File name:

wifi-hacker-pro_setup.exe

Full analysis: https://app.any.run/tasks/feb7eec2-22b5-481b-ada5-ebf3b475f822
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 30, 2024, 11:27:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
mircop
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

57E48A1B8AFAC106772BF4C348D6AB85

SHA1:

AB3F2BA3BF7F46E88ADE5198FF47CD967DF156CB

SHA256:

EE20C3F6460C5BDE502FA0D2CA7A909B2D4408D6D490C9664CA667EF9813DC78

SSDEEP:

24576:4yIQ9ZUU6KYQYLX5nNKbtV0m0qPZlvW+5xJSaYx4JzqCOxMuBRUq:4yW5KILdN2bRfPbWK6X4JGd1aq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • wifi-hacker-pro_setup.exe (PID: 3972)
      • wifi-hacker-pro_setup.exe (PID: 1020)
      • wifi-hacker-pro_setup.tmp (PID: 2104)
      • tool2.exe (PID: 312)

    • Changes the login/logoff helper path in the registry

      • tool3.exe (PID: 660)
      • tool3.exe (PID: 728)

    • Changes the autorun value in the registry

      • tool3.exe (PID: 660)
      • tool3.exe (PID: 728)
      • reg.exe (PID: 2924)

    • Creates a writable file in the system directory

      • wusa.exe (PID: 444)

    • MIRCOP has been detected

      • tool2.exe (PID: 312)

    • Create files in the Startup directory

      • cmd.exe (PID: 2044)
      • tool2.exe (PID: 312)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 2044)
      • net.exe (PID: 3000)
      • net.exe (PID: 3084)
      • net.exe (PID: 2736)
      • net.exe (PID: 3060)
      • net.exe (PID: 2912)

    • Uses NET.EXE to stop Windows Update service

      • net.exe (PID: 3060)
      • cmd.exe (PID: 2044)

    • UAC/LUA settings modification

      • reg.exe (PID: 3112)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • wifi-hacker-pro_setup.exe (PID: 3972)
      • wifi-hacker-pro_setup.exe (PID: 1020)
      • wifi-hacker-pro_setup.tmp (PID: 2104)
      • wusa.exe (PID: 444)
      • tool2.exe (PID: 312)

    • Reads the Windows owner or organization settings

      • wifi-hacker-pro_setup.tmp (PID: 2104)

    • Reads the Internet Settings

      • Wifi-hacker-pro.exe (PID: 1064)
      • cmd.exe (PID: 2044)
      • cmd.exe (PID: 1424)
      • tool2.exe (PID: 312)
      • wscript.exe (PID: 2740)
      • sipnotify.exe (PID: 128)

    • Starts CMD.EXE for commands execution

      • Wifi-hacker-pro.exe (PID: 1064)
      • tool2.exe (PID: 312)
      • migwiz.exe (PID: 2852)

    • Executing commands from a ".bat" file

      • Wifi-hacker-pro.exe (PID: 1064)

    • The process executes VB scripts

      • cmd.exe (PID: 2044)
      • tool2.exe (PID: 312)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 2044)

    • Reads security settings of Internet Explorer

      • Wifi-hacker-pro.exe (PID: 1064)
      • tool2.exe (PID: 312)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2044)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2044)
      • cmd.exe (PID: 3052)

    • Creates file in the systems drive root

      • cmd.exe (PID: 2044)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2044)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 2044)

    • Write to the desktop.ini file (may be used to cloak folders)

      • tool2.exe (PID: 312)

    • Changes the desktop background image

      • tool2.exe (PID: 312)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 640)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2740)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 128)

  • INFO

    • Create files in a temporary directory

      • wifi-hacker-pro_setup.exe (PID: 3972)
      • wifi-hacker-pro_setup.exe (PID: 1020)
      • Wifi-hacker-pro.exe (PID: 1064)
      • tool2.exe (PID: 312)

    • Checks supported languages

      • wifi-hacker-pro_setup.exe (PID: 3972)
      • wifi-hacker-pro_setup.exe (PID: 1020)
      • wifi-hacker-pro_setup.tmp (PID: 3988)
      • wifi-hacker-pro_setup.tmp (PID: 2104)
      • Wifi-hacker-pro.exe (PID: 1064)
      • tool2.exe (PID: 312)
      • tool3.exe (PID: 660)
      • tool3.exe (PID: 728)

    • Reads the computer name

      • wifi-hacker-pro_setup.tmp (PID: 3988)
      • wifi-hacker-pro_setup.tmp (PID: 2104)
      • Wifi-hacker-pro.exe (PID: 1064)
      • tool2.exe (PID: 312)
      • tool3.exe (PID: 728)
      • tool3.exe (PID: 660)

    • Creates files in the program directory

      • wifi-hacker-pro_setup.tmp (PID: 2104)

    • Creates a software uninstall entry

      • wifi-hacker-pro_setup.tmp (PID: 2104)

    • Reads the machine GUID from the registry

      • Wifi-hacker-pro.exe (PID: 1064)
      • tool2.exe (PID: 312)

    • Reads mouse settings

      • tool2.exe (PID: 312)

    • Application launched itself

      • msedge.exe (PID: 588)

    • Drops the executable file immediately after the start

      • wusa.exe (PID: 444)

    • Creates files or folders in the user directory

      • tool2.exe (PID: 312)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 128)

    • Reads the software policy settings

      • sipnotify.exe (PID: 128)

    • Manual execution by a user

      • sipnotify.exe (PID: 128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41984
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0xaad0
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: unknown
FileDescription: Wifi-hacker-pro Setup
FileVersion:
LegalCopyright:
ProductName: Wifi-hacker-pro
ProductVersion: 1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
61
Malicious processes
10
Suspicious processes
4

Behavior graph

Click at the process to see the details
start wifi-hacker-pro_setup.exe wifi-hacker-pro_setup.tmp no specs wifi-hacker-pro_setup.exe wifi-hacker-pro_setup.tmp wifi-hacker-pro.exe no specs cmd.exe wscript.exe no specs notepad.exe no specs tool2.exe tool3.exe tool3.exe msedge.exe wscript.exe no specs rundll32.exe no specs msedge.exe no specs cmd.exe no specs wusa.exe no specs wusa.exe no specs wusa.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs wscript.exe no specs migwiz.exe no specs reg.exe no specs attrib.exe no specs attrib.exe no specs reg.exe no specs reg.exe reg.exe no specs net.exe no specs migwiz.exe net1.exe no specs net.exe no specs net1.exe no specs taskkill.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs netsh.exe no specs cmd.exe no specs reg.exe no specs net.exe no specs net1.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ctfmon.exe no specs sipnotify.exe

Process information

PID
CMD
Path
Indicators
Parent process
128C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
308"C:\Windows\system32\NOTEPAD.EXE" C:\script\tool\email.txtC:\Windows\System32\notepad.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
312C:\script\tool\tool2.exe C:\script\tool\tool2.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\script\tool\tool2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
444"C:\Windows\system32\wusa.exe" C:\Users\admin\AppData\Local\Temp\32.cab /quiet /extract:C:\Windows\system32\migwiz\ C:\Windows\System32\wusa.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
588"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.locked.org/C:\Program Files\Microsoft\Edge\Application\msedge.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
640C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CTF Loader
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
660C:\script\tool\tool3.exe C:\script\tool\tool3.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1073807364
Modules
Images
c:\script\tool\tool3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
676"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1308 --field-trial-handle=1264,i,10069390866641049358,2139709077082072597,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
692"C:\Windows\System32\WScript.exe" "C:\script\tool\msg.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1073807364
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
728tool3.exe C:\script\tool\tool3.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1073807364
Modules
Images
c:\script\tool\tool3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
20 640
Read events
20 366
Write events
257
Delete events
17

Modification events

(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
38080000DA6C8877F19ADA01
(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
0D1BA97CAD7EDAFD3BD626C298BF40A50307B362613C89671EB305A3AE73FE73
(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\script\tool\Wifi-hacker-pro.exe
(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
A26CB5187533AA62F0A483FD40893CFF3D550697DEA452D97A50CC8C684EAC4F
(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB59919C-D02B-462D-B70C-DC3834D16039}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (a)
(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB59919C-D02B-462D-B70C-DC3834D16039}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\script\tool
(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB59919C-D02B-462D-B70C-DC3834D16039}_is1
Operation:writeName:InstallLocation
Value:
C:\script\tool\
(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB59919C-D02B-462D-B70C-DC3834D16039}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(2104) wifi-hacker-pro_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB59919C-D02B-462D-B70C-DC3834D16039}_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
14
Suspicious files
68
Text files
59
Unknown types
39

Dropped files

PID
Process
Filename
Type
2104wifi-hacker-pro_setup.tmpC:\script\tool\Wifi-hacker-pro.exeexecutable
MD5:52E05136434440D94FE786E070E54001
SHA256:07C8AE2310DDDF4D06CA14A60A6FAC90A38617EB2179CE36512F2642E6DAB527
2104wifi-hacker-pro_setup.tmpC:\script\tool\is-HTH0Q.tmpexecutable
MD5:52E05136434440D94FE786E070E54001
SHA256:07C8AE2310DDDF4D06CA14A60A6FAC90A38617EB2179CE36512F2642E6DAB527
1020wifi-hacker-pro_setup.exeC:\Users\admin\AppData\Local\Temp\is-NJAU6.tmp\wifi-hacker-pro_setup.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
2104wifi-hacker-pro_setup.tmpC:\script\tool\is-6B9JI.tmpexecutable
MD5:E99FC87D8C6DAEF0C8A3D72431CA94E7
SHA256:54B2E5EE18A664AEB831DED10595729F1FE298C63D3820EDA6ABE8103F2E6ECD
2104wifi-hacker-pro_setup.tmpC:\script\tool\is-5BU7A.tmpexecutable
MD5:FCC241C9768F58F4E712D302067DDD4B
SHA256:F70CF4847CC03E4007CAE281BA6B9FE23143E99241CBBE659A824156B9244A09
2104wifi-hacker-pro_setup.tmpC:\script\tool\unins000.exeexecutable
MD5:E99FC87D8C6DAEF0C8A3D72431CA94E7
SHA256:54B2E5EE18A664AEB831DED10595729F1FE298C63D3820EDA6ABE8103F2E6ECD
2104wifi-hacker-pro_setup.tmpC:\script\tool\tool2.exeexecutable
MD5:FCC241C9768F58F4E712D302067DDD4B
SHA256:F70CF4847CC03E4007CAE281BA6B9FE23143E99241CBBE659A824156B9244A09
2104wifi-hacker-pro_setup.tmpC:\script\tool\is-R39JG.tmptext
MD5:24F515663349689E75E38F4AF620C7C5
SHA256:949535E590AF4D64EC74BBA154248183147803BEF2BA2752B9923B309C5F24FC
2104wifi-hacker-pro_setup.tmpC:\script\tool\wifi ikon.pngimage
MD5:D23DF13A5705981E1A9DD4EE2DC1ACA6
SHA256:5E9790AF80FCF5B8292D83B3CBA6614AEF67AFC6BF6568FB48C73341BBF4F495
2104wifi-hacker-pro_setup.tmpC:\script\tool\is-IIVIU.tmptext
MD5:FD7268C0FDD974163399F88B7AF10AC6
SHA256:DCFE78E309E68A602A185033C80D9069347AF217D9D172A333A4E5043CDABFD7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
21
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
128
sipnotify.exe
HEAD
200
104.93.93.45:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133589537813120000
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
676
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
588
msedge.exe
239.255.255.250:1900
—
—
—
unknown
676
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
676
msedge.exe
2.19.193.82:443
www.bing.com
Akamai International B.V.
TR
unknown
588
msedge.exe
224.0.0.251:5353
—
—
—
unknown
676
msedge.exe
152.199.21.175:443
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
EDGECAST
DE
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
unknown
www.locked.org
  • —
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
unknown
google.com
  • 142.250.184.238
  • 142.250.185.238
unknown
www.bing.com
  • 2.19.193.82
  • 2.19.193.104
  • 2.19.193.107
  • 2.19.193.90
  • 2.19.193.88
  • 2.19.193.83
  • 2.19.193.99
  • 2.19.193.96
  • 2.19.193.91
unknown
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 152.199.21.175
unknown
query.prod.cms.rt.microsoft.com
  • 104.93.93.45
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
wifi-hacker-pro_setup.exe