URL:

https://www.solvusoft.com/en/download/winthruster/

Full analysis: https://app.any.run/tasks/503cd420-0268-4299-a8c9-825f84a5ac72
Verdict: No threats detected
Analysis date: September 19, 2020, 00:10:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

52C1BD54D6AFC07104211D989878E595

SHA1:

97FEC9E05F2AD272C9CC736F98ABCBAA69975FBC

SHA256:

FB1702FACC9B5C68C6C485DCA84860F194D2CC7332DDD27FB60D5D5354258AA0

SSDEEP:

3:N8DSLgN4GFBKSCNFQWgK:2OLGXFBSFD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Setup_WinThruster_2020.exe (PID: 3488)
      • Setup_WinThruster_2020.exe (PID: 2380)
      • WinThruster.exe (PID: 2616)
      • WTNotifications.exe (PID: 2268)

    • Loads dropped or rewritten executable

      • WinThruster.exe (PID: 2616)
      • WTNotifications.exe (PID: 2268)

    • Actions looks like stealing of personal data

      • WTNotifications.exe (PID: 2268)
      • WinThruster.exe (PID: 2616)

    • Uses Task Scheduler to autorun other applications

      • WinThruster.exe (PID: 2616)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2144)

  • SUSPICIOUS

    • Reads Windows owner or organization settings

      • Setup_WinThruster_2020.tmp (PID: 2068)

    • Reads the Windows organization settings

      • Setup_WinThruster_2020.tmp (PID: 2068)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2464)
      • Setup_WinThruster_2020.exe (PID: 2380)
      • Setup_WinThruster_2020.exe (PID: 3488)
      • Setup_WinThruster_2020.tmp (PID: 2068)

    • Creates files in the program directory

      • WinThruster.exe (PID: 2616)

    • Reads CPU info

      • WinThruster.exe (PID: 2616)

    • Reads Internet Cache Settings

      • WinThruster.exe (PID: 2616)

    • Reads the cookies of Mozilla Firefox

      • WinThruster.exe (PID: 2616)

    • Reads the cookies of Google Chrome

      • WinThruster.exe (PID: 2616)

    • Creates files in the user directory

      • WinThruster.exe (PID: 2616)

    • Check for Java to be installed

      • WinThruster.exe (PID: 2616)

    • Reads Microsoft Outlook installation path

      • WinThruster.exe (PID: 2616)

    • Searches for installed software

      • WinThruster.exe (PID: 2616)
      • WTNotifications.exe (PID: 2268)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2464)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2132)
      • iexplore.exe (PID: 2464)
      • iexplore.exe (PID: 2896)

    • Application was dropped or rewritten from another process

      • Setup_WinThruster_2020.tmp (PID: 2068)
      • Setup_WinThruster_2020.tmp (PID: 2680)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2464)
      • iexplore.exe (PID: 2132)
      • iexplore.exe (PID: 2896)

    • Creates files in the user directory

      • iexplore.exe (PID: 2132)
      • iexplore.exe (PID: 2896)

    • Application launched itself

      • iexplore.exe (PID: 2464)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2464)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2132)
      • iexplore.exe (PID: 2896)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2464)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2464)

    • Creates files in the program directory

      • Setup_WinThruster_2020.tmp (PID: 2068)

    • Creates a software uninstall entry

      • Setup_WinThruster_2020.tmp (PID: 2068)

    • Dropped object may contain Bitcoin addresses

      • Setup_WinThruster_2020.tmp (PID: 2068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
10
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe setup_winthruster_2020.exe setup_winthruster_2020.tmp no specs setup_winthruster_2020.exe setup_winthruster_2020.tmp wtnotifications.exe winthruster.exe iexplore.exe schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2068"C:\Users\admin\AppData\Local\Temp\is-B71V4.tmp\Setup_WinThruster_2020.tmp" /SL5="$201E0,4896492,780800,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Setup_WinThruster_2020.exe" /SPAWNWND=$101DE /NOTIFYWND=$301B0 C:\Users\admin\AppData\Local\Temp\is-B71V4.tmp\Setup_WinThruster_2020.tmp
Setup_WinThruster_2020.exe
User:
admin
Company:
Solvusoft
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-b71v4.tmp\setup_winthruster_2020.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2132"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2464 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2144"C:\Windows\System32\schtasks.exe" /Create /TN "WinThruster automatic scan and notifications" /TR "\"C:\Program Files\WinThruster\WTNotifications.exe\"" /SC ONLOGON /RL HIGHEST /FC:\Windows\System32\schtasks.exe—WinThruster.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2268"C:\Program Files\WinThruster\WTNotifications.exe"C:\Program Files\WinThruster\WTNotifications.exe
Setup_WinThruster_2020.tmp
User:
admin
Company:
Solvusoft
Integrity Level:
HIGH
Description:
WinThruster automatic scan and notifications
Exit code:
0
Version:
7.1.0.1
Modules
Images
c:\program files\winthruster\wtnotifications.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2380"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Setup_WinThruster_2020.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Setup_WinThruster_2020.exe
iexplore.exe
User:
admin
Company:
Solvusoft
Integrity Level:
MEDIUM
Description:
WinThruster
Exit code:
0
Version:
7.1.0.1
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\78rfyb7z\setup_winthruster_2020.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
2464"C:\Program Files\Internet Explorer\iexplore.exe" https://www.solvusoft.com/en/download/winthruster/C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2616"C:\Program Files\WinThruster\WinThruster.exe"C:\Program Files\WinThruster\WinThruster.exe
Setup_WinThruster_2020.tmp
User:
admin
Company:
Solvusoft
Integrity Level:
HIGH
Description:
WinThruster
Exit code:
0
Version:
7.1.0.1
Modules
Images
c:\program files\winthruster\winthruster.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2680"C:\Users\admin\AppData\Local\Temp\is-6JI5T.tmp\Setup_WinThruster_2020.tmp" /SL5="$301B0,4896492,780800,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Setup_WinThruster_2020.exe" C:\Users\admin\AppData\Local\Temp\is-6JI5T.tmp\Setup_WinThruster_2020.tmp—Setup_WinThruster_2020.exe
User:
admin
Company:
Solvusoft
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-6ji5t.tmp\setup_winthruster_2020.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2896"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2464 CREDAT:202002 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3488"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Setup_WinThruster_2020.exe" /SPAWNWND=$101DE /NOTIFYWND=$301B0 C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Setup_WinThruster_2020.exe
Setup_WinThruster_2020.tmp
User:
admin
Company:
Solvusoft
Integrity Level:
HIGH
Description:
WinThruster
Exit code:
0
Version:
7.1.0.1
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\78rfyb7z\setup_winthruster_2020.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
38 930
Read events
38 690
Write events
225
Delete events
15

Modification events

(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1961196338
(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30838297
(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A3000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2464) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
8
Suspicious files
65
Text files
101
Unknown types
32

Dropped files

PID
Process
Filename
Type
2132iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab839B.tmp —
MD5:—
SHA256:—
2132iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar839C.tmp —
MD5:—
SHA256:—
2132iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\winthruster[1].htmhtml
MD5:—
SHA256:—
2132iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\buttons[1].csstext
MD5:—
SHA256:—
2132iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\7J74STFW.txttext
MD5:—
SHA256:—
2132iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_33E8F98A524575FDD27708D6D61F97EDder
MD5:—
SHA256:—
2132iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_33E8F98A524575FDD27708D6D61F97EDbinary
MD5:—
SHA256:—
2132iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\styles[1].csstext
MD5:—
SHA256:—
2132iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\EX2G1AMK.txttext
MD5:—
SHA256:—
2132iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\960grid[1].csstext
MD5:8CABFE7B15477B4C9A7F939CFDC968B8
SHA256:1F04FB766CD3735879C21BF158F1B9B7059E225D93A77B0D77B4B6E14EB635EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
63
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2132
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAKXB1YM1Knrv%2BJy8eCW2II%3D
US
der
471 b
whitelisted
2132
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
2132
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
2132
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAKXB1YM1Knrv%2BJy8eCW2II%3D
US
der
471 b
whitelisted
2132
iexplore.exe
GET
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAa5VhR9EEs0AgAAAAB5ZBM%3D
US
der
471 b
whitelisted
2132
iexplore.exe
GET
200
216.58.206.3:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2132
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
US
der
1.49 Kb
whitelisted
2132
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
2132
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
US
der
1.49 Kb
whitelisted
2132
iexplore.exe
GET
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEC9uA2ZNAd8yAgAAAAB5ZQ8%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2132
iexplore.exe
162.247.242.19:443
bam.nr-data.net
New Relic
US
whitelisted
2132
iexplore.exe
142.250.74.206:443
www.googlecommerce.com
Google Inc.
US
whitelisted
2132
iexplore.exe
216.58.205.238:443
www.google-analytics.com
Google Inc.
US
whitelisted
2132
iexplore.exe
172.217.23.110:443
www.youtube.com
Google Inc.
US
whitelisted
2132
iexplore.exe
74.125.133.154:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted
2132
iexplore.exe
216.58.212.142:443
www.youtube.com
Google Inc.
US
whitelisted
2132
iexplore.exe
172.217.23.132:443
www.google.com
Google Inc.
US
whitelisted
2132
iexplore.exe
104.111.238.212:443
www.solvusoft.com
Akamai International B.V.
NL
unknown
2132
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2132
iexplore.exe
172.217.16.170:443
ajax.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.solvusoft.com
  • 104.111.238.212
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
seal.verisign.com
  • 104.111.214.11
whitelisted
ajax.googleapis.com
  • 172.217.16.170
whitelisted
seal.websecurity.norton.com
  • 104.111.249.240
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.pki.goog
  • 216.58.206.3
whitelisted
www.googletagmanager.com
  • 216.58.207.72
whitelisted
js-agent.newrelic.com
  • 151.101.2.110
  • 151.101.66.110
  • 151.101.130.110
  • 151.101.194.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.solvusoft.com/en/download/winthruster/