File name:

WinrarUpdate.exe

Full analysis: https://app.any.run/tasks/e879b385-ed66-4c4f-8ce2-1532e1f093ec
Verdict: Malicious activity
Threats:

LockBit, a ransomware variant, encrypts data on infected machines, demanding a ransom payment for decryption. Used in targeted attacks, It's a significant risk to organizations.

Malware Trends Tracker     >>>
Analysis date: July 22, 2024, 02:23:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
remote
upx
ransomware
stealer
lockbit
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

FDBD64B74A367F7F95D449A14BDDD3F7

SHA1:

6FAD561C71C597C3BED29E4783D91972CAC538E0

SHA256:

0FA7CAC41276D2410D48509A3330C0DD262783CBAF0715284CDDA737BCF9E8E8

SSDEEP:

768:QhTXuUJRJRbSfPWpOGxF4kYcfOVZAIejox7Qid1V1pHK3sXGIG:GTXhJRGKxefIE3FK8XRG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS has been detected

      • WinrarUpdate.exe (PID: 1540)
      • WinrarUpdate.exe (PID: 1540)

    • UAC/LUA settings modification

      • reg.exe (PID: 6936)

    • Drops the executable file immediately after the start

      • WinrarUpdate.exe (PID: 1540)
      • dwn.exe (PID: 7588)
      • msiexec.exe (PID: 6444)

    • REMCOS has been detected (YARA)

      • WinrarUpdate.exe (PID: 1540)

    • REMCOS has been detected (SURICATA)

      • WinrarUpdate.exe (PID: 1540)

    • Renames files like ransomware

      • dwn.exe (PID: 7588)

    • Steals credentials from Web Browsers

      • dwn.exe (PID: 7588)

    • [YARA] LockBit is detected

      • dwn.exe (PID: 7588)

    • Scans artifacts that could help determine the target

      • ONENOTE.EXE (PID: 2268)
      • Integrator.exe (PID: 4600)
      • Integrator.exe (PID: 2860)

    • Actions looks like stealing of personal data

      • dwn.exe (PID: 7588)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WinrarUpdate.exe (PID: 1540)
      • 3C0B.tmp (PID: 6932)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7604)

    • Reads the date of Windows installation

      • WinrarUpdate.exe (PID: 1540)
      • 3C0B.tmp (PID: 6932)
      • SearchApp.exe (PID: 7656)
      • ONENOTE.EXE (PID: 2268)

    • Reads security settings of Internet Explorer

      • WinrarUpdate.exe (PID: 1540)
      • 3C0B.tmp (PID: 6932)
      • ONENOTE.EXE (PID: 2268)
      • Integrator.exe (PID: 4600)
      • Integrator.exe (PID: 2860)

    • Connects to unusual port

      • WinrarUpdate.exe (PID: 1540)

    • Write to the desktop.ini file (may be used to cloak folders)

      • dwn.exe (PID: 7588)

    • Creates files like ransomware instruction

      • dwn.exe (PID: 7588)

    • Executable content was dropped or overwritten

      • dwn.exe (PID: 7588)

    • Executing commands from a ".bat" file

      • WinrarUpdate.exe (PID: 1540)

    • Starts application with an unusual extension

      • dwn.exe (PID: 7588)

    • Changes the desktop background image

      • dwn.exe (PID: 7588)

    • Detected use of alternative data streams (AltDS)

      • ONENOTE.EXE (PID: 2268)

    • Hides command output

      • cmd.exe (PID: 7480)

    • Checks Windows Trust Settings

      • ONENOTE.EXE (PID: 2268)
      • Integrator.exe (PID: 2860)
      • Integrator.exe (PID: 4600)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 6444)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6444)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6444)

  • INFO

    • Create files in a temporary directory

      • WinrarUpdate.exe (PID: 1540)
      • dwn.exe (PID: 7588)
      • ONENOTE.EXE (PID: 2268)

    • UPX packer has been detected

      • WinrarUpdate.exe (PID: 1540)

    • Reads Environment values

      • WinrarUpdate.exe (PID: 1540)
      • ONENOTE.EXE (PID: 2268)
      • msiexec.exe (PID: 6548)
      • Integrator.exe (PID: 4600)
      • Integrator.exe (PID: 2860)

    • Checks supported languages

      • WinrarUpdate.exe (PID: 1540)
      • dwn.exe (PID: 7588)
      • SearchApp.exe (PID: 7656)
      • 3C0B.tmp (PID: 6932)
      • ONENOTE.EXE (PID: 2268)
      • OfficeClickToRun.exe (PID: 6812)
      • Integrator.exe (PID: 4600)
      • msiexec.exe (PID: 6444)
      • msiexec.exe (PID: 6548)
      • Integrator.exe (PID: 2860)

    • Reads the computer name

      • dwn.exe (PID: 7588)
      • WinrarUpdate.exe (PID: 1540)
      • SearchApp.exe (PID: 7656)
      • ONENOTE.EXE (PID: 2268)
      • 3C0B.tmp (PID: 6932)
      • OfficeClickToRun.exe (PID: 6812)
      • Integrator.exe (PID: 4600)
      • msiexec.exe (PID: 6444)
      • msiexec.exe (PID: 6548)
      • Integrator.exe (PID: 2860)

    • Process checks computer location settings

      • WinrarUpdate.exe (PID: 1540)
      • SearchApp.exe (PID: 7656)
      • 3C0B.tmp (PID: 6932)
      • ONENOTE.EXE (PID: 2268)
      • Integrator.exe (PID: 4600)
      • Integrator.exe (PID: 2860)

    • Creates files in the program directory

      • dwn.exe (PID: 7588)

    • Creates files or folders in the user directory

      • dwn.exe (PID: 7588)
      • printfilterpipelinesvc.exe (PID: 3388)
      • ONENOTE.EXE (PID: 2268)
      • WinrarUpdate.exe (PID: 1540)

    • Checks proxy server information

      • SearchApp.exe (PID: 7656)
      • ONENOTE.EXE (PID: 2268)
      • OfficeClickToRun.exe (PID: 6812)
      • Integrator.exe (PID: 4600)
      • Integrator.exe (PID: 2860)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 7656)
      • dwn.exe (PID: 7588)
      • OfficeClickToRun.exe (PID: 6812)
      • ONENOTE.EXE (PID: 2268)
      • Integrator.exe (PID: 2860)
      • Integrator.exe (PID: 4600)

    • Reads the software policy settings

      • SearchApp.exe (PID: 7656)
      • OfficeClickToRun.exe (PID: 6812)
      • ONENOTE.EXE (PID: 2268)
      • Integrator.exe (PID: 4600)
      • Integrator.exe (PID: 2860)

    • Process checks Internet Explorer phishing filters

      • SearchApp.exe (PID: 7656)

    • Reads security settings of Internet Explorer

      • splwow64.exe (PID: 2160)
      • printfilterpipelinesvc.exe (PID: 3388)
      • notepad.exe (PID: 2072)

    • Reads Microsoft Office registry keys

      • ONENOTE.EXE (PID: 2268)
      • OfficeClickToRun.exe (PID: 6812)
      • Integrator.exe (PID: 4600)
      • OpenWith.exe (PID: 6568)
      • Integrator.exe (PID: 2860)
      • OpenWith.exe (PID: 7800)
      • OpenWith.exe (PID: 7060)

    • Manual execution by a user

      • notepad.exe (PID: 2072)

    • Executes as Windows Service

      • OfficeClickToRun.exe (PID: 6812)

    • Reads CPU info

      • ONENOTE.EXE (PID: 2268)
      • Integrator.exe (PID: 4600)
      • Integrator.exe (PID: 2860)

    • Reads product name

      • ONENOTE.EXE (PID: 2268)

    • Application launched itself

      • msiexec.exe (PID: 6444)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6444)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6444)

    • Dropped object may contain TOR URL's

      • dwn.exe (PID: 7588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (28.6)
.exe | UPX compressed Win32 Executable (28)
.exe | Win32 EXE Yoda's Crypter (27.5)
.dll | Win32 Dynamic Link Library (generic) (6.8)
.exe | Win32 Executable (generic) (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:01:05 19:50:13+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 32768
InitializedDataSize: 8192
UninitializedDataSize: 73728
EntryPoint: 0x1a790
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
30
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT winrarupdate.exe cmd.exe no specs iexplore.exe no specs conhost.exe no specs reg.exe no specs slui.exe no specs #LOCKBIT dwn.exe ucpdmgr.exe no specs conhost.exe no specs searchapp.exe cmd.exe no specs conhost.exe no specs splwow64.exe no specs printfilterpipelinesvc.exe no specs onenote.exe 3c0b.tmp no specs cmd.exe no specs conhost.exe no specs notepad.exe no specs officeclicktorun.exe integrator.exe conhost.exe no specs msiexec.exe msiexec.exe no specs integrator.exe conhost.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs winrarupdate.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1032"C:\Users\admin\Desktop\WinrarUpdate.exe" C:\Users\admin\Desktop\WinrarUpdate.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\winrarupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1540"C:\Users\admin\Desktop\WinrarUpdate.exe" C:\Users\admin\Desktop\WinrarUpdate.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\winrarupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2072"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\9Ua4jT3Ld.README.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2160C:\WINDOWS\splwow64.exe 12288C:\Windows\splwow64.exe—dwn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Print driver host for applications
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\splwow64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2268/insertdoc "C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\{DF9C1216-E250-4F8E-B1F6-3AC8C6B767C7}.xps" 133660888479830000C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
printfilterpipelinesvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft OneNote
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\onenote.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2860integrator.exe /R /License PRIDName=OneNoteFreeRetail.16,Professional2019Retail.16 /C2R PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
OfficeClickToRun.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Click-to-Run Integrator
Exit code:
3221356598
Version:
16.0.16026.20086
Modules
Images
c:\program files\microsoft office\root\integration\integrator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
3128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3388C:\WINDOWS\system32\printfilterpipelinesvc.exe -EmbeddingC:\Windows\System32\printfilterpipelinesvc.exe—svchost.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Print Filter Pipeline Host
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\printfilterpipelinesvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4152C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4496"C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe—WinrarUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
11.00.19041.1 (WinBuild.160101.0800)
Total events
45 931
Read events
42 049
Write events
3 660
Delete events
222

Modification events

(PID) Process:(1540) WinrarUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\remcos_lyaurjbybgbivac
Operation:writeName:EXEpath
Value:
PÜè6>%*k N. -[¿ØlEmƒ‚¥äá³cÛ5Dì<dx¸Ì
(PID) Process:(6936) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(1540) WinrarUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1540) WinrarUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1540) WinrarUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1540) WinrarUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7588) dwn.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
12
(PID) Process:(7588) dwn.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
A41D000004E2334DDEDBDA01
(PID) Process:(7588) dwn.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
E106D56CCB5CB25532EA1A1D005A34B6E81F98C0C7F49D0B59CC56AC7E4DE727
(PID) Process:(7588) dwn.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
Executable files
30
Suspicious files
2 097
Text files
2 456
Unknown types
42

Dropped files

PID
Process
Filename
Type
7588dwn.exeC:\$Recycle.Bin\S-1-5-18\desktop.inibinary
MD5:53E87ADEF6B90CBBAC91A80AEFF85DB1
SHA256:C77DE2B04E1E4AD3B14F44F15A72F0CC475111F97A7E785813F2E4A0DCB0E645
7588dwn.exeC:\$Recycle.Bin\S-1-5-18\FFFFFFFFFFFbinary
MD5:53E87ADEF6B90CBBAC91A80AEFF85DB1
SHA256:C77DE2B04E1E4AD3B14F44F15A72F0CC475111F97A7E785813F2E4A0DCB0E645
1540WinrarUpdate.exeC:\Users\admin\AppData\Roaming\remcos\logs.dattext
MD5:5C5767635D19537590F86B28812984F2
SHA256:93BAF728AC39B5097B5740BCFCEF0CC47C018BF32CF1A18718648246EDCA13A4
1540WinrarUpdate.exeC:\Users\admin\AppData\Local\Temp\dwn.exetext
MD5:9888EDE4CD12681CDCC929A7038A033A
SHA256:4400B9E2697EE80799F72A4B792A81D235B8263EC37B2193BF5DBCF15DEC1BDF
7588dwn.exeC:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHHbinary
MD5:53E87ADEF6B90CBBAC91A80AEFF85DB1
SHA256:C77DE2B04E1E4AD3B14F44F15A72F0CC475111F97A7E785813F2E4A0DCB0E645
7588dwn.exeC:\$Recycle.Bin\S-1-5-18\DDDDDDDDDDDbinary
MD5:53E87ADEF6B90CBBAC91A80AEFF85DB1
SHA256:C77DE2B04E1E4AD3B14F44F15A72F0CC475111F97A7E785813F2E4A0DCB0E645
7588dwn.exeC:\ProgramData\9Ua4jT3Ld.icoimage
MD5:88D9337C4C9CFE2D9AFF8A2C718EC76B
SHA256:95E059EF72686460884B9AEA5C292C22917F75D56FE737D43BE440F82034F438
7588dwn.exeC:\$Recycle.Bin\S-1-5-18\IIIIIIIIIIIbinary
MD5:53E87ADEF6B90CBBAC91A80AEFF85DB1
SHA256:C77DE2B04E1E4AD3B14F44F15A72F0CC475111F97A7E785813F2E4A0DCB0E645
7588dwn.exeC:\$Recycle.Bin\S-1-5-18\JJJJJJJJJJJbinary
MD5:53E87ADEF6B90CBBAC91A80AEFF85DB1
SHA256:C77DE2B04E1E4AD3B14F44F15A72F0CC475111F97A7E785813F2E4A0DCB0E645
7588dwn.exeC:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGGbinary
MD5:53E87ADEF6B90CBBAC91A80AEFF85DB1
SHA256:C77DE2B04E1E4AD3B14F44F15A72F0CC475111F97A7E785813F2E4A0DCB0E645
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
71
DNS requests
26
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2268
ONENOTE.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2268
ONENOTE.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4716
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5620
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2760
svchost.exe
40.113.103.199:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7856
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1540
WinrarUpdate.exe
3.17.7.232:14184
0.tcp.ngrok.io
AMAZON-02
US
unknown
8112
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5620
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.159.75
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.160.17
  • 40.126.32.68
  • 40.126.32.136
  • 20.190.160.22
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.74
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 216.58.212.174
whitelisted
0.tcp.ngrok.io
  • 3.17.7.232
shared
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted
www.bing.com
  • 184.86.251.22
  • 184.86.251.27
  • 184.86.251.19
  • 184.86.251.7
  • 2.23.209.187
  • 2.23.209.130
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2168
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
1540
WinrarUpdate.exe
A Network Trojan was detected
REMOTE [ANY.RUN] Remcos Successful Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinrarUpdate.exe