File name:

Mes_Drivers_3.0.4.exe

Full analysis: https://app.any.run/tasks/9e8b56bf-76c2-4855-a980-36ba863c3edb
Verdict: Malicious activity
Analysis date: January 09, 2025, 15:14:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

50A5E891DA27E63D54E68511E48AA026

SHA1:

87073D85A7BA420B15C8BB9A9E4ADC64DB2BCFEF

SHA256:

0788AAEA249D92A84F70047EFCACAA54C26320B439C490BA3CE00457955031D6

SSDEEP:

24576:AfHFw5b9DOnFYrv+kjqipUompMEoNMDYSkbDknoI6JK+ZYtEi8ETtAM5B:sjFYrv+kjV45oeYSRnyJhOtEVcf5B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses environment variables (SCRIPT)

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • detection.exe (PID: 6592)

    • Accesses BIOS(Win32_BIOS, may evade sandboxes) via WMI (SCRIPT)

      • detection.exe (PID: 6592)

    • Reads the value of a key from the registry (SCRIPT)

      • detection.exe (PID: 6592)

    • Accesses Motherboard(Win32_BaseBoard, may evade sandboxes) via WMI (SCRIPT)

      • detection.exe (PID: 6592)

    • Accesses physical disk drive(Win32_DiskDrive) via WMI (SCRIPT)

      • detection.exe (PID: 6592)

    • Accesses network adapter’s MAC address via WMI (SCRIPT)

      • detection.exe (PID: 6592)

    • Accesses the network adapter (Win32_NetworkAdapter) via WMI (SCRIPT)

      • detection.exe (PID: 6592)

    • Accesses Processor(Win32_Processor, may evade sandboxes) via WMI (SCRIPT)

      • detection.exe (PID: 6592)

    • Accesses Video Controller(Win32_VideoController, may evade sandboxes) via WMI (SCRIPT)

      • detection.exe (PID: 6592)

    • Accesses Physical Memory (Win32_PhysicalMemory, may evade sandboxes) via WMI (SCRIPT)

      • detection.exe (PID: 6592)

    • Checks whether a specified folder exists (SCRIPT)

      • detection.exe (PID: 6592)

    • Creates a new folder (SCRIPT)

      • detection.exe (PID: 6592)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • detection.exe (PID: 6592)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • detection.exe (PID: 6592)

    • Deletes a file (SCRIPT)

      • Mes_Drivers_3.0.4.exe (PID: 6508)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • detection.exe (PID: 6592)

    • Gets name of the script (SCRIPT)

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • detection.exe (PID: 6592)

    • Executable content was dropped or overwritten

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • detection.exe (PID: 6592)

    • Gets full path of the running script (SCRIPT)

      • Mes_Drivers_3.0.4.exe (PID: 6508)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • detection.exe (PID: 6592)

    • Starts CMD.EXE for commands execution

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • cmd.exe (PID: 6580)
      • cmd.exe (PID: 6716)
      • detection.exe (PID: 6592)

    • Checks whether a specific file exists (SCRIPT)

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • detection.exe (PID: 6592)

    • Runs shell command (SCRIPT)

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • detection.exe (PID: 6592)

    • Executing commands from ".cmd" file

      • cmd.exe (PID: 6580)

    • Application launched itself

      • cmd.exe (PID: 6716)
      • cmd.exe (PID: 6580)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6716)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7088)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • detection.exe (PID: 6592)

    • Executes WMI query (SCRIPT)

      • detection.exe (PID: 6592)

    • Accesses computer name via WMI (SCRIPT)

      • detection.exe (PID: 6592)

    • Reads data from a binary Stream object (SCRIPT)

      • detection.exe (PID: 6592)

    • Writes binary data to a Stream object (SCRIPT)

      • detection.exe (PID: 6592)

    • Accesses OperatingSystem(Win32_OperatingSystem) via WMI (SCRIPT)

      • detection.exe (PID: 6592)

  • INFO

    • Checks supported languages

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • curl_x64.exe (PID: 6780)
      • detection.exe (PID: 6592)
      • detect_x64.exe (PID: 6220)
      • aes_x64.exe (PID: 4952)
      • detect_x64.exe (PID: 6176)

    • Reads the computer name

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • detection.exe (PID: 6592)

    • The sample compiled with english language support

      • Mes_Drivers_3.0.4.exe (PID: 6508)
      • detection.exe (PID: 6592)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6828)

    • Checks operating system version

      • cmd.exe (PID: 6716)

    • Reads the time zone

      • detection.exe (PID: 6592)

    • Reads the machine GUID from the registry

      • aes_x64.exe (PID: 4952)

    • Self-termination (SCRIPT)

      • detection.exe (PID: 6592)
      • Mes_Drivers_3.0.4.exe (PID: 6508)

    • Application launched itself

      • msedge.exe (PID: 1392)
      • msedge.exe (PID: 644)

    • Manual execution by a user

      • msedge.exe (PID: 644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (63.7)
.scr | Windows screen saver (20)
.exe | Win32 Executable (generic) (6.9)
.exe | Win16/32 Executable Delphi generic (3.1)
.exe | Generic Win/DOS Executable (3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:09:09 21:39:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 350720
InitializedDataSize: 1260544
UninitializedDataSize: -
EntryPoint: 0x5678c
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.0.4.0
ProductVersionNumber: 3.0.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Tous Les Drivers
FileDescription: Mes Drivers
FileVersion: 3. 0. 4. 0
InternalName: -
LegalCopyright: Copyright © 2016 Tous Les Drivers - Tous droits réservés
LegalTrademarks: -
OriginalFileName: -
ProductName: Mes Drivers
ProductVersion: 3. 0. 4. 0
Comments: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
244
Monitored processes
116
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start mes_drivers_3.0.4.exe cmd.exe no specs detection.exe conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs curl_x64.exe mode.com no specs cmd.exe no specs findstr.exe no specs waitfor.exe no specs waitfor.exe no specs sc.exe no specs waitfor.exe no specs detect_x64.exe no specs detect_x64.exe no specs detect_x64.exe no specs detect_x64.exe no specs detect_x64.exe no specs waitfor.exe no specs waitfor.exe no specs waitfor.exe no specs aes_x64.exe no specs curl_x64.exe cmd.exe no specs waitfor.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs mes_drivers_3.0.4.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364WAITFOR /S DESKTOP-JGLLJLD /SI unlockC:\Windows\SysWOW64\waitfor.exe—detection.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
waitfor - wait/send a signal over a network
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\waitfor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
436"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2872 --field-trial-handle=2360,i,17883414211244707678,5733676324165491572,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument http://www.touslesdrivers.com/index.php?v_page=31&v_id=b3Hoc00eBiZ1eCBIC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6636 --field-trial-handle=2360,i,17883414211244707678,5733676324165491572,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1392"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.touslesdrivers.com/index.php?v_page=31&v_id=b3Hoc00eBiZ1eCBIC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1488"C:\Users\admin\AppData\Local\Temp\detect_x64.exe" drivernodes 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*C:\Users\admin\AppData\Local\Temp\detect_x64.exe—detection.exe
User:
admin
Integrity Level:
HIGH
Description:
Detect
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\detect_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1596"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5788 --field-trial-handle=2360,i,17883414211244707678,5733676324165491572,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1916"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6904 --field-trial-handle=2360,i,17883414211244707678,5733676324165491572,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2144"C:\Users\admin\AppData\Local\Temp\detect_x64.exe" status 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*C:\Users\admin\AppData\Local\Temp\detect_x64.exe—detection.exe
User:
admin
Integrity Level:
HIGH
Description:
Detect
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\detect_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2220"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2656 --field-trial-handle=2368,i,8245867638947006450,8612853083288910053,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
8 110
Read events
8 034
Write events
76
Delete events
0

Modification events

(PID) Process:(6508) Mes_Drivers_3.0.4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(6580) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6580) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C000000000000046D50100006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4120) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C000000000000046D50100006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4120) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4120) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4120) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1392) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1392) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1392) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
Executable files
10
Suspicious files
315
Text files
43
Unknown types
16

Dropped files

PID
Process
Filename
Type
6900waitfor.exe\Device\Mup:\DESKTOP-JGLLJLD\mailslot\WAITFOR.EXE\unlock —
MD5:—
SHA256:—
364waitfor.exe\Device\Mup:\DESKTOP-JGLLJLD\mailslot\WAITFOR.EXE\unlock —
MD5:—
SHA256:—
3144waitfor.exe\Device\Mup:\DESKTOP-JGLLJLD\mailslot\WAITFOR.EXE\unlock —
MD5:—
SHA256:—
5828waitfor.exe\Device\Mup:\DESKTOP-JGLLJLD\mailslot\WAITFOR.EXE\unlock —
MD5:—
SHA256:—
6592detection.exeC:\Users\admin\AppData\Local\Temp\aes_x64.exeexecutable
MD5:E5125D4651C008EBA61D9FD3ABD5AB31
SHA256:874CB7A8513B781B25E176828FE8FE5AC73FA2FE29EA2AAC5FE0EAAD50E63F39
644msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\b22d4939-fc90-4462-a413-65691c3b2273.tmp —
MD5:—
SHA256:—
6508Mes_Drivers_3.0.4.exeC:\Users\admin\AppData\Local\Temp\waitfor_x86.exeexecutable
MD5:DD8C73BDCF2077B82DBB6DDD8ECB6A6D
SHA256:C3370E8EC5CA54E8FD7EAC19C278689CF122EDAC91FAA4376DC24B1D807FE510
644msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State —
MD5:—
SHA256:—
6508Mes_Drivers_3.0.4.exeC:\Users\admin\AppData\Local\Temp\interface.cmdtext
MD5:E0EB53551ACA2ACFF814DDD7ACA212E2
SHA256:11993A03F68A33500A3CE8FBEB3E3C2042A28299D04F39EED40147709E76CA79
6592detection.exeC:\Users\admin\AppData\Local\Temp\curl_x86.exeexecutable
MD5:213A2CE0C3E3BCC71DF42A9EDAD0BA35
SHA256:FBC0D3A56DCC0B9C6FFE556D1FD58C57502325780F137B64788FBBBDFC13BB82
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
534
DNS requests
580
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
760
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQDSf7vB3jWeUhatYUlYYJnE
unknown
—
—
whitelisted
760
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTiTO5p2rXxVy%2FTcLUdpziu1DSCwQUVnNYZJX5khqwEioEYnmhQBWIIUkCEGIIWPCDVmzHf3dQOJ6lUPE%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1904
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1904
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6780
curl_x64.exe
51.255.80.171:443
www.touslesdrivers.com
OVH SAS
FR
whitelisted
760
lsass.exe
104.18.38.233:80
ocsp.usertrust.com
CLOUDFLARENET
—
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.touslesdrivers.com
  • 51.255.80.171
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.0
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.68
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
5916
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5916
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5916
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5916
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5916
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Marketing Measurement Service (exactag .com)
5916
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Marketing Measurement Service (exactag .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mes_Drivers_3.0.4.exe