analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

HWiNFO_Monitor_Setup.exe

Full analysis: https://app.any.run/tasks/e61ec6fb-331f-4bb7-825d-2c881e6cd706
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 11, 2026 at 07:44:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
cpuz
tool
stealer
fake-filezilla
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

CDC459A866361463D719BC89622300F3

SHA1:

02A53D660332C25AF623BBB7DF57C2AAD1B0B91B

SHA256:

EEFC0F986DD3EA376A4A54F80CE0DC3E6491165AEFDD7D5D6005DA3892CE248F

SSDEEP:

98304:yBPF0PN/Yi+UKcy9iuPrstBUlwBZL1+7/1f7ZaG6TCoIFhQyNIiMoyfPKnQ1VxTY:tMO3CMPy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Reads a specific registry key of the VM

      • HWMonitor.exe (PID: 7320)
      • powershell.exe (PID: 2324)

    • Trojanized FileZilla has been detected

      • HWMonitor.exe (PID: 7320)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • HWiNFO_Monitor_Setup.tmp (PID: 2304)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)
      • HWMonitor.exe (PID: 7320)
      • csc.exe (PID: 7636)

    • Reads the Windows owner or organization settings

      • HWiNFO_Monitor_Setup.tmp (PID: 2304)

    • Reads the BIOS version

      • HWMonitor.exe (PID: 7320)
      • powershell.exe (PID: 2324)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 736)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7636)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 2324)

    • Starts POWERSHELL.EXE for commands execution

      • HWMonitor.exe (PID: 7320)

  • INFO

    • Create files in a temporary directory

      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)
      • HWiNFO_Monitor_Setup.tmp (PID: 2304)
      • csc.exe (PID: 7636)
      • cvtres.exe (PID: 6732)

    • Checks supported languages

      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)
      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWiNFO_Monitor_Setup.tmp (PID: 2304)
      • HWMonitor.exe (PID: 7320)
      • csc.exe (PID: 7636)
      • cvtres.exe (PID: 6732)

    • Reads the computer name

      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)
      • HWiNFO_Monitor_Setup.tmp (PID: 2304)
      • HWMonitor.exe (PID: 7320)

    • Reads security settings of Internet Explorer

      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWMonitor.exe (PID: 7320)

    • Process checks computer location settings

      • HWiNFO_Monitor_Setup.tmp (PID: 6148)

    • Detects InnoSetup installer (YARA)

      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)

    • Compiled with Borland Delphi (YARA)

      • HWiNFO_Monitor_Setup.exe (PID: 1684)
      • HWiNFO_Monitor_Setup.tmp (PID: 6148)
      • HWiNFO_Monitor_Setup.exe (PID: 2308)

    • The sample compiled with english language support

      • HWiNFO_Monitor_Setup.tmp (PID: 2304)
      • HWMonitor.exe (PID: 7320)

    • Creates a software uninstall entry

      • HWiNFO_Monitor_Setup.tmp (PID: 2304)

    • Manual execution by a user

      • HWMonitor.exe (PID: 5888)
      • HWMonitor.exe (PID: 7320)

    • CPUZ mutex has been found

      • HWMonitor.exe (PID: 7320)

    • Reads the machine GUID from the registry

      • HWMonitor.exe (PID: 7320)
      • csc.exe (PID: 7636)

    • Creates files or folders in the user directory

      • HWMonitor.exe (PID: 7320)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 2324)

    • Reads the time zone

      • HWMonitor.exe (PID: 7320)

    • Reads CPU info

      • HWMonitor.exe (PID: 7320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2026:02:11 11:40:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 726016
InitializedDataSize: 178688
UninitializedDataSize: -
EntryPoint: 0xb1e60
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: CPUID
FileDescription: HWiNFO Monitor Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: HWiNFO Monitor
ProductVersion: 1.63
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
11
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start hwinfo_monitor_setup.exe hwinfo_monitor_setup.tmp no specs hwinfo_monitor_setup.exe hwinfo_monitor_setup.tmp hwmonitor.exe no specs #FAKE-FILEZILLA hwmonitor.exe powershell.exe conhost.exe no specs wmiapsrv.exe no specs csc.exe cvtres.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736C:\WINDOWS\system32\wbem\WmiApSrv.exeC:\Windows\System32\wbem\WmiApSrv.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Performance Reverse Adapter
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\psapi.dll
1684"C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe" C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe
explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
HWiNFO Monitor Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\hwinfo_monitor_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
2304"C:\Users\admin\AppData\Local\Temp\is-99NZTHBL5L.tmp\HWiNFO_Monitor_Setup.tmp" /SL5="$13010C,3034253,905728,C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe" /SPAWNWND=$1603AC /FIRSTWND=$90302 C:\Users\admin\AppData\Local\Temp\is-99NZTHBL5L.tmp\HWiNFO_Monitor_Setup.tmp
HWiNFO_Monitor_Setup.exe
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1054.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-99nzthbl5l.tmp\hwinfo_monitor_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2308"C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe" /SPAWNWND=$1603AC /FIRSTWND=$90302 C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe
HWiNFO_Monitor_Setup.tmp
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
HWiNFO Monitor Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\hwinfo_monitor_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
2324C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::In.ReadToEnd() | Invoke-Expression"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
HWMonitor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5888"C:\Program Files\CPUID\HWiNFO\HWMonitor.exe" C:\Program Files\CPUID\HWiNFO\HWMonitor.exe—explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
HWMonitor
Exit code:
3221226540
Version:
1, 6, 3, 0
Modules
Images
c:\program files\cpuid\hwinfo\hwmonitor.exe
c:\windows\system32\ntdll.dll
6148"C:\Users\admin\AppData\Local\Temp\is-0BHNVU88Q5.tmp\HWiNFO_Monitor_Setup.tmp" /SL5="$90302,3034253,905728,C:\Users\admin\AppData\Local\Temp\HWiNFO_Monitor_Setup.exe" C:\Users\admin\AppData\Local\Temp\is-0BHNVU88Q5.tmp\HWiNFO_Monitor_Setup.tmp—HWiNFO_Monitor_Setup.exe
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1054.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-0bhnvu88q5.tmp\hwinfo_monitor_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6732C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESA17B.tmp" "c:\Users\admin\AppData\Local\Temp\g3fijyed\CSCBB0EB4BA70B460F887BA3E3AB2F41.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_clr0400.dll
7320"C:\Program Files\CPUID\HWiNFO\HWMonitor.exe" C:\Program Files\CPUID\HWiNFO\HWMonitor.exe
explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
HWMonitor
Version:
1, 6, 3, 0
Modules
Images
c:\program files\cpuid\hwinfo\hwmonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
1 519
Read events
1 494
Write events
25
Delete events
0

Modification events

(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.7.1
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\CPUID\HWiNFO
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\CPUID\HWiNFO\
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
CPUID\HWiNFO
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
desktopicon
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:Inno Setup: Language
Value:
russian
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:DisplayName
Value:
HWiNFO Monitor, версия 1.63
(PID) Process:(2304) HWiNFO_Monitor_Setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F12FE46-4F7A-43AB-93D5-012BBED69B1A}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\CPUID\HWiNFO\HWiNFO.exe
Executable files
13
Suspicious files
11
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\is-T1IZ5X6CHF.tmpexecutable
MD5:176E0D21114AB4CB4DDA16D15071D7C0
SHA256:5E9B42E797477B04E2CD2C17DE7A43830378A5813C486BEBA29EDB655C898A62
1684HWiNFO_Monitor_Setup.exeC:\Users\admin\AppData\Local\Temp\is-0BHNVU88Q5.tmp\HWiNFO_Monitor_Setup.tmpexecutable
MD5:3E447B198F4BF47B6CA383B9318D80A3
SHA256:6543DAA30E7F7F491E0D467BFC312C8C590B1D6CF042B703A3DB2AF37C77F914
2308HWiNFO_Monitor_Setup.exeC:\Users\admin\AppData\Local\Temp\is-99NZTHBL5L.tmp\HWiNFO_Monitor_Setup.tmpexecutable
MD5:3E447B198F4BF47B6CA383B9318D80A3
SHA256:6543DAA30E7F7F491E0D467BFC312C8C590B1D6CF042B703A3DB2AF37C77F914
7320HWMonitor.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:7F924EAEA21BB91214FF7B4525F3BD29
SHA256:E718475014C8F51A8F2746FBE90A7BFF516B65BEF36EE6340A5FC746BC5DFC32
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\unins000.msgbinary
MD5:313D0CC5D1A64D2565E35937991775A6
SHA256:5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
2304HWiNFO_Monitor_Setup.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID\HWiNFO\HWiNFO Monitor.lnkbinary
MD5:FBFDD262CC8C41AD0E98E56BA908A7EF
SHA256:0F7980D4F585CB2F2D7A8E8E7341CB4204F33559D7B5C2E392D14E52CDE2C99D
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\is-F1DGVPGYH8.tmpexecutable
MD5:1C2DB2B8528275CC5599FF19689FB2CF
SHA256:6270005159CE90CC83E321975520045FC019AEAA71CCA0E2014EE366D99B3B29
7320HWMonitor.exeC:\ProgramData\CPUID Software\hwmonitor\9YEi7xZmexecutable
MD5:AF51881B3C3475E8540D6868A4191B44
SHA256:39A5DBA3BC4A1E006CA8E4CD6F5A78CB59375ABF65A57AD66E415C3ADEAA90BB
2304HWiNFO_Monitor_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-TQJHFW4Y17.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
2304HWiNFO_Monitor_Setup.tmpC:\Program Files\CPUID\HWiNFO\unins000.exeexecutable
MD5:176E0D21114AB4CB4DDA16D15071D7C0
SHA256:5E9B42E797477B04E2CD2C17DE7A43830378A5813C486BEBA29EDB655C898A62
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
32
DNS requests
20
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
5276
MoUsoCoreWorker.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
7052
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
7052
SIHClient.exe
GET
200
20.165.94.54:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
7052
SIHClient.exe
GET
200
74.178.240.61:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
7052
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5392
svchost.exe
GET
200
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
text
5.74 Kb
whitelisted
5392
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5392
svchost.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
5392
svchost.exe
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5392
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
5392
svchost.exe
23.48.23.194:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5392
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5532
SearchApp.exe
2.16.204.141:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
5532
SearchApp.exe
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 4.231.128.59
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
google.com
  • 142.251.127.113
  • 142.251.127.101
  • 142.251.127.100
  • 142.251.127.139
  • 142.251.127.138
  • 142.251.127.102
whitelisted
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.159
  • 23.48.23.143
  • 23.48.23.158
  • 23.48.23.140
  • 23.48.23.139
  • 23.48.23.147
  • 23.48.23.145
  • 23.48.23.138
whitelisted
www.microsoft.com
  • 23.59.18.102
whitelisted
www.bing.com
  • 2.16.204.141
  • 2.16.204.161
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted

Threats

PID
Process
Class
Message
5392
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
7320
HWMonitor.exe
Misc activity
ET INFO Cloudflare DNS Over HTTPS Certificate Inbound
2324
powershell.exe
Misc activity
HUNTING [ANY.RUN] TCP binary protocol 32-BE data-len prefix on non-standard port inbound
2324
powershell.exe
Misc activity
HUNTING [ANY.RUN] TCP binary protocol 32-BE data-len prefix on non-standard port outbound
2324
powershell.exe
Misc activity
HUNTING [ANY.RUN] TCP binary protocol 16-BE data-len prefix on non-standard port outbound
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HWiNFO_Monitor_Setup.exe