File name:

Deobfuscator.rar

Full analysis: https://app.any.run/tasks/d127714e-8719-4d39-8b12-7e760145caa1
Verdict: Malicious activity
Analysis date: February 19, 2025, 17:09:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-scr
qrcode
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1C20F39BCD12A2EF53BD598FCCAC57DB

SHA1:

503744579B104C8E7599EAD2C473B90C2C0F898E

SHA256:

09E83ED10D9CAF832B7C740B9538BB8484D023FA0414D0C7C1B45A93FDD657B0

SSDEEP:

12288:Q+chtX0zk8ESCvT5qmqQfwDvPVL1uW7GwV7rMxg+zUFFaJQwTNFqaFFmpGQ88qGK:2tXekTSCvT5qmqQfwDvPVL1uW7GwV7r4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5992)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • explorer.exe (PID: 4488)
      • msiexec.exe (PID: 6276)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 4488)
      • msiexec.exe (PID: 6276)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5004)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6716)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2976)
      • msiexec.exe (PID: 4120)
      • msiexec.exe (PID: 6276)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 5004)

    • Executes script using NodeJS

      • node.exe (PID: 6488)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 6992)
      • firefox.exe (PID: 7084)

    • Application launched itself

      • firefox.exe (PID: 7084)
      • msiexec.exe (PID: 5004)
      • firefox.exe (PID: 7104)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4488)
      • msiexec.exe (PID: 2012)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 4488)

    • Reads the computer name

      • msiexec.exe (PID: 5004)
      • msiexec.exe (PID: 2976)
      • msiexec.exe (PID: 2336)
      • msiexec.exe (PID: 6504)
      • msiexec.exe (PID: 6276)
      • msiexec.exe (PID: 4120)

    • Checks supported languages

      • msiexec.exe (PID: 2336)
      • msiexec.exe (PID: 2976)
      • msiexec.exe (PID: 4120)
      • msiexec.exe (PID: 5004)
      • msiexec.exe (PID: 6504)
      • msiexec.exe (PID: 6276)
      • node.exe (PID: 6488)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2012)
      • msiexec.exe (PID: 5004)

    • Reads the software policy settings

      • msiexec.exe (PID: 2012)
      • msiexec.exe (PID: 5004)
      • explorer.exe (PID: 4488)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 4488)

    • Checks proxy server information

      • explorer.exe (PID: 4488)

    • Manages system restore points

      • SrTasks.exe (PID: 6348)

    • The sample compiled with english language support

      • msiexec.exe (PID: 2012)
      • msiexec.exe (PID: 5004)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 5004)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5004)

    • Local mutex for internet shortcut management

      • msiexec.exe (PID: 4120)
      • explorer.exe (PID: 4488)

    • Process checks computer location settings

      • msiexec.exe (PID: 6276)

    • Reads product name

      • node.exe (PID: 6488)

    • Reads Environment values

      • node.exe (PID: 6488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 755
UncompressedSize: 2140
OperatingSystem: Win32
ArchivedFileName: MoonSec V.2,IronBrew,AztupBrew/index.js
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
37
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs explorer.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs node.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2012"C:\WINDOWS\System32\msiexec.exe" /i "C:\Users\admin\Downloads\node-v23.8.0-x64.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2336C:\Windows\System32\MsiExec.exe -Embedding E0DEF288C2E2F9D81A6F3DF26714ECD5 CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2736"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240213221259 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a85713bb-5904-408b-9f82-fb4e4f2fd501} 7104 "\\.\pipe\gecko-crash-server-pipe.7104" 224b56ebb10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
2976C:\Windows\System32\MsiExec.exe -Embedding AE1BEED3B3A28801EF83F6C4A474D3AEC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4120C:\Windows\System32\MsiExec.exe -Embedding C6621963A2BE4D68156F0BC01DDC3C9D E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4144"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 7 -isForBrowser -prefsHandle 4892 -prefMapHandle 5356 -prefsLen 32012 -prefMapSize 244583 -jsInitHandle 1504 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b945ded-5d95-4fe4-abfe-d051ea40f993} 7104 "\\.\pipe\gecko-crash-server-pipe.7104" 224c0de6d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
4488C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
4500"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 936 -prefMapHandle 4664 -prefsLen 36588 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3080944b-9936-4b6d-8f50-4c7db4828426} 7104 "\\.\pipe\gecko-crash-server-pipe.7104" 224be40c310 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4516\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4576\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
55 090
Read events
51 647
Write events
3 408
Delete events
35

Modification events

(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000050316
Operation:writeName:VirtualDesktop
Value:
1000000030304456A48A294F7A40804AB924005FF030B61F
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Deobfuscator.rar
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010014000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C0000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C0000000D0000000000000053006B007900700065002E006C006E006B003E0020007C000000140000000000000061007000700065006100720063006F00750070006C0065002E0070006E0067003E002000200000001500000000000000640065006D0061006E0064006E006500740077006F0072006B002E0070006E0067003E002000200000001100000000000000640065007300690067006E006800650072002E007200740066003E00200020000000130000000000000069006E0066006F0066007500720074006800650072002E0070006E0067003E0020002000000017000000000000006C0069006E006B00730063006F006E0066006500720065006E00630065002E0070006E0067003E00200020000000130000000000000072006F006C0065006D0069006C006C0069006F006E002E007200740066003E0020002000000014000000000000007300680065006E00650063006500730073006100720079002E007200740066003E002000200000000F00000000000000740065006C0074006800690073002E0070006E0067003E002000200000001400000000000000740065007300740069006E0067006C0069006E00650073002E007200740066003E00200020000000150000000000000074007200750073007400700072006F0062006C0065006D0073002E0070006E0067003E00200020000000190000000000000075006E006B006E006F0077006E00720065007300740061007500720061006E0074002E007200740066003E0020002000000022000000000000004D006F006F006E00530065006300200056002E0032002C00490072006F006E0042007200650077002C0041007A0074007500700042007200650077003E005C0020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001400000000000000000000000000000000000000803F0000004008000000803F0000404009000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F0000000040000080401000000000400000A040110000004040000000001200000000000000803F0100000000000000004002000000000000004040030000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F070000008040000000401300
Executable files
23
Suspicious files
2 168
Text files
713
Unknown types
2

Dropped files

PID
Process
Filename
Type
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\ansi-styles\index.d.tstext
MD5:8B3CD8B3B64C5FA421B79CC29E607F65
SHA256:6B5A49A699FFBCCCE553DEAD6C39D3B10A896F78869EF5507D30DFCDBF6F0977
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\input.luabinary
MD5:EAC4E36E555FBC5791F1FAA6D9D58101
SHA256:2D3198D216CF655685ACBF0BD715CCCA07104BA893E069EDE461C48C3DC31948
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\chalk\source\index.jsbinary
MD5:588C36823B6C659EF060CE6141852923
SHA256:A7EDA1E88414E0E3F050A09621A35E8D656550077DA044606C16B053148F6459
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\chalk\source\util.jsbinary
MD5:188694918D042AA89A37678275ADC01E
SHA256:9D5CBEE8050B580D28FC1DE92987EE0237CF609415DA8DC781920074F278C016
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\ansi-styles\index.jsbinary
MD5:9D4ACB14D5449B232B22BFE40453B00C
SHA256:D3F197D370760DDD8753C1355B4BDB585A787F1BAA92BB8ED217F170C138B594
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\chalk\package.jsonbinary
MD5:E9911C2278CD2D9D88D0328D1629B2E6
SHA256:9CD907D34A45CB73B5C8A459D5602A36CCD456794665C529A3A5B0F02E196F26
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\ansi-styles\package.jsonbinary
MD5:AB7A71AB9F6B46ACDA83106C5F34E6E3
SHA256:D405F010681D53F77691015E98461F8484B2AFE6A9EDFDD2DDB27B1E8A8E883D
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\chalk\source\templates.jsbinary
MD5:7F7E2A37129BC942C81337A3C5650762
SHA256:546F8511507D2E842CAC590F99DC550DFE2B21F7FDCD12AB071FF5AAA3E770D5
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\ansi-styles\licensetext
MD5:915042B5DF33C31A6DB2B37EADAA00E3
SHA256:48DA2F39E100D4085767E94966B43F4FA95FF6A0698FBA57ED460914E35F94A0
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\color-convert\CHANGELOG.mdtext
MD5:8BFDDE6C27AEFD62F810963029EC43AD
SHA256:EE2EA4FE91D043EC4214AA60AEAFF595009ACDFDBB9ED4030896191126D70849
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
123
DNS requests
149
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5892
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7104
firefox.exe
POST
200
142.250.185.67:80
http://o.pki.goog/s/wr3/jLM
unknown
—
—
whitelisted
7104
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
7104
firefox.exe
POST
200
184.24.77.52:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
7104
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
7104
firefox.exe
POST
200
184.24.77.45:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6092
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
92.123.104.18:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3976
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6092
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.140
  • 23.48.23.193
  • 23.48.23.145
  • 23.48.23.139
  • 23.48.23.180
  • 23.48.23.143
  • 23.48.23.147
  • 23.48.23.190
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 92.123.104.18
  • 92.123.104.38
  • 92.123.104.59
  • 92.123.104.32
  • 92.123.104.35
  • 92.123.104.23
  • 92.123.104.28
  • 92.123.104.65
  • 92.123.104.61
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.64
  • 20.190.160.131
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 2.18.97.227
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Deobfuscator.rar