File name:

07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712

Full analysis: https://app.any.run/tasks/279a501f-8525-408c-881a-30126b87dd62
Verdict: Malicious activity
Analysis date: July 06, 2021, 06:07:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5:

085A01F1E78692902B20D2612E82492F

SHA1:

7F97CEE228757D39B137B5319FB98D89E0BCB3B7

SHA256:

07C5E2061A5DD83E82D2A4647459BBA1EB796427AEFA34BDD36A17FD4C93B712

SSDEEP:

196608:DhTg61OqO+ExBOk+FO23y+mSULV8Iaoojk6:FTg61xJExBOHlELaI5l6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • CTS.exe (PID: 1592)
      • 07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe (PID: 1580)

    • Changes the autorun value in the registry

      • CTS.exe (PID: 1592)
      • 07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe (PID: 1580)

    • Application was dropped or rewritten from another process

      • 9WrQUfHmZyk0nYl.exe (PID: 3620)
      • 9WrQUfHmZyk0nYl.exe (PID: 312)
      • 9WrQUfHmZyk0nYl.exe (PID: 3908)
      • FileSyncConfig.exe (PID: 2500)
      • OneDrive.exe (PID: 3572)

    • Loads dropped or rewritten executable

      • FileSyncConfig.exe (PID: 2500)
      • OneDrive.exe (PID: 3572)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • 07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe (PID: 1580)
      • 9WrQUfHmZyk0nYl.exe (PID: 3908)
      • 9WrQUfHmZyk0nYl.exe (PID: 3620)

    • Checks supported languages

      • CTS.exe (PID: 1592)
      • 9WrQUfHmZyk0nYl.exe (PID: 312)
      • 9WrQUfHmZyk0nYl.exe (PID: 3620)
      • 07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe (PID: 1580)
      • FileSyncConfig.exe (PID: 2500)
      • 9WrQUfHmZyk0nYl.exe (PID: 3908)
      • OneDrive.exe (PID: 3572)
      • OneDriveSetup.exe (PID: 3748)
      • OneDriveSetup.exe (PID: 2540)

    • Executable content was dropped or overwritten

      • CTS.exe (PID: 1592)
      • 07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe (PID: 1580)
      • 9WrQUfHmZyk0nYl.exe (PID: 3620)
      • 9WrQUfHmZyk0nYl.exe (PID: 3908)

    • Reads the computer name

      • 9WrQUfHmZyk0nYl.exe (PID: 312)
      • 9WrQUfHmZyk0nYl.exe (PID: 3620)
      • 9WrQUfHmZyk0nYl.exe (PID: 3908)
      • FileSyncConfig.exe (PID: 2500)
      • OneDrive.exe (PID: 3572)
      • OneDriveSetup.exe (PID: 2540)
      • OneDriveSetup.exe (PID: 3748)

    • Application launched itself

      • 9WrQUfHmZyk0nYl.exe (PID: 312)
      • OneDriveSetup.exe (PID: 3748)

    • Starts itself from another location

      • 07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe (PID: 1580)

    • Creates/Modifies COM task schedule object

      • 9WrQUfHmZyk0nYl.exe (PID: 3908)

    • Creates files in the user directory

      • 9WrQUfHmZyk0nYl.exe (PID: 3908)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • FileSyncConfig.exe (PID: 2500)

    • Reads CPU info

      • OneDrive.exe (PID: 3572)

    • Reads the time zone

      • OneDrive.exe (PID: 3572)

    • Creates a software uninstall entry

      • 9WrQUfHmZyk0nYl.exe (PID: 3908)

    • Creates a directory in Program Files

      • 9WrQUfHmZyk0nYl.exe (PID: 3620)

    • Creates files in the program directory

      • 9WrQUfHmZyk0nYl.exe (PID: 3620)
      • OneDriveSetup.exe (PID: 3748)

    • Reads Environment values

      • OneDriveSetup.exe (PID: 3748)
      • OneDriveSetup.exe (PID: 2540)

    • Drops a file with too old compile date

      • 9WrQUfHmZyk0nYl.exe (PID: 3908)

  • INFO

    • Reads settings of System Certificates

      • 9WrQUfHmZyk0nYl.exe (PID: 312)
      • 9WrQUfHmZyk0nYl.exe (PID: 3620)
      • 9WrQUfHmZyk0nYl.exe (PID: 3908)
      • OneDrive.exe (PID: 3572)
      • OneDriveSetup.exe (PID: 3748)
      • OneDriveSetup.exe (PID: 2540)

    • Checks Windows Trust Settings

      • 9WrQUfHmZyk0nYl.exe (PID: 3908)
      • 9WrQUfHmZyk0nYl.exe (PID: 312)
      • 9WrQUfHmZyk0nYl.exe (PID: 3620)
      • OneDrive.exe (PID: 3572)
      • OneDriveSetup.exe (PID: 3748)
      • OneDriveSetup.exe (PID: 2540)

    • Dropped object may contain Bitcoin addresses

      • 9WrQUfHmZyk0nYl.exe (PID: 3908)
      • 9WrQUfHmZyk0nYl.exe (PID: 3620)
      • 9WrQUfHmZyk0nYl.exe (PID: 312)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.5)
.exe | UPX compressed Win32 Executable (36.8)
.dll | Win32 Dynamic Link Library (generic) (8.9)
.exe | Win32 Executable (generic) (6.1)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x5dd2
UninitializedDataSize: 57344
InitializedDataSize: 4096
CodeSize: 28672
LinkerVersion: 11
PEType: PE32
TimeStamp: 2015:05:05 15:45:31+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-May-2015 13:45:31

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 05-May-2015 13:45:31
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x0000E000
0x0000CE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.51803
UPX1
0x0000F000
0x00007000
0x00006200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.1204
UPX2
0x00016000
0x00001000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.90467
.imports
0x00017000
0x00001000
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.05173
.reloc
0x00018000
0x00001000
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.53141

Imports

ADVAPI32.dll
KERNEL32.DLL
USER32.dll
ntdll.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
9
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start 07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe 9wrqufhmzyk0nyl.exe cts.exe 9wrqufhmzyk0nyl.exe 9wrqufhmzyk0nyl.exe filesyncconfig.exe no specs onedrive.exe onedrivesetup.exe no specs onedrivesetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
312C:\Users\admin\AppData\Local\Temp\9WrQUfHmZyk0nYl.exe C:\Users\admin\AppData\Local\Temp\9WrQUfHmZyk0nYl.exe
07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive Setup
Exit code:
0
Version:
17.3.6281.1202
Modules
Images
c:\users\admin\appdata\local\temp\9wrqufhmzyk0nyl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
1580"C:\Users\admin\AppData\Local\Temp\07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe" C:\Users\admin\AppData\Local\Temp\07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1592"C:\Users\admin\AppData\Local\Temp\CTS.exe"C:\Users\admin\AppData\Local\Temp\CTS.exe
07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\cts.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2500"C:\Users\admin\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncConfig.exe" C:\Users\admin\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncConfig.exe—9WrQUfHmZyk0nYl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive Configuration Application
Exit code:
4294967295
Version:
17.3.6281.1202
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\onedrive\17.3.6281.1202\filesyncconfig.exe
c:\users\admin\appdata\local\microsoft\onedrive\17.3.6281.1202\msvcp120.dll
c:\users\admin\appdata\local\microsoft\onedrive\17.3.6281.1202\msvcr120.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2540C:\Users\admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions C:\Users\admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe—OneDriveSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive (32 bit) Setup
Exit code:
0
Version:
21.109.0530.0001
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\microsoft\onedrive\update\onedrivesetup.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wer.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
3572"C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
9WrQUfHmZyk0nYl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive
Exit code:
0
Version:
17.3.6281.1202
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\onedrive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\usp10.dll
3620"C:\Users\admin\AppData\Local\Temp\9WrQUfHmZyk0nYl.exe" C:\Users\admin\AppData\Local\Temp\9WrQUfHmZyk0nYl.exe /permachine /silent /childprocess /cusid:S-1-5-21-1302019708-1500728564-335382590-1000 C:\Users\admin\AppData\Local\Temp\9WrQUfHmZyk0nYl.exe
9WrQUfHmZyk0nYl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft OneDrive Setup
Exit code:
0
Version:
17.3.6281.1202
Modules
Images
c:\users\admin\appdata\local\temp\9wrqufhmzyk0nyl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shell32.dll
3748"C:\Users\admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update C:\Users\admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe—OneDrive.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive (32 bit) Setup
Exit code:
0
Version:
21.109.0530.0001
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\update\onedrivesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wer.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
3908C:\Users\admin\AppData\Local\Temp\9WrQUfHmZyk0nYl.exe /peruser /childprocess C:\Users\admin\AppData\Local\Temp\9WrQUfHmZyk0nYl.exe
9WrQUfHmZyk0nYl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive Setup
Exit code:
0
Version:
17.3.6281.1202
Modules
Images
c:\users\admin\appdata\local\temp\9wrqufhmzyk0nyl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
23 509
Read events
22 809
Write events
693
Delete events
7

Modification events

(PID) Process:(1580) 07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:CTS
Value:
C:\Users\admin\AppData\Local\Temp\CTS.exe
(PID) Process:(1592) CTS.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:CTS
Value:
C:\Users\admin\AppData\Local\Temp\CTS.exe
(PID) Process:(312) 9WrQUfHmZyk0nYl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\QoS
Operation:writeName:UMID
Value:
E51D4D87-3DAF-467A-B271-75B1C3BCB36E
(PID) Process:(312) 9WrQUfHmZyk0nYl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\OneDrive\QoS
Operation:writeName:UUID
Value:
8A49DA17-5C89-4237-9ECE-37AC30E6DA44
(PID) Process:(312) 9WrQUfHmZyk0nYl.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(312) 9WrQUfHmZyk0nYl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(312) 9WrQUfHmZyk0nYl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(312) 9WrQUfHmZyk0nYl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(312) 9WrQUfHmZyk0nYl.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3620) 9WrQUfHmZyk0nYl.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
146
Suspicious files
10
Text files
11
Unknown types
14

Dropped files

PID
Process
Filename
Type
3129WrQUfHmZyk0nYl.exeC:\Users\admin\AppData\Local\Temp\tmpC778.tmp —
MD5:—
SHA256:—
36209WrQUfHmZyk0nYl.exeC:\Users\admin\AppData\Local\Temp\tmpCCD7.tmp —
MD5:—
SHA256:—
39089WrQUfHmZyk0nYl.exeC:\Users\admin\AppData\Local\Temp\tmpCD35.tmp —
MD5:—
SHA256:—
158007c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712.exeC:\Users\admin\AppData\Local\Temp\CTS.exeexecutable
MD5:—
SHA256:—
39089WrQUfHmZyk0nYl.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\ETWlog.dllexecutable
MD5:—
SHA256:—
1592CTS.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\gtcheck.exeexecutable
MD5:—
SHA256:—
39089WrQUfHmZyk0nYl.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\mt-mt\FileSync.LocalizedResources.dll.muiexecutable
MD5:—
SHA256:—
39089WrQUfHmZyk0nYl.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\ja\FileSync.LocalizedResources.dll.muiexecutable
MD5:—
SHA256:—
39089WrQUfHmZyk0nYl.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\eu\FileSync.LocalizedResources.dll.muiexecutable
MD5:—
SHA256:—
39089WrQUfHmZyk0nYl.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\ar\FileSync.LocalizedResources.dll.muiexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
9
DNS requests
6
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3572
OneDrive.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
—
1.47 Kb
whitelisted
3572
OneDrive.exe
GET
302
52.142.114.176:80
http://g.live.com/1rewlive5skydrive/OneDriveProduction?OneDriveUpdate=90cb9062dfd2a8d6772b3b2bf84
IE
—
—
whitelisted
3572
OneDrive.exe
POST
200
157.55.109.226:80
http://ssw.live.com/UploadData.aspx
US
—
—
whitelisted
3908
9WrQUfHmZyk0nYl.exe
POST
—
157.55.109.226:80
http://ssw.live.com/UploadData.aspx
US
—
—
whitelisted
312
9WrQUfHmZyk0nYl.exe
POST
—
157.55.109.226:80
http://ssw.live.com/UploadData.aspx
US
—
—
whitelisted
3620
9WrQUfHmZyk0nYl.exe
POST
200
157.55.109.226:80
http://ssw.live.com/UploadData.aspx
US
—
—
whitelisted
3572
OneDrive.exe
GET
200
8.248.145.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1fa20cc7f4fc3891
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3572
OneDrive.exe
52.142.114.176:80
g.live.com
Microsoft Corporation
IE
whitelisted
3572
OneDrive.exe
23.212.233.239:443
oneclient.sfx.ms
Akamai International B.V.
NL
unknown
3572
OneDrive.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
8.248.145.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
896
svchost.exe
23.212.233.239:443
oneclient.sfx.ms
Akamai International B.V.
NL
unknown
—
—
157.55.109.226:80
ssw.live.com
Microsoft Corporation
US
unknown
3572
OneDrive.exe
157.55.109.226:80
ssw.live.com
Microsoft Corporation
US
unknown
312
9WrQUfHmZyk0nYl.exe
157.55.109.226:80
ssw.live.com
Microsoft Corporation
US
unknown
3620
9WrQUfHmZyk0nYl.exe
157.55.109.226:80
ssw.live.com
Microsoft Corporation
US
unknown

DNS requests

Domain
IP
Reputation
ssw.live.com
  • 157.55.109.226
whitelisted
ls2web.redmond.corp.microsoft.com
  • —
unknown
g.live.com
  • 52.142.114.176
whitelisted
oneclient.sfx.ms
  • 23.212.233.239
suspicious
ctldl.windowsupdate.com
  • 8.248.145.254
  • 8.248.137.254
  • 8.248.133.254
  • 8.253.207.120
  • 8.248.135.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
3620
9WrQUfHmZyk0nYl.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
07c5e2061a5dd83e82d2a4647459bba1eb796427aefa34bdd36a17fd4c93b712