File name:

REF--REQUIRED--ORDER-CONFIRMATIONS.cmd

Full analysis: https://app.any.run/tasks/5470e516-ed28-4053-a4f1-93c589de698c
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: January 30, 2025, 10:28:21
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
delphi
m0yv
sinkhole
snake
keylogger
evasion
stealer
smtp
netreactor
truesight
mal-driver
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, Unicode text, UTF-8 text, with very long lines (504), with CRLF line terminators
MD5:

05D564F76213F94C6013E2F5202FC1B8

SHA1:

0331BB25890D7188633716544BD4D27BF970F745

SHA256:

107F5B7D95B1D5DA610D6716545E5646F0C2B60E6E26E1BD835A862C6AFB3DEE

SSDEEP:

24576:Ya8rhD9oVoZdPTqp/lAGyC7lTQd5M77eaGYIcev3m0nA7RWELw2awORgyBBJaNuF:Ya8p9ooeiC7a5M77eUHz0D/h0GjLVTWG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 4400)
      • alpha.pif (PID: 5028)

    • Starts PowerShell from an unusual location

      • alpha.pif (PID: 5028)

    • Changes the autorun value in the registry

      • AnyDesk.pif (PID: 3640)

    • GENERIC has been found (auto)

      • AnyDesk.pif (PID: 3640)

    • M0YV mutex has been found

      • hvphrsqL.pif (PID: 4044)

    • Steals credentials from Web Browsers

      • hvphrsqL.pif (PID: 4044)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • hvphrsqL.pif (PID: 4044)

    • Actions looks like stealing of personal data

      • hvphrsqL.pif (PID: 4044)

    • M0YV has been detected (YARA)

      • hvphrsqL.pif (PID: 4044)

  • SUSPICIOUS

    • Likely accesses (executes) a file from the Public directory

      • extrac32.exe (PID: 372)
      • extrac32.exe (PID: 2280)
      • extrac32.exe (PID: 3540)
      • alpha.pif (PID: 1876)
      • phf.pif (PID: 3208)
      • alpha.pif (PID: 4968)
      • phf.pif (PID: 5588)
      • awpha.pif (PID: 2676)
      • AnyDesk.pif (PID: 3640)
      • cmd.exe (PID: 3884)
      • cmd.exe (PID: 4400)
      • cmd.exe (PID: 4132)
      • extrac32.exe (PID: 2076)
      • extrac32.exe (PID: 1988)
      • extrac32.exe (PID: 5488)
      • alpha.pif (PID: 2600)
      • Upha.pif (PID: 5748)
      • alpha.pif (PID: 5764)
      • Upha.pif (PID: 5080)
      • alpha.pif (PID: 5028)
      • aken.pif (PID: 4556)
      • hvphrsqL.pif (PID: 4044)

    • Drops a file with a rarely used extension (PIF)

      • extrac32.exe (PID: 372)
      • extrac32.exe (PID: 2280)
      • extrac32.exe (PID: 3540)
      • phf.pif (PID: 5588)
      • extrac32.exe (PID: 5488)
      • extrac32.exe (PID: 1988)
      • extrac32.exe (PID: 2076)
      • AnyDesk.pif (PID: 3640)

    • Executable content was dropped or overwritten

      • extrac32.exe (PID: 2280)
      • extrac32.exe (PID: 372)
      • extrac32.exe (PID: 3540)
      • phf.pif (PID: 5588)
      • AnyDesk.pif (PID: 3640)
      • extrac32.exe (PID: 2076)
      • extrac32.exe (PID: 1988)
      • extrac32.exe (PID: 5488)
      • hvphrsqL.pif (PID: 4044)

    • Starts application with an unusual extension

      • alpha.pif (PID: 1876)
      • cmd.exe (PID: 2144)
      • alpha.pif (PID: 4968)
      • awpha.pif (PID: 2676)
      • cmd.exe (PID: 4132)
      • cmd.exe (PID: 4400)
      • alpha.pif (PID: 2600)
      • alpha.pif (PID: 5764)
      • alpha.pif (PID: 5028)
      • AnyDesk.pif (PID: 3640)

    • Starts itself from another location

      • cmd.exe (PID: 2144)
      • cmd.exe (PID: 4400)

    • Starts a Microsoft application from unusual location

      • awpha.pif (PID: 2676)
      • alpha.pif (PID: 2600)
      • Upha.pif (PID: 5748)
      • alpha.pif (PID: 5764)
      • Upha.pif (PID: 5080)
      • alpha.pif (PID: 5028)
      • aken.pif (PID: 4556)

    • Reads the date of Windows installation

      • awpha.pif (PID: 2676)

    • Reads security settings of Internet Explorer

      • awpha.pif (PID: 2676)
      • AnyDesk.pif (PID: 3640)
      • aken.pif (PID: 4556)

    • Starts CMD.EXE for commands execution

      • AnyDesk.pif (PID: 3640)
      • svchost.pif (PID: 4968)

    • There is functionality for taking screenshot (YARA)

      • AnyDesk.pif (PID: 3640)

    • Executing commands from ".cmd" file

      • AnyDesk.pif (PID: 3640)
      • svchost.pif (PID: 4968)

    • Drops a system driver (possible attempt to evade defenses)

      • AnyDesk.pif (PID: 3640)

    • Process drops legitimate windows executable

      • extrac32.exe (PID: 2076)
      • hvphrsqL.pif (PID: 4044)

    • Checks Windows Trust Settings

      • aken.pif (PID: 4556)

    • Checks for external IP

      • hvphrsqL.pif (PID: 4044)
      • svchost.exe (PID: 2192)

    • Connects to SMTP port

      • hvphrsqL.pif (PID: 4044)

    • The process verifies whether the antivirus software is installed

      • hvphrsqL.pif (PID: 4044)

  • INFO

    • Reads the computer name

      • extrac32.exe (PID: 372)
      • extrac32.exe (PID: 2280)
      • extrac32.exe (PID: 3540)
      • phf.pif (PID: 3208)
      • phf.pif (PID: 5588)
      • awpha.pif (PID: 2676)
      • AnyDesk.pif (PID: 3640)
      • extrac32.exe (PID: 2076)
      • extrac32.exe (PID: 5488)
      • extrac32.exe (PID: 1988)
      • Upha.pif (PID: 5748)
      • Upha.pif (PID: 5080)
      • aken.pif (PID: 4556)
      • hvphrsqL.pif (PID: 4044)

    • Checks supported languages

      • extrac32.exe (PID: 2280)
      • extrac32.exe (PID: 372)
      • extrac32.exe (PID: 3540)
      • alpha.pif (PID: 1876)
      • alpha.pif (PID: 4968)
      • phf.pif (PID: 3208)
      • phf.pif (PID: 5588)
      • awpha.pif (PID: 2676)
      • AnyDesk.pif (PID: 3640)
      • svchost.pif (PID: 4968)
      • extrac32.exe (PID: 2076)
      • extrac32.exe (PID: 1988)
      • extrac32.exe (PID: 5488)
      • alpha.pif (PID: 2600)
      • Upha.pif (PID: 5748)
      • alpha.pif (PID: 5028)
      • alpha.pif (PID: 5764)
      • Upha.pif (PID: 5080)
      • aken.pif (PID: 4556)
      • hvphrsqL.pif (PID: 4044)

    • Process checks computer location settings

      • awpha.pif (PID: 2676)

    • Checks proxy server information

      • AnyDesk.pif (PID: 3640)
      • hvphrsqL.pif (PID: 4044)

    • Compiled with Borland Delphi (YARA)

      • AnyDesk.pif (PID: 3640)

    • Reads the software policy settings

      • AnyDesk.pif (PID: 3640)
      • aken.pif (PID: 4556)
      • hvphrsqL.pif (PID: 4044)

    • The sample compiled with english language support

      • extrac32.exe (PID: 2076)
      • AnyDesk.pif (PID: 3640)
      • hvphrsqL.pif (PID: 4044)

    • Process checks Powershell version

      • aken.pif (PID: 4556)

    • Create files in a temporary directory

      • aken.pif (PID: 4556)

    • Reads the machine GUID from the registry

      • aken.pif (PID: 4556)
      • hvphrsqL.pif (PID: 4044)
      • AnyDesk.pif (PID: 3640)

    • Reads Environment values

      • aken.pif (PID: 4556)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • aken.pif (PID: 4556)

    • Script raised an exception (POWERSHELL)

      • aken.pif (PID: 4556)

    • Creates files or folders in the user directory

      • hvphrsqL.pif (PID: 4044)

    • Disables trace logs

      • hvphrsqL.pif (PID: 4044)

    • .NET Reactor protector has been detected

      • hvphrsqL.pif (PID: 4044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
31
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs extrac32.exe extrac32.exe extrac32.exe alpha.pif no specs phf.pif no specs alpha.pif no specs phf.pif awpha.pif no specs #GENERIC anydesk.pif cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs svchost.pif no specs svchost.pif no specs svchost.pif cmd.exe no specs conhost.exe no specs extrac32.exe extrac32.exe extrac32.exe alpha.pif no specs upha.pif no specs alpha.pif no specs upha.pif no specs alpha.pif no specs aken.pif no specs #M0YV hvphrsql.pif svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
372extrac32 /C /Y "C:\\Windows\\System32\\wlrmdr.exe" "C:\\Users\\Public\\awpha.pif" C:\Windows\System32\extrac32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
372"C:\Windows \SysWOW64\svchost.pif" C:\Windows \SysWOW64\svchost.pif—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Exchange ActiveSync Invoker
Exit code:
3221226540
Version:
10.0.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\windows \syswow64\svchost.pif
c:\windows\system32\ntdll.dll
396\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1876C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\phf.pif -decodehex -F "C:\Users\admin\Desktop\REF--REQUIRED--ORDER-CONFIRMATIONS.cmd.bat" "C:\\Users\\Public\\AnyDesk.avi" 9 C:\Users\Public\alpha.pif—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\public\alpha.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1988extrac32 /C /Y C:\\Windows\\System32\\sc.exe C:\\Users\\Public\\Upha.pif C:\Windows\System32\extrac32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2076extrac32 /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.pif C:\Windows\System32\extrac32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2144C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\REF--REQUIRED--ORDER-CONFIRMATIONS.cmd.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2280extrac32 /C /Y "C:\\Windows\\System32\\cmd.exe" "C:\\Users\\Public\\alpha.pif" C:\Windows\System32\extrac32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
14 688
Read events
14 671
Write events
17
Delete events
0

Modification events

(PID) Process:(2144) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4132) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(3640) AnyDesk.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Lqsrhpvh
Value:
C:\Users\Public\Lqsrhpvh.url
(PID) Process:(4044) hvphrsqL.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hvphrsqL_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4044) hvphrsqL.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hvphrsqL_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4044) hvphrsqL.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hvphrsqL_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4044) hvphrsqL.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hvphrsqL_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4044) hvphrsqL.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hvphrsqL_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4044) hvphrsqL.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hvphrsqL_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4044) hvphrsqL.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hvphrsqL_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
21
Suspicious files
3
Text files
6
Unknown types
1

Dropped files

PID
Process
Filename
Type
3540extrac32.exeC:\Users\Public\phf.pifexecutable
MD5:A7A5B67EC704EAC6D6E6AF0489353F42
SHA256:BF072F9A6A15B550B13AE86A4FBD3FA809D2A13236847AE9FA9A68F41386106E
372extrac32.exeC:\Users\Public\awpha.pifexecutable
MD5:59BD6F822956E54CDEDD0C441372C289
SHA256:2F89115E1081C91BABAF2961CEF0BCF9C8F4EE803D3BE6E88ACE23B383FE7324
3640AnyDesk.pifC:\Users\Public\LqsrhpvhF.cmdtext
MD5:F82AEB3B12F33250E404DF6EC873DD1D
SHA256:23B7417B47C7EFB96FB7CE395E325DC831AB2EE03EADDA59058D31BDBE9C1EA6
3640AnyDesk.pifC:\Windows \SysWOW64\svchost.pifexecutable
MD5:869640D0A3F838694AB4DFEA9E2F544D
SHA256:0DB4D3FFDB96D13CF3B427AF8BE66D985728C55AE254E4B67D287797E4C0B323
2076extrac32.exeC:\Users\Public\alpha.pifexecutable
MD5:CB6CD09F6A25744A8FA6E4B3E4D260C5
SHA256:265B69033CEA7A9F8214A34CD9B17912909AF46C7A47395DD7BB893A24507E59
2280extrac32.exeC:\Users\Public\alpha.pifexecutable
MD5:CB6CD09F6A25744A8FA6E4B3E4D260C5
SHA256:265B69033CEA7A9F8214A34CD9B17912909AF46C7A47395DD7BB893A24507E59
5588phf.pifC:\Users\Public\Libraries\AnyDesk.pifexecutable
MD5:B465857AE91273991DD72307AF91A130
SHA256:9195F22B8899A2E762B0C3FB1E8C16841159644608B4FCA8A963C1D95ADAA365
3208phf.pifC:\Users\Public\AnyDesk.avitext
MD5:25033B898F4F4B7BADE231EB9AB4C4CE
SHA256:A403F7AEF97DC7C545FB1FF7B73E90741F22CAEC1972A38C273538BC4BF130D0
3640AnyDesk.pifC:\Users\Public\Libraries\Lqsrhpvh.mp3executable
MD5:F53FA44C7B591A2BE105344790543369
SHA256:BFC2EF3B404294FE2FA05A8B71C7F786B58519175B7202A69FE30F45E607FF1C
3640AnyDesk.pifC:\Windows \SysWOW64\NETUTILS.dllexecutable
MD5:3E09A81444C29DC7F3D8D2C79AF30D3A
SHA256:EAB451B09E71B7E508916C0445AD22FF68CCC3923E019A59208F9ED953C54240
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
39
DNS requests
25
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
303
142.250.185.78:443
https://drive.google.com/uc?export=download&id=1t9mWFr1AZhmKSOSp19tOMCH5dYI3hB2N
unknown
—
—
—
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4044
hvphrsqL.pif
POST
200
18.141.10.107:80
http://ssbzmoy.biz/d
unknown
—
—
malicious
4044
hvphrsqL.pif
POST
200
54.244.188.177:80
http://pywolwnvd.biz/fyasgrqndgaklklg
unknown
—
—
malicious
4044
hvphrsqL.pif
GET
200
193.122.130.0:80
http://checkip.dyndns.org/
unknown
—
—
malicious
4044
hvphrsqL.pif
POST
200
44.221.84.105:80
http://npukfztj.biz/msovyetpappwa
unknown
—
—
malicious
4044
hvphrsqL.pif
GET
200
193.122.130.0:80
http://checkip.dyndns.org/
unknown
—
—
malicious
4044
hvphrsqL.pif
POST
200
54.244.188.177:80
http://cvgrf.biz/xeo
unknown
—
—
unknown
4044
hvphrsqL.pif
POST
302
72.52.178.23:80
http://przvgke.biz/bxswjufnymfimff
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
—
—
92.123.104.21:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
4712
MoUsoCoreWorker.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3976
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3640
AnyDesk.pif
142.250.185.110:443
drive.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 92.123.104.21
  • 92.123.104.17
  • 92.123.104.19
  • 92.123.104.16
  • 92.123.104.20
  • 92.123.104.26
  • 92.123.104.23
  • 92.123.104.27
  • 92.123.104.18
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.181.238
unknown
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.104
  • 2.16.164.105
  • 2.16.164.107
  • 2.16.164.91
  • 2.16.164.89
  • 2.16.164.74
  • 2.16.164.99
  • 2.16.164.112
whitelisted
www.microsoft.com
  • 23.35.229.160
unknown
drive.google.com
  • 142.250.185.110
unknown
drive.usercontent.google.com
  • 142.250.185.193
unknown
pywolwnvd.biz
  • 54.244.188.177
malicious
ssbzmoy.biz
  • 18.141.10.107
malicious
checkip.dyndns.org
  • 193.122.130.0
  • 132.226.247.73
  • 193.122.6.168
  • 158.101.44.242
  • 132.226.8.169
shared

Threats

PID
Process
Class
Message
4044
hvphrsqL.pif
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
4044
hvphrsqL.pif
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
4044
hvphrsqL.pif
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
4044
hvphrsqL.pif
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
2192
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
4044
hvphrsqL.pif
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
4044
hvphrsqL.pif
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
2192
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
4044
hvphrsqL.pif
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
REF--REQUIRED--ORDER-CONFIRMATIONS.cmd