File name:

Deobfuscator.rar

Full analysis: https://app.any.run/tasks/d127714e-8719-4d39-8b12-7e760145caa1
Verdict: Malicious activity
Analysis date: February 19, 2025, 17:09:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-scr
qrcode
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1C20F39BCD12A2EF53BD598FCCAC57DB

SHA1:

503744579B104C8E7599EAD2C473B90C2C0F898E

SHA256:

09E83ED10D9CAF832B7C740B9538BB8484D023FA0414D0C7C1B45A93FDD657B0

SSDEEP:

12288:Q+chtX0zk8ESCvT5qmqQfwDvPVL1uW7GwV7rMxg+zUFFaJQwTNFqaFFmpGQ88qGK:2tXekTSCvT5qmqQfwDvPVL1uW7GwV7r4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5992)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6716)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 5004)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5004)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2976)
      • msiexec.exe (PID: 4120)
      • msiexec.exe (PID: 6276)

    • Executing commands from a ".bat" file

      • msiexec.exe (PID: 6276)
      • explorer.exe (PID: 4488)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 6276)
      • explorer.exe (PID: 4488)

    • Executes script using NodeJS

      • node.exe (PID: 6488)

  • INFO

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4488)
      • msiexec.exe (PID: 2012)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 4488)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 4488)

    • Application launched itself

      • firefox.exe (PID: 7104)
      • msiexec.exe (PID: 5004)
      • firefox.exe (PID: 7084)

    • Checks proxy server information

      • explorer.exe (PID: 4488)

    • Checks supported languages

      • msiexec.exe (PID: 5004)
      • msiexec.exe (PID: 2336)
      • msiexec.exe (PID: 4120)
      • msiexec.exe (PID: 6504)
      • msiexec.exe (PID: 6276)
      • msiexec.exe (PID: 2976)
      • node.exe (PID: 6488)

    • Reads the software policy settings

      • explorer.exe (PID: 4488)
      • msiexec.exe (PID: 2012)
      • msiexec.exe (PID: 5004)

    • Reads the computer name

      • msiexec.exe (PID: 5004)
      • msiexec.exe (PID: 2336)
      • msiexec.exe (PID: 4120)
      • msiexec.exe (PID: 6504)
      • msiexec.exe (PID: 2976)
      • msiexec.exe (PID: 6276)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2012)
      • msiexec.exe (PID: 5004)

    • The sample compiled with english language support

      • msiexec.exe (PID: 2012)
      • msiexec.exe (PID: 5004)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 5004)

    • Manages system restore points

      • SrTasks.exe (PID: 6348)

    • Local mutex for internet shortcut management

      • msiexec.exe (PID: 4120)
      • explorer.exe (PID: 4488)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5004)

    • Process checks computer location settings

      • msiexec.exe (PID: 6276)

    • Reads Environment values

      • node.exe (PID: 6488)

    • Reads product name

      • node.exe (PID: 6488)

    • Manual execution by a user

      • firefox.exe (PID: 7084)
      • cmd.exe (PID: 6992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 755
UncompressedSize: 2140
OperatingSystem: Win32
ArchivedFileName: MoonSec V.2,IronBrew,AztupBrew/index.js
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
37
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs explorer.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs node.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2012"C:\WINDOWS\System32\msiexec.exe" /i "C:\Users\admin\Downloads\node-v23.8.0-x64.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2336C:\Windows\System32\MsiExec.exe -Embedding E0DEF288C2E2F9D81A6F3DF26714ECD5 CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2736"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240213221259 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a85713bb-5904-408b-9f82-fb4e4f2fd501} 7104 "\\.\pipe\gecko-crash-server-pipe.7104" 224b56ebb10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
2976C:\Windows\System32\MsiExec.exe -Embedding AE1BEED3B3A28801EF83F6C4A474D3AEC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4120C:\Windows\System32\MsiExec.exe -Embedding C6621963A2BE4D68156F0BC01DDC3C9D E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4144"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 7 -isForBrowser -prefsHandle 4892 -prefMapHandle 5356 -prefsLen 32012 -prefMapSize 244583 -jsInitHandle 1504 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b945ded-5d95-4fe4-abfe-d051ea40f993} 7104 "\\.\pipe\gecko-crash-server-pipe.7104" 224c0de6d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
4488C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
4500"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 936 -prefMapHandle 4664 -prefsLen 36588 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3080944b-9936-4b6d-8f50-4c7db4828426} 7104 "\\.\pipe\gecko-crash-server-pipe.7104" 224be40c310 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4516\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4576\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
55 090
Read events
51 647
Write events
3 408
Delete events
35

Modification events

(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000050316
Operation:writeName:VirtualDesktop
Value:
1000000030304456A48A294F7A40804AB924005FF030B61F
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Deobfuscator.rar
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5992) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010014000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C0000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C0000000D0000000000000053006B007900700065002E006C006E006B003E0020007C000000140000000000000061007000700065006100720063006F00750070006C0065002E0070006E0067003E002000200000001500000000000000640065006D0061006E0064006E006500740077006F0072006B002E0070006E0067003E002000200000001100000000000000640065007300690067006E006800650072002E007200740066003E00200020000000130000000000000069006E0066006F0066007500720074006800650072002E0070006E0067003E0020002000000017000000000000006C0069006E006B00730063006F006E0066006500720065006E00630065002E0070006E0067003E00200020000000130000000000000072006F006C0065006D0069006C006C0069006F006E002E007200740066003E0020002000000014000000000000007300680065006E00650063006500730073006100720079002E007200740066003E002000200000000F00000000000000740065006C0074006800690073002E0070006E0067003E002000200000001400000000000000740065007300740069006E0067006C0069006E00650073002E007200740066003E00200020000000150000000000000074007200750073007400700072006F0062006C0065006D0073002E0070006E0067003E00200020000000190000000000000075006E006B006E006F0077006E00720065007300740061007500720061006E0074002E007200740066003E0020002000000022000000000000004D006F006F006E00530065006300200056002E0032002C00490072006F006E0042007200650077002C0041007A0074007500700042007200650077003E005C0020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001400000000000000000000000000000000000000803F0000004008000000803F0000404009000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F0000000040000080401000000000400000A040110000004040000000001200000000000000803F0100000000000000004002000000000000004040030000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F070000008040000000401300
Executable files
23
Suspicious files
2 168
Text files
713
Unknown types
2

Dropped files

PID
Process
Filename
Type
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\ansi-styles\licensetext
MD5:915042B5DF33C31A6DB2B37EADAA00E3
SHA256:48DA2F39E100D4085767E94966B43F4FA95FF6A0698FBA57ED460914E35F94A0
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\ansi-styles\index.jsbinary
MD5:9D4ACB14D5449B232B22BFE40453B00C
SHA256:D3F197D370760DDD8753C1355B4BDB585A787F1BAA92BB8ED217F170C138B594
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\.package-lock.jsonbinary
MD5:84BE8BFE3849E0689D2153F0FB37093A
SHA256:3F408A0EC4EA7F6B410435BD9669A1AD6C090A0C6A75A38D6C50967C070E08E2
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\index.jsbinary
MD5:F8FA7105FFFCEEE8F081F82A5CC17245
SHA256:8CB943C9782ACC1AB2BF994A2027D42ADB772E6DEEC54C4316ED9197C6C6CD91
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\chalk\licensetext
MD5:915042B5DF33C31A6DB2B37EADAA00E3
SHA256:48DA2F39E100D4085767E94966B43F4FA95FF6A0698FBA57ED460914E35F94A0
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\ansi-styles\index.d.tstext
MD5:8B3CD8B3B64C5FA421B79CC29E607F65
SHA256:6B5A49A699FFBCCCE553DEAD6C39D3B10A896F78869EF5507D30DFCDBF6F0977
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\chalk\index.d.tstext
MD5:9509FFC80EA0EF035CD27FF88E1972D0
SHA256:0D14FA22C41FDC7277E6F71473B20EBC07F40F00E38875142335D5B63CDFC9D2
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\ansi-styles\package.jsonbinary
MD5:AB7A71AB9F6B46ACDA83106C5F34E6E3
SHA256:D405F010681D53F77691015E98461F8484B2AFE6A9EDFDD2DDB27B1E8A8E883D
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\chalk\readme.mdbinary
MD5:85920DFE8C0D5F9234C7F6D372F8A90F
SHA256:B93F6D0B7D7AE17C159D80DC87D583C4432DBA330B3094BA85D8C33D12EB7694
5992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5992.30468\MoonSec V.2,IronBrew,AztupBrew\node_modules\color-convert\CHANGELOG.mdtext
MD5:8BFDDE6C27AEFD62F810963029EC43AD
SHA256:EE2EA4FE91D043EC4214AA60AEAFF595009ACDFDBB9ED4030896191126D70849
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
123
DNS requests
149
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5892
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5892
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7104
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
7104
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
7104
firefox.exe
POST
200
184.24.77.52:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
7104
firefox.exe
POST
200
142.250.185.67:80
http://o.pki.goog/s/wr3/jLM
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6092
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
92.123.104.18:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3976
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6092
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.140
  • 23.48.23.193
  • 23.48.23.145
  • 23.48.23.139
  • 23.48.23.180
  • 23.48.23.143
  • 23.48.23.147
  • 23.48.23.190
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 92.123.104.18
  • 92.123.104.38
  • 92.123.104.59
  • 92.123.104.32
  • 92.123.104.35
  • 92.123.104.23
  • 92.123.104.28
  • 92.123.104.65
  • 92.123.104.61
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.64
  • 20.190.160.131
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 2.18.97.227
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Deobfuscator.rar