File name:

Bloody.Proxy.Scraper.exe

Full analysis: https://app.any.run/tasks/f6b106b1-071a-4138-82e2-72500abf432f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:22:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
trox
stealer
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

56F5CC5831B62239C5DC8B75578EDDA5

SHA1:

F3E1E8AF328153FAC798126F98C5D5579BEA103E

SHA256:

EF4547D009D8A02BC14DB69D979988A8B90FCA01A6C908F7D734D9C8CD584D12

SSDEEP:

98304:0hVj57lsLW1dieOBXDvjh0JGXOURipHvbVbhuixOPyVXrxvxwSmDZq9cbeVrbFfu:0emGNLAPXnwbVcRqtzzTSI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • TROX has been detected

      • Bloody.Proxy.Scraper.exe (PID: 7224)
      • Bloody.Proxy.Scraper.exe (PID: 8036)

  • SUSPICIOUS

    • Process drops python dynamic module

      • Bloody.Proxy.Scraper.exe (PID: 7224)
      • Bloody.Proxy.Scraper.exe (PID: 8036)

    • Executable content was dropped or overwritten

      • Bloody.Proxy.Scraper.exe (PID: 7224)
      • Bloody.Proxy.Scraper.exe (PID: 8036)

    • Starts CMD.EXE for commands execution

      • main.exe (PID: 7324)
      • main.exe (PID: 7616)

    • Loads Python modules

      • main.exe (PID: 7324)
      • main.exe (PID: 7616)

    • Reads security settings of Internet Explorer

      • Bloody.Proxy.Scraper.exe (PID: 7224)
      • Bloody.Proxy.Scraper.exe (PID: 8036)
      • ShellExperienceHost.exe (PID: 7208)

  • INFO

    • Create files in a temporary directory

      • Bloody.Proxy.Scraper.exe (PID: 7224)
      • Bloody.Proxy.Scraper.exe (PID: 8036)

    • The sample compiled with english language support

      • Bloody.Proxy.Scraper.exe (PID: 7224)
      • Bloody.Proxy.Scraper.exe (PID: 8036)

    • Checks supported languages

      • main.exe (PID: 7324)
      • Bloody.Proxy.Scraper.exe (PID: 7224)
      • main.exe (PID: 7616)
      • Bloody.Proxy.Scraper.exe (PID: 8036)
      • ShellExperienceHost.exe (PID: 7208)

    • Checks operating system version

      • main.exe (PID: 7324)
      • main.exe (PID: 7616)

    • Reads the computer name

      • Bloody.Proxy.Scraper.exe (PID: 7224)
      • Bloody.Proxy.Scraper.exe (PID: 8036)
      • ShellExperienceHost.exe (PID: 7208)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8008)
      • BackgroundTransferHost.exe (PID: 1280)
      • BackgroundTransferHost.exe (PID: 1324)
      • BackgroundTransferHost.exe (PID: 4608)
      • BackgroundTransferHost.exe (PID: 4200)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 1280)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 1280)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 1280)
      • slui.exe (PID: 7380)

    • Manual execution by a user

      • Bloody.Proxy.Scraper.exe (PID: 8036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:09:20 08:33:29+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 130048
InitializedDataSize: 11263488
UninitializedDataSize: -
EntryPoint: 0xc4fc
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
17
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #TROX bloody.proxy.scraper.exe conhost.exe no specs main.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #TROX bloody.proxy.scraper.exe conhost.exe no specs main.exe no specs cmd.exe no specs shellexperiencehost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1280"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1324"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4200"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4608"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7208"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
7224"C:\Users\admin\Desktop\Bloody.Proxy.Scraper.exe" C:\Users\admin\Desktop\Bloody.Proxy.Scraper.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\bloody.proxy.scraper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
7236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Bloody.Proxy.Scraper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7324"C:\Users\admin\Desktop\Bloody.Proxy.Scraper.exe" C:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\main.exe—Bloody.Proxy.Scraper.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\onefile_7224_133873465836409863\main.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\onefile_7224_133873465836409863\python311.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
7332C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7380"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 662
Read events
4 645
Write events
17
Delete events
0

Modification events

(PID) Process:(8008) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8008) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8008) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1280) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1280) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1280) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4608) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4608) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4608) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1324) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
48
Suspicious files
5
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7224Bloody.Proxy.Scraper.exeC:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\_lzma.pydexecutable
MD5:BC07D7AC5FDC92DB1E23395FDE3420F2
SHA256:AB822F7E846D4388B6F435D788A028942096BA1344297E0B7005C9D50814981B
7224Bloody.Proxy.Scraper.exeC:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\_queue.pydexecutable
MD5:E0CC8C12F0B289EA87C436403BC357C1
SHA256:9517689D7D97816DEE9E6C01FFD35844A3AF6CDE3FF98F3A709D52157B1ABE03
7224Bloody.Proxy.Scraper.exeC:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\_bz2.pydexecutable
MD5:A8A37BA5E81D967433809BF14D34E81D
SHA256:50E21CE62F8D9BAB92F6A7E9B39A86406C32D2DF18408BB52FFB3D245C644C7B
7224Bloody.Proxy.Scraper.exeC:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\_decimal.pydexecutable
MD5:5E8AA9CD4742A51ACC5B2155770241D5
SHA256:59FEE7A8D0A85ED98BBF5DFB7A0AD64B60CBE88427EFD98B3C9FAAD3E4421A87
7224Bloody.Proxy.Scraper.exeC:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\libssl-1_1.dllexecutable
MD5:86F2D9CC8CC54BBB005B15CABF715E5D
SHA256:D98DD943517963FD0E790FDE00965822AA4E4A48E8A479AFAD74ABF14A300771
7224Bloody.Proxy.Scraper.exeC:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\_socket.pydexecutable
MD5:290DBF92268AEBDE8B9507B157BEF602
SHA256:E05C5342D55CB452E88E041061FABA492D6DD9268A7F67614A8143540ACA2BFE
7224Bloody.Proxy.Scraper.exeC:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\libcrypto-1_1.dllexecutable
MD5:80B72C24C74D59AE32BA2B0EA5E7DAD2
SHA256:EB975C94E5F4292EDD9A8207E356FE4EA0C66E802C1E9305323D37185F85AD6D
7224Bloody.Proxy.Scraper.exeC:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\pyexpat.pydexecutable
MD5:C5C1CA1B3641772E661F85EF0166FD6C
SHA256:3D81D06311A8A15967533491783EA9C7FC88D594F40EEE64076723CEBDD58928
1280BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9e8de41c-4a54-4cba-a416-733fc0173615.down_data —
MD5:—
SHA256:—
7224Bloody.Proxy.Scraper.exeC:\Users\admin\AppData\Local\Temp\onefile_7224_133873465836409863\_ssl.pydexecutable
MD5:0A7EB5D67B14B983A38F82909472F380
SHA256:3BAC94D8713A143095EF8E2F5D2B4A3765EBC530C8CA051080D415198CECF380
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7604
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1280
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7932
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7932
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
976
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.128
  • 20.190.159.23
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.129
  • 40.126.31.67
  • 40.126.31.2
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.185
  • 104.126.37.163
  • 104.126.37.128
  • 104.126.37.176
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.161
  • 104.126.37.145
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bloody.Proxy.Scraper.exe