File name:

file_ed203554c19a48558fbeb8f2be2232b3_2025-05-19_13_37_26_743000.zip

Full analysis: https://app.any.run/tasks/c78cb5a5-fee0-4383-9e3d-e88cb57e0549
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 13:39:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
loader
stealer
cpuz-sys
vuln-driver
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

1C488C73E147B761557D5428F6D720A3

SHA1:

35D68A6F5B136E206164C862DCB5D882916B1003

SHA256:

F652CFAC550C7B667E796C25B123AF04C911155EC9CF2538B272F7537BAE1A83

SSDEEP:

98304:FmqLG30ludy82S5hg3tXncYCyXvaKFqnPgFB1WUYFf9OxTCzVhcUGy5sNs1j+Aj5:nz7jw3Hp2HVxRa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4996)

    • Executing a file with an untrusted certificate

      • spsetup131.exe (PID: 1532)
      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)

    • Actions looks like stealing of personal data

      • spsetup131.exe (PID: 6244)

    • Vulnerable driver has been detected

      • Speccy64.exe (PID: 5136)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • spsetup131.exe (PID: 6244)

    • Reads Internet Explorer settings

      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)

    • The process creates files with name similar to system file names

      • spsetup131.exe (PID: 6244)

    • Executable content was dropped or overwritten

      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)

    • Searches for installed software

      • spsetup131.exe (PID: 6244)

    • Reads security settings of Internet Explorer

      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)

    • Process requests binary or script from the Internet

      • spsetup131.exe (PID: 6244)

    • There is functionality for taking screenshot (YARA)

      • spsetup131.exe (PID: 6244)

    • Drops a system driver (possible attempt to evade defenses)

      • Speccy64.exe (PID: 5136)

    • Checks for external IP

      • Speccy64.exe (PID: 5136)

    • Reads the date of Windows installation

      • Speccy64.exe (PID: 5136)

    • Checks for Java to be installed

      • Speccy64.exe (PID: 5136)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 7312)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4996)

    • Reads the software policy settings

      • slui.exe (PID: 6640)
      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)

    • The sample compiled with english language support

      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)

    • Create files in a temporary directory

      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)

    • Manual execution by a user

      • spsetup131.exe (PID: 1532)
      • spsetup131.exe (PID: 6244)
      • msedge.exe (PID: 2908)

    • Reads Environment values

      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)
      • identity_helper.exe (PID: 7764)

    • Checks proxy server information

      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)

    • Reads the machine GUID from the registry

      • spsetup131.exe (PID: 6244)

    • Creates files in the program directory

      • spsetup131.exe (PID: 6244)
      • java.exe (PID: 7436)

    • Checks supported languages

      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)
      • java.exe (PID: 7436)

    • Process checks computer location settings

      • spsetup131.exe (PID: 6244)

    • Reads product name

      • Speccy64.exe (PID: 5136)

    • Application launched itself

      • msedge.exe (PID: 2344)
      • msedge.exe (PID: 2908)
      • msedge.exe (PID: 7852)

    • Creates files or folders in the user directory

      • spsetup131.exe (PID: 6244)
      • Speccy64.exe (PID: 5136)

    • Process checks Powershell version

      • Speccy64.exe (PID: 5136)

    • Reads the computer name

      • identity_helper.exe (PID: 7764)

    • Process checks whether UAC notifications are on

      • Speccy64.exe (PID: 5136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0800
ZipCompression: None
ZipModifyDate: 2025:05:19 15:37:50
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: entry001/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
202
Monitored processes
65
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe slui.exe no specs spsetup131.exe no specs spsetup131.exe ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs msedge.exe no specs THREAT speccy64.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs java.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs icacls.exe no specs conhost.exe no specs wmiapsrv.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6844 --field-trial-handle=2480,i,10361503685205977438,12553789622602328317,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3544 --field-trial-handle=2480,i,10361503685205977438,12553789622602328317,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—PING.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2672 --field-trial-handle=2312,i,7889704518617610921,3524738106991297988,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1532"C:\Users\admin\Desktop\spsetup131.exe" C:\Users\admin\Desktop\spsetup131.exe—explorer.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
MEDIUM
Description:
Speccy Installer
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\spsetup131.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4364 --field-trial-handle=2312,i,7889704518617610921,3524738106991297988,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2344"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.piriform.com/go/app_releasenotes?p=4&v=1.31.732&l=1033&b=1&a=0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—spsetup131.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2416"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4108 --field-trial-handle=2480,i,10361503685205977438,12553789622602328317,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2780"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4408 --field-trial-handle=2480,i,10361503685205977438,12553789622602328317,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2852ping -n 1 -w 5000 www.piriform.comC:\Windows\SysWOW64\PING.EXE—spsetup131.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
13 107
Read events
13 027
Write events
63
Delete events
17

Modification events

(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\file_ed203554c19a48558fbeb8f2be2232b3_2025-05-19_13_37_26_743000.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
103
Suspicious files
167
Text files
64
Unknown types
0

Dropped files

PID
Process
Filename
Type
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\p\pfWWW.dllexecutable
MD5:CB1D8D51ABC47FCF036A8AAC36C5F4AA
SHA256:903EBBD07A9D551E41BA8CF581069E5E1C70894D2E6473C009B8CED94E8C0D2F
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\ui\res\lang-1026.dllexecutable
MD5:4CC7B57B9D59F75CCC5D113CAA45F493
SHA256:DE8136F59BB16605E883CDA174731F4617E67534D217F116D0EEAFAC5BDB0AC5
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\System.dllexecutable
MD5:41A3C964232EDD2D7D5EDEA53E8245CD
SHA256:8B65FEC615C7B371C23F8F7F344B12DC5085E40A556F96DB318ED757494D62D5
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\g\gcapi_dll.dllexecutable
MD5:2973AF8515EFFD0A3BFC7A43B03B3FCC
SHA256:D0E4581210A22135CE5DEB47D9DF4D636A94B3813E0649AAB84822C9F08AF2A0
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\nsExec.dllexecutable
MD5:5ED60250F74FA36A5A247A715BCD026E
SHA256:EA8026766ADC2D7CC26E2206CFDF5F0865B1426BFE3BC2AEC8F43D3FC9A072EF
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\ui\pfUI.dllexecutable
MD5:1DAF05AEF6CC99EF780423F7CE9A8224
SHA256:723EA2E50FF908B8AC33A3C4738CDF5136FEEE3D87BFB550065BF726A7379DF2
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\ui\res\PF_logo.pngimage
MD5:079CCA30760CCA3C01863B6B96E87848
SHA256:8DD37D3721E25C32C5BF878B6DBA9E61D04B7CE8AEC45BDF703A41BC41802DFA
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\ui\res\Speccy_Logo_72px.pngimage
MD5:1787175D95EAB213CF5A8BC25E252676
SHA256:65FA6BAA9D140251D04069CF538F3262EBBB0E4E62D58D06CC58AD8B22085A83
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\ui\res\Montserrat-Regular.otfbinary
MD5:27E50FFD6A14CBC8221C9DBD3B5208DC
SHA256:40FC1142200A5C1C18F80B6915257083C528C7F7FD2B00A552AEEBC42898D428
6244spsetup131.exeC:\Users\admin\AppData\Local\Temp\nsbD05F.tmp\ui\res\lang-1031.dllexecutable
MD5:50E32F13D56147F9EB10BE3560DF7F4B
SHA256:108924CE60C8BB7676AC6124D9D986FACE575B1E8797DC29DF39A1BC6128CB33
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
129
DNS requests
166
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6244
spsetup131.exe
GET
302
23.45.99.21:80
http://service.piriform.com/installcheck.aspx?p=4&v=1.31.732&vx=&l=1033&b=1&o=10W6&g=0&i=1&a=0&c=0&d=0&e=0&n=spsetup131.exe&id=003
unknown
—
—
whitelisted
5800
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6244
spsetup131.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
5800
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5136
Speccy64.exe
GET
302
23.45.99.21:80
http://www.piriform.com/auto?p=sp&v=1.31.732&l=1033&o=6.2W6&lk=&mk=BXRJ-R3BN-G8KM-4Z2M-3SGJ-4IVA-3432-99N6-ZHK6
unknown
—
—
whitelisted
5136
Speccy64.exe
GET
301
2.19.225.128:80
http://www.ccleaner.com/auto?p=sp&v=1.31.732&l=1033&o=6.2W6&lk=&mk=BXRJ-R3BN-G8KM-4Z2M-3SGJ-4IVA-3432-99N6-ZHK6
unknown
—
—
whitelisted
5136
Speccy64.exe
GET
—
13.90.213.204:80
http://speccy.piriform.com/ip/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.22:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.22
  • 23.216.77.21
  • 23.216.77.6
  • 23.216.77.31
  • 23.216.77.19
  • 23.216.77.28
  • 23.216.77.8
  • 23.216.77.42
  • 23.216.77.13
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.2
  • 40.126.32.72
  • 20.190.160.64
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.76
  • 20.190.160.3
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
5772
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5772
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5772
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5772
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5772
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5772
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5772
msedge.exe
Misc activity
INFO [ANY.RUN] Possible short link service (t .co)
5772
msedge.exe
Misc activity
INFO [ANY.RUN] Possible short link service (t .co)
5772
msedge.exe
Misc activity
INFO [ANY.RUN] Possible short link service (t .co)
5772
msedge.exe
Misc activity
INFO [ANY.RUN] Possible short link service (t .co)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
file_ed203554c19a48558fbeb8f2be2232b3_2025-05-19_13_37_26_743000.zip