File name:

#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest.zip

Full analysis: https://app.any.run/tasks/7d2c4212-a794-4e96-8be2-acbf3864da6e
Verdict: Malicious activity
Analysis date: March 24, 2025, 19:14:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
susp-attachments
attachments
attc-eml
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

79E367B9A0D71ACEF00315580F67FBE8

SHA1:

A5EB63F84CC1DFEEE2FE0D1CF629DFF2F7659D61

SHA256:

0B051358DEDC2147027315ADB1AC9B401B1E27F9DA76AA84CABA7EC82A581777

SSDEEP:

98304:AKlrCbPuatzSVutlEJZZ18HS+7FtmBGK0vDPFaKgsVWuPct0iUle3N04qa4cj2pY:k8GVgRpr+In

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 5156)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7832)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 7832)

    • Starts application with an unusual extension

      • Setup.exe (PID: 6808)
      • Setup.exe (PID: 3176)

  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8148)
      • BackgroundTransferHost.exe (PID: 7932)
      • BackgroundTransferHost.exe (PID: 5756)
      • BackgroundTransferHost.exe (PID: 4436)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 8148)

    • Manual execution by a user

      • WinRAR.exe (PID: 7832)
      • Setup.exe (PID: 6808)
      • WinRAR.exe (PID: 5528)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8148)
      • slui.exe (PID: 7392)
      • slui.exe (PID: 7188)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7832)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7832)

    • The sample compiled with chinese language support

      • WinRAR.exe (PID: 7832)

    • Create files in a temporary directory

      • Setup.exe (PID: 6808)
      • Setup.exe (PID: 3176)

    • Checks supported languages

      • Setup.exe (PID: 6808)
      • more.com (PID: 6516)
      • Setup.exe (PID: 3176)

    • Creates files in the program directory

      • Setup.exe (PID: 6808)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8148)

    • Reads the machine GUID from the registry

      • more.com (PID: 6516)
      • MSBuild.exe (PID: 2420)

    • Reads the computer name

      • MSBuild.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CKโ„ข MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: 0x0800
ZipCompression: None
ZipModifyDate: 2025:03:24 15:37:18
ZipCRC: 0x380b4b90
ZipCompressedSize: 6819521
ZipUncompressedSize: 6819521
ZipFileName: #๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest.7z
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
26
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs winrar.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs rundll32.exe no specs winrar.exe setup.exe no specs slui.exe more.com no specs conhost.exe no specs CMSTPLUA setup.exe no specs shellexperiencehost.exe no specs msbuild.exe no specs more.com no specs conhost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2420C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeโ€”Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\ksbys
c:\windows\syswow64\msi.dll
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
3176"C:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\Setup.exe" C:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\Setup.exeโ€”dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\#๐“Ÿ๐“ช$๐“’ล๐”ป๐“ฎ--8799--set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!latest\#๐“Ÿ๐“ช$๐“’ล๐”ป๐“ฎ--8799--set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!latest\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4436"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exeโ€”svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5116"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeโ€”svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
5156C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
5204\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeโ€”more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5528"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest.zip" C:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\C:\Program Files\WinRAR\WinRAR.exeโ€”explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5756"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exeโ€”svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5868\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeโ€”more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6372C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.comโ€”Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
More Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
Total events
6ย 506
Read events
6ย 471
Write events
35
Delete events
0

Modification events

(PID) Process:(7300)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7300)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7300)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7300)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7300)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000008202050000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(7300)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F00000000000000000000000000000000000000000006C0203000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(7300)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F0000000000000000000000000000000000000000000580203000000000000000000180000006400000000000000000000000000000003000000
(PID) Process:(7932)ย BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7932)ย BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7932)ย BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
37
Suspicious files
17
Text files
71
Unknown types
1

Dropped files

PID
Process
Filename
Type
8148BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d2a35b82-5f7a-4f30-ad5a-17ec5f435400.down_data โ€”
MD5:โ€”
SHA256:โ€”
5528WinRAR.exeC:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest.7z โ€”
MD5:โ€”
SHA256:โ€”
8148BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
7832WinRAR.exeC:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\age.xlsxbinary
MD5:083D14A1A14417CE32DD29EAAFF23ECA
SHA256:7CE306B10E6921D26873B163EA447FCA6C05E5A1676772AE00C17CF089B50B72
7832WinRAR.exeC:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\Resource\bug78694.phpttext
MD5:B9FA9887732F5436B4C3947947001E37
SHA256:3C3751CC0827DE33125FAF0272994159ACF45403FB5FCF4BBB1D1BADFCD267D8
8148BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e24d664d-2bcb-4c14-92ba-9b98fad17ff6.14a72858-4136-448c-8ad4-561c1a14fed6.down_metabinary
MD5:8D967600916B52D952E30F4349F2322E
SHA256:864DDDC05F416B3C69BADF11BCC7887BE7D4B89BA5F44B8FE14EF85D8F5C62AF
7832WinRAR.exeC:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\Resource\exif015.phptbinary
MD5:70F543FBE2A2444389F834222D5CC60B
SHA256:0AC0753EF9D1B1E26FD4561D119B4D072ECD44B105BC297C94109C6D170A5080
7832WinRAR.exeC:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\Resource\047.phpttext
MD5:5262A79302A4653A74F681233EC4B16D
SHA256:65AFDD8DCD75D46FDFDCAD493A35CAD21F87DBA8800307A27C7917D8C3F66F37
7832WinRAR.exeC:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\Resource\bug35624.phpttext
MD5:493F82E9D07406792068E4837A00F9EF
SHA256:367D6F72864F03CA73B023589BA3CAF6DC5563462756F43F12A89F9390BDCE8A
7832WinRAR.exeC:\Users\admin\Desktop\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest\Resource\browscap_no_default.initext
MD5:CE518DB6714865377D209D3889510F7B
SHA256:3E237FA8F3B33B1A7499BEB6C4DD2060DC0E095A5EDE1002DA049E51ABDAA0A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
27
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
728
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
โ€”
โ€”
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
โ€”
โ€”
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
โ€”
โ€”
whitelisted
7692
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
โ€”
โ€”
whitelisted
7692
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
โ€”
โ€”
whitelisted
8148
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
โ€”
โ€”
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
โ€”
โ€”
โ€”
whitelisted
โ€”
โ€”
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.141:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
โ€”
โ€”
โ€”
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
728
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 172.217.18.110
whitelisted
crl.microsoft.com
  • 23.48.23.141
  • 23.48.23.176
  • 23.48.23.177
  • 23.48.23.173
  • 23.48.23.193
  • 23.48.23.143
  • 23.48.23.180
  • 23.48.23.159
  • 23.48.23.156
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.128
  • 20.190.159.68
  • 40.126.31.128
  • 40.126.31.0
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.162
  • 104.126.37.185
  • 104.126.37.163
  • 104.126.37.155
  • 104.126.37.161
  • 104.126.37.160
  • 104.126.37.176
  • 104.126.37.171
  • 104.126.37.178
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
ยฉ 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
#๐“Ÿ๐“ช$๐“’ลŒ๐”ป๐“ฎ--8799--Set๐“คp_๐““๐“ธ๐”€๐“ท๐“ต๐“ช๐“ธ๐“ญ_32_๐Ÿž๐Ÿœ๐•“๐•š!!!Latest.zip