File name:

HWiNFO_Monitor_Setup.exe

Full analysis: https://app.any.run/tasks/e61ec6fb-331f-4bb7-825d-2c881e6cd706
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 10, 2026, 22:44:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
cpuz
tool
stealer
fake-filezilla
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

CDC459A866361463D719BC89622300F3

SHA1:

02A53D660332C25AF623BBB7DF57C2AAD1B0B91B

SHA256:

EEFC0F986DD3EA376A4A54F80CE0DC3E6491165AEFDD7D5D6005DA3892CE248F

SSDEEP:

98304:yBPF0PN/Yi+UKcy9iuPrstBUlwBZL1+7/1f7ZaG6TCoIFhQyNIiMoyfPKnQ1VxTY:tMO3CMPy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Trojanized FileZilla has been detected

      • HWMonitor.exe (PID: 7320)

    • Reads a specific registry key of the VM

      • HWMonitor.exe (PID: 7320)
      • powershell.exe (PID: 2324)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)
      • HWMonitor.exe (PID: 7320)
      • csc.exe (PID: 7636)
      • HWiNFO_Monitor_Setup.tmp (PID: 2304)

    • Reads the Windows owner or organization settings

      • HWiNFO_Monitor_Setup.tmp (PID: 2304)

    • Starts POWERSHELL.EXE for commands execution

      • HWMonitor.exe (PID: 7320)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 736)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7636)

    • Reads the BIOS version

      • HWMonitor.exe (PID: 7320)
      • powershell.exe (PID: 2324)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 2324)

  • INFO

    • Checks supported languages

      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • HWiNFO_Monitor_Setup.tmp (PID: 2304)
      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWMonitor.exe (PID: 7320)
      • csc.exe (PID: 7636)
      • cvtres.exe (PID: 6732)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)

    • Reads security settings of Internet Explorer

      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWMonitor.exe (PID: 7320)

    • Reads the computer name

      • HWiNFO_Monitor_Setup.tmp (PID: 2304)
      • HWMonitor.exe (PID: 7320)
      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)

    • Compiled with Borland Delphi (YARA)

      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)

    • Create files in a temporary directory

      • HWiNFO_Monitor_Setup.tmp (PID: 2304)
      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • csc.exe (PID: 7636)
      • cvtres.exe (PID: 6732)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)

    • Detects InnoSetup installer (YARA)

      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)

    • The sample compiled with english language support

      • HWiNFO_Monitor_Setup.tmp (PID: 2304)
      • HWMonitor.exe (PID: 7320)

    • Manual execution by a user

      • HWMonitor.exe (PID: 5888)
      • HWMonitor.exe (PID: 7320)

    • CPUZ mutex has been found

      • HWMonitor.exe (PID: 7320)

    • Creates a software uninstall entry

      • HWiNFO_Monitor_Setup.tmp (PID: 2304)

    • Reads the machine GUID from the registry

      • HWMonitor.exe (PID: 7320)
      • csc.exe (PID: 7636)

    • Reads CPU info

      • HWMonitor.exe (PID: 7320)

    • Reads the time zone

      • HWMonitor.exe (PID: 7320)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 2324)

    • Creates files or folders in the user directory

      • HWMonitor.exe (PID: 7320)

    • Process checks computer location settings

      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2026:02:11 11:40:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 726016
InitializedDataSize: 178688
UninitializedDataSize: -
EntryPoint: 0xb1e60
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: CPUID
FileDescription: HWiNFO Monitor Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: HWiNFO Monitor
ProductVersion: 1.63
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
11
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start hwinfo_monitor_setup.exe hwinfo_monitor_setup.tmp no specs hwinfo_monitor_setup.exe hwinfo_monitor_setup.tmp hwmonitor.exe no specs #FAKE-FILEZILLA hwmonitor.exe powershell.exe conhost.exe no specs wmiapsrv.exe no specs csc.exe cvtres.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736C:\WINDOWS\system32\wbem\WmiApSrv.exeC:\Windows\System32\wbem\WmiApSrv.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Performance Reverse Adapter
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\psapi.dll
1684"C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe" C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe
explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
HWiNFO Monitor Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\hwinfo_monitor_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
2304"C:\Users\admin\AppData\Local\Temp\is-99NZTHBL5L.tmp\HWiNFO_Monitor_Setup.tmp" /SL5="$13010C,3034253,905728,C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe" /SPAWNWND=$1603AC /FIRSTWND=$90302 C:\Users\admin\AppData\Local\Temp\is-99NZTHBL5L.tmp\HWiNFO_Monitor_Setup.tmp
HWiNFO_Monitor_Setup.exe
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1054.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-99nzthbl5l.tmp\hwinfo_monitor_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2308"C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe" /SPAWNWND=$1603AC /FIRSTWND=$90302 C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe
HWiNFO_Monitor_Setup.tmp
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
HWiNFO Monitor Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\hwinfo_monitor_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
2324C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::In.ReadToEnd() | Invoke-Expression"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
HWMonitor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5888"C:\Program Files\CPUID\HWiNFO\HWMonitor.exe" C:\Program Files\CPUID\HWiNFO\HWMonitor.exe—explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
HWMonitor
Exit code:
3221226540
Version:
1, 6, 3, 0
Modules
Images
c:\program files\cpuid\hwinfo\hwmonitor.exe
c:\windows\system32\ntdll.dll
6148"C:\Users\admin\AppData\Local\Temp\is-0BHNVU88Q5.tmp\HWiNFO_Monitor_Setup.tmp" /SL5="$90302,3034253,905728,C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe" C:\Users\admin\AppData\Local\Temp\is-0BHNVU88Q5.tmp\HWiNFO_Monitor_Setup.tmp—HWiNFO_Monitor_Setup.exe
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1054.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-0bhnvu88q5.tmp\hwinfo_monitor_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6732C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESA17B.tmp" "c:\Users\admin\AppData\Local\Temp\g3fijyed\CSCBB0EB4BA70B460F887BA3E3AB2F41.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_clr0400.dll
7320"C:\Program Files\CPUID\HWiNFO\HWMonitor.exe" C:\Program Files\CPUID\HWiNFO\HWMonitor.exe
explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
HWMonitor
Version:
1, 6, 3, 0
Modules
Images
c:\program files\cpuid\hwinfo\hwmonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
10 866
Read events
10 827
Write events
39
Delete events
0

Modification events

(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.7.1
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\CPUID\HWiNFO
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\CPUID\HWiNFO\
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
CPUID\HWiNFO
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
desktopicon
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Language
Value:
russian
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:DisplayName
Value:
HWiNFO Monitor, версия 1.63
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\CPUID\HWiNFO\HWiNFO.exe
Executable files
13
Suspicious files
11
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\HWMonitor.exeexecutable
MD5:5AC249F46A574A7DCFE900D42D4AF4C5
SHA256:02DB6764D1F13B837B0A525E5931BDBC67E7A2A4D071E849C7E087255D4A2D5B
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\is-YCUZZ1QCAJ.tmpexecutable
MD5:5AC249F46A574A7DCFE900D42D4AF4C5
SHA256:02DB6764D1F13B837B0A525E5931BDBC67E7A2A4D071E849C7E087255D4A2D5B
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\unins000.msgbinary
MD5:313D0CC5D1A64D2565E35937991775A6
SHA256:5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
1684HWiNFO_Monitor_Setup.exeC:\Users\admin\AppData\Local\Temp\is-0BHNVU88Q5.tmp\HWiNFO_Monitor_Setup.tmpexecutable
MD5:3E447B198F4BF47B6CA383B9318D80A3
SHA256:6543DAA30E7F7F491E0D467BFC312C8C590B1D6CF042B703A3DB2AF37C77F914
2308HWiNFO_Monitor_Setup.exeC:\Users\admin\AppData\Local\Temp\is-99NZTHBL5L.tmp\HWiNFO_Monitor_Setup.tmpexecutable
MD5:3E447B198F4BF47B6CA383B9318D80A3
SHA256:6543DAA30E7F7F491E0D467BFC312C8C590B1D6CF042B703A3DB2AF37C77F914
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\CRYPTBASE.dllexecutable
MD5:8B76280EAA6F34B3D3FC55E14F676314
SHA256:776446FAF98A68F6EBC36E800455645CF04197EDD4C249C6B2FE178C86B18652
2304HWiNFO_Monitor_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-TQJHFW4Y17.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\unins000.exeexecutable
MD5:176E0D21114AB4CB4DDA16D15071D7C0
SHA256:5E9B42E797477B04E2CD2C17DE7A43830378A5813C486BEBA29EDB655C898A62
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\is-T1IZ5X6CHF.tmpexecutable
MD5:176E0D21114AB4CB4DDA16D15071D7C0
SHA256:5E9B42E797477B04E2CD2C17DE7A43830378A5813C486BEBA29EDB655C898A62
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\is-2RVAFVDFGH.tmpexecutable
MD5:8B76280EAA6F34B3D3FC55E14F676314
SHA256:776446FAF98A68F6EBC36E800455645CF04197EDD4C249C6B2FE178C86B18652
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
32
DNS requests
20
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
5276
MoUsoCoreWorker.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
7052
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
7052
SIHClient.exe
GET
200
20.165.94.54:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
7052
SIHClient.exe
GET
200
74.178.240.61:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
7052
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5392
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5532
SearchApp.exe
POST
204
2.16.204.141:443
https://www.bing.com/threshold/xls.aspx?t=5&dl=1&f=9&wsbc=1
NL
—
—
whitelisted
5392
svchost.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
7052
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
US
binary
407 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5392
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
5392
svchost.exe
23.48.23.194:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5392
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5532
SearchApp.exe
2.16.204.141:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
5532
SearchApp.exe
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 4.231.128.59
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
google.com
  • 142.251.127.113
  • 142.251.127.101
  • 142.251.127.100
  • 142.251.127.139
  • 142.251.127.138
  • 142.251.127.102
whitelisted
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.159
  • 23.48.23.143
  • 23.48.23.158
  • 23.48.23.140
  • 23.48.23.139
  • 23.48.23.147
  • 23.48.23.145
  • 23.48.23.138
whitelisted
www.microsoft.com
  • 23.59.18.102
whitelisted
www.bing.com
  • 2.16.204.141
  • 2.16.204.161
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted

Threats

PID
Process
Class
Message
5392
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
7320
HWMonitor.exe
Misc activity
ET INFO Cloudflare DNS Over HTTPS Certificate Inbound
2324
powershell.exe
Misc activity
HUNTING [ANY.RUN] TCP binary protocol 32-BE data-len prefix on non-standard port inbound
2324
powershell.exe
Misc activity
HUNTING [ANY.RUN] TCP binary protocol 32-BE data-len prefix on non-standard port outbound
2324
powershell.exe
Misc activity
HUNTING [ANY.RUN] TCP binary protocol 16-BE data-len prefix on non-standard port outbound
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HWiNFO_Monitor_Setup.exe