File name:

Maltoolkit.exe

Full analysis: https://app.any.run/tasks/4253e374-0bda-4f99-9a06-28a69c99135e
Verdict: Malicious activity
Analysis date: June 17, 2023, 20:46:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D4163D85BA71A09B181DEA459744698C

SHA1:

002EFBDAF3B87A486CD1B577B219A36995A66489

SHA256:

1FD51D6DD83F903B81C2FE5EE5811A32F4EEDDAE97B02C89659E6F0E7DA16B1E

SSDEEP:

12288:FkJiiL9fPbGXY3ZuTmlOIq76xb35zdtKTKKpKKM:Fk0iL97ngEMWx35

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • adminGDI169.exe.exe (PID: 2532)
      • adminGDI169.exe.exe (PID: 2384)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Maltoolkit.exe (PID: 2732)
      • adminGDI169.exe.exe (PID: 2532)
      • adminGDI169.exe.exe (PID: 2384)

    • Executable content was dropped or overwritten

      • adminGDI169.exe.exe (PID: 2532)
      • iexpress.exe (PID: 3416)
      • adminGDI169.exe.exe (PID: 2384)

    • Reads the Internet Settings

      • Maltoolkit.exe (PID: 3824)

  • INFO

    • Reads the computer name

      • Maltoolkit.exe (PID: 2732)
      • Maltoolkit.exe (PID: 2804)
      • Maltoolkit.exe (PID: 3824)
      • Maltoolkit.exe (PID: 2448)

    • Reads the machine GUID from the registry

      • Maltoolkit.exe (PID: 2732)
      • Maltoolkit.exe (PID: 2804)
      • Maltoolkit.exe (PID: 3824)
      • Maltoolkit.exe (PID: 2448)

    • Manual execution by a user

      • taskmgr.exe (PID: 1432)
      • adminGDI169.exe.exe (PID: 2532)
      • Maltoolkit.exe (PID: 3824)
      • adminGDI169.exe.exe (PID: 2384)

    • Checks supported languages

      • Maltoolkit.exe (PID: 2804)
      • Maltoolkit.exe (PID: 3824)
      • adminGDI169.exe.exe (PID: 2532)
      • Maltoolkit.exe (PID: 2732)
      • adminGDI169.exe.exe (PID: 2384)
      • Maltoolkit.exe (PID: 2448)

    • Create files in a temporary directory

      • makecab.exe (PID: 3572)
      • Maltoolkit.exe (PID: 2732)
      • adminGDI169.exe.exe (PID: 2532)
      • adminGDI169.exe.exe (PID: 2384)

    • The process checks LSA protection

      • Maltoolkit.exe (PID: 2732)
      • Maltoolkit.exe (PID: 2804)
      • Maltoolkit.exe (PID: 3824)
      • Maltoolkit.exe (PID: 2448)

    • The executable file from the user directory is run by the CMD process

      • Maltoolkit.exe (PID: 2804)
      • Maltoolkit.exe (PID: 2448)

    • Application launched itself

      • iexplore.exe (PID: 292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

AssemblyVersion: 1.0.0.0
ProductVersion: 1.0.0.0
ProductName: Maltoolkit
OriginalFileName: Maltoolkit.exe
LegalTrademarks: -
LegalCopyright: Copyright © MALWAREMAN
InternalName: Maltoolkit.exe
FileVersion: 1.0.0.0
FileDescription: Maltoolkit
CompanyName: MALWAREMAN
Comments: Made by malwareman https://www.youtube.com/channel/UCk8Gj-r2kQdCkleLtKWz7rQ
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 4
EntryPoint: 0x95f1e
UninitializedDataSize: -
InitializedDataSize: 6656
CodeSize: 606208
LinkerVersion: 48
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2046:11:16 21:21:40+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Nov-2046 21:21:40
Debug artifacts:
  • C:\Users\User\Downloads\Compressed\Maltoolkit\Maltoolkit\Maltoolkit\obj\Debug\Maltoolkit.pdb
Comments: Made by malwareman https://www.youtube.com/channel/UCk8Gj-r2kQdCkleLtKWz7rQ
CompanyName: MALWAREMAN
FileDescription: Maltoolkit
FileVersion: 1.0.0.0
InternalName: Maltoolkit.exe
LegalCopyright: Copyright © MALWAREMAN
LegalTrademarks: -
OriginalFilename: Maltoolkit.exe
ProductName: Maltoolkit
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 16-Nov-2046 21:21:40
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x00093F24
0x00094000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.97834
.rsrc
0x00096000
0x0000173C
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.15768
.reloc
0x00098000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST
32512
1.91924
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
14
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start maltoolkit.exe no specs cmd.exe no specs iexpress.exe makecab.exe no specs taskmgr.exe no specs admingdi169.exe.exe cmd.exe no specs maltoolkit.exe maltoolkit.exe no specs iexplore.exe iexplore.exe admingdi169.exe.exe cmd.exe no specs maltoolkit.exe

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/channel/UCk8Gj-r2kQdCkleLtKWz7rQ?sub_confirmation=1C:\Program Files\Internet Explorer\iexplore.exe
Maltoolkit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
596cmd /c Maltoolkit.exe --shreadinggdipayloadremovesystemdll'stunnelgdipayloadcreateunlimitedsystemaccountsscreeninvertingpayloadpixelatedgdiglitchesmousefollowingpayloadinversegdipayload1000C:\Windows\System32\cmd.exe—adminGDI169.exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3762504530
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1432"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2384"C:\Users\admin\Desktop\adminGDI169.exe.exe" C:\Users\admin\Desktop\adminGDI169.exe.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\users\admin\desktop\admingdi169.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2448Maltoolkit.exe --shreadinggdipayloadremovesystemdll'stunnelgdipayloadcreateunlimitedsystemaccountsscreeninvertingpayloadpixelatedgdiglitchesmousefollowingpayloadinversegdipayload1000C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Maltoolkit.exe
cmd.exe
User:
admin
Company:
MALWAREMAN
Integrity Level:
MEDIUM
Description:
Maltoolkit
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\maltoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sspicli.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
2532"C:\Users\admin\Desktop\adminGDI169.exe.exe" C:\Users\admin\Desktop\adminGDI169.exe.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\users\admin\desktop\admingdi169.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2732"C:\Users\admin\Desktop\Maltoolkit.exe" C:\Users\admin\Desktop\Maltoolkit.exe—explorer.exe
User:
admin
Company:
MALWAREMAN
Integrity Level:
MEDIUM
Description:
Maltoolkit
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\maltoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2804Maltoolkit.exe --shreadinggdipayloadremovesystemdll'stunnelgdipayloadcreateunlimitedsystemaccountsscreeninvertingpayloadpixelatedgdiglitchesmousefollowingpayloadinversegdipayload1000C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Maltoolkit.exe
cmd.exe
User:
admin
Company:
MALWAREMAN
Integrity Level:
MEDIUM
Description:
Maltoolkit
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\maltoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2908cmd /c Maltoolkit.exe --shreadinggdipayloadremovesystemdll'stunnelgdipayloadcreateunlimitedsystemaccountsscreeninvertingpayloadpixelatedgdiglitchesmousefollowingpayloadinversegdipayload1000C:\Windows\System32\cmd.exe—adminGDI169.exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3762504530
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\apphelp.dll
2996"cmd.exe"C:\Windows\System32\cmd.exe—Maltoolkit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
15 411
Read events
15 344
Write events
67
Delete events
0

Modification events

(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
5
Suspicious files
9
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2732Maltoolkit.exeC:\Windows\Temp\data.tmptext
MD5:B871481EB1A9B7C41FC2BFB0D7AE527B
SHA256:25B1AD3FAA6CAE40F52B10CA23039C1F5CFC59268F859DAC518061047DFD00BE
3572makecab.exeC:\Users\admin\AppData\Local\Temp\cab_3572_5binary
MD5:29B1745E465A8BC3D4B8984B7FE0E36D
SHA256:891414EC318A8B972064CDD311E23036A7592326CBA452C91DB14F1E74F60618
3572makecab.exeC:\Users\admin\AppData\Local\Temp\inf_3572_3text
MD5:3CC7909DDDA0CAD2B92E51C82A913AE4
SHA256:44D7C1AAB0F4DC094D3F501E545372DA3107A4017DDA20CB359056E0A3D77C3D
3572makecab.exeC:\Users\admin\AppData\Local\Temp\inf_3572_4text
MD5:5D9466FC3F6A64D5CA6528EF13C9130F
SHA256:1FA0AF78417461F9E70E28694584A0ADBED143084CC5E08634E521CB2B878C21
3416iexpress.exeC:\Users\admin\Desktop\adminGDI169.exe.exeexecutable
MD5:6A92CEC8532056791C6832B2725D170D
SHA256:3D0E2C0CCFEEA27D4B7414B9DA0DE4707C2087134D3FF8AFE6FF59522A98E137
3416iexpress.exeC:\Users\admin\Desktop\RCXFA99.tmpexecutable
MD5:FFE7CA92A4D4CD9E7B6E63415DDD95F7
SHA256:A879E1865353F20691D320C6A31639800E057A6A4CEAB79363BC18E8410F8C25
2384adminGDI169.exe.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Maltoolkit.exeexecutable
MD5:D4163D85BA71A09B181DEA459744698C
SHA256:1FD51D6DD83F903B81C2FE5EE5811A32F4EEDDAE97B02C89659E6F0E7DA16B1E
2532adminGDI169.exe.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Maltoolkit.exeexecutable
MD5:D4163D85BA71A09B181DEA459744698C
SHA256:1FD51D6DD83F903B81C2FE5EE5811A32F4EEDDAE97B02C89659E6F0E7DA16B1E
2732Maltoolkit.exeC:\Users\admin\AppData\Local\Temp\optionfile.SEDbinary
MD5:24DCE8A55BA8CB3D98860EB155F0E3A8
SHA256:89DDDBADF2A3C8FD39B65C18F37ED32469BC4BC1D9D65A9818059BE2F011DE03
3572makecab.exeC:\Users\admin\Desktop\~adminGDI169.exe.CABcompressed
MD5:5571C9EADA20AF46F55358CDBE5879E3
SHA256:F5326A8A8A6ED85A71C5ADE82B75AD41D033DD07F8AA1BD1053359530CBD00BE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
23
DNS requests
14
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4206c1c789c60d12
US
xml
341 b
whitelisted
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4fc6619cbf5d2bbd
US
xml
341 b
whitelisted
3032
iexplore.exe
GET
404
67.27.235.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?12350f424d98b979
US
xml
341 b
whitelisted
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?adab7207e8c873ff
US
xml
341 b
whitelisted
3032
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?69473f7d56e03b6c
US
xml
341 b
whitelisted
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3cb40fb57f2ef7ff
US
xml
341 b
whitelisted
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0bd78179f2c13cfd
US
xml
341 b
whitelisted
1076
svchost.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a74158113368dad0
US
xml
341 b
whitelisted
1076
svchost.exe
GET
404
8.253.95.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6937215a1f99fe7a
US
xml
341 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
292
iexplore.exe
184.86.251.27:443
www.bing.com
Akamai International B.V.
DE
suspicious
292
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
568
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1076
svchost.exe
67.27.235.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3032
iexplore.exe
216.58.212.142:443
www.youtube.com
GOOGLE
US
whitelisted
292
iexplore.exe
23.212.215.152:443
go.microsoft.com
AKAMAI-AS
AU
suspicious
292
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
www.youtube.com
  • 216.58.212.142
  • 142.250.185.78
  • 142.250.185.110
  • 142.250.185.142
  • 142.250.185.174
  • 142.250.185.206
  • 142.250.185.238
  • 142.250.186.78
  • 142.250.186.110
  • 142.250.181.238
  • 142.250.184.206
  • 142.250.184.238
  • 142.250.186.142
  • 142.250.74.206
  • 142.250.186.46
  • 172.217.18.14
whitelisted
ctldl.windowsupdate.com
  • 67.27.235.126
  • 67.27.159.254
  • 8.248.131.254
  • 67.27.233.126
  • 8.241.122.126
  • 67.27.235.254
  • 67.27.157.254
  • 8.248.115.254
  • 8.248.137.254
  • 8.248.135.254
  • 8.253.95.120
  • 8.253.95.249
  • 8.253.204.121
  • 67.27.234.126
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 184.86.251.27
  • 184.86.251.19
  • 184.86.251.22
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 23.212.215.152
whitelisted

Threats

Found threats are available for the paid subscriptions
11 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Maltoolkit.exe