File name:

Maltoolkit.exe

Full analysis: https://app.any.run/tasks/4253e374-0bda-4f99-9a06-28a69c99135e
Verdict: Malicious activity
Analysis date: June 17, 2023, 20:46:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D4163D85BA71A09B181DEA459744698C

SHA1:

002EFBDAF3B87A486CD1B577B219A36995A66489

SHA256:

1FD51D6DD83F903B81C2FE5EE5811A32F4EEDDAE97B02C89659E6F0E7DA16B1E

SSDEEP:

12288:FkJiiL9fPbGXY3ZuTmlOIq76xb35zdtKTKKpKKM:Fk0iL97ngEMWx35

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • adminGDI169.exe.exe (PID: 2532)
      • adminGDI169.exe.exe (PID: 2384)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Maltoolkit.exe (PID: 2732)
      • adminGDI169.exe.exe (PID: 2532)
      • adminGDI169.exe.exe (PID: 2384)

    • Executable content was dropped or overwritten

      • iexpress.exe (PID: 3416)
      • adminGDI169.exe.exe (PID: 2532)
      • adminGDI169.exe.exe (PID: 2384)

    • Reads the Internet Settings

      • Maltoolkit.exe (PID: 3824)

  • INFO

    • Reads the computer name

      • Maltoolkit.exe (PID: 2732)
      • Maltoolkit.exe (PID: 2804)
      • Maltoolkit.exe (PID: 3824)
      • Maltoolkit.exe (PID: 2448)

    • Checks supported languages

      • Maltoolkit.exe (PID: 2732)
      • adminGDI169.exe.exe (PID: 2532)
      • Maltoolkit.exe (PID: 2804)
      • adminGDI169.exe.exe (PID: 2384)
      • Maltoolkit.exe (PID: 2448)
      • Maltoolkit.exe (PID: 3824)

    • Reads the machine GUID from the registry

      • Maltoolkit.exe (PID: 2732)
      • Maltoolkit.exe (PID: 2804)
      • Maltoolkit.exe (PID: 2448)
      • Maltoolkit.exe (PID: 3824)

    • The process checks LSA protection

      • Maltoolkit.exe (PID: 2732)
      • Maltoolkit.exe (PID: 2804)
      • Maltoolkit.exe (PID: 3824)
      • Maltoolkit.exe (PID: 2448)

    • Create files in a temporary directory

      • makecab.exe (PID: 3572)
      • Maltoolkit.exe (PID: 2732)
      • adminGDI169.exe.exe (PID: 2532)
      • adminGDI169.exe.exe (PID: 2384)

    • Manual execution by a user

      • adminGDI169.exe.exe (PID: 2532)
      • taskmgr.exe (PID: 1432)
      • Maltoolkit.exe (PID: 3824)
      • adminGDI169.exe.exe (PID: 2384)

    • The executable file from the user directory is run by the CMD process

      • Maltoolkit.exe (PID: 2804)
      • Maltoolkit.exe (PID: 2448)

    • Application launched itself

      • iexplore.exe (PID: 292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

AssemblyVersion: 1.0.0.0
ProductVersion: 1.0.0.0
ProductName: Maltoolkit
OriginalFileName: Maltoolkit.exe
LegalTrademarks: -
LegalCopyright: Copyright © MALWAREMAN
InternalName: Maltoolkit.exe
FileVersion: 1.0.0.0
FileDescription: Maltoolkit
CompanyName: MALWAREMAN
Comments: Made by malwareman https://www.youtube.com/channel/UCk8Gj-r2kQdCkleLtKWz7rQ
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 4
EntryPoint: 0x95f1e
UninitializedDataSize: -
InitializedDataSize: 6656
CodeSize: 606208
LinkerVersion: 48
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2046:11:16 21:21:40+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Nov-2046 21:21:40
Debug artifacts:
  • C:\Users\User\Downloads\Compressed\Maltoolkit\Maltoolkit\Maltoolkit\obj\Debug\Maltoolkit.pdb
Comments: Made by malwareman https://www.youtube.com/channel/UCk8Gj-r2kQdCkleLtKWz7rQ
CompanyName: MALWAREMAN
FileDescription: Maltoolkit
FileVersion: 1.0.0.0
InternalName: Maltoolkit.exe
LegalCopyright: Copyright © MALWAREMAN
LegalTrademarks: -
OriginalFilename: Maltoolkit.exe
ProductName: Maltoolkit
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 16-Nov-2046 21:21:40
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x00093F24
0x00094000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.97834
.rsrc
0x00096000
0x0000173C
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.15768
.reloc
0x00098000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST
32512
1.91924
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
14
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start maltoolkit.exe no specs cmd.exe no specs iexpress.exe makecab.exe no specs taskmgr.exe no specs admingdi169.exe.exe cmd.exe no specs maltoolkit.exe maltoolkit.exe no specs iexplore.exe iexplore.exe admingdi169.exe.exe cmd.exe no specs maltoolkit.exe

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/channel/UCk8Gj-r2kQdCkleLtKWz7rQ?sub_confirmation=1C:\Program Files\Internet Explorer\iexplore.exe
Maltoolkit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
596cmd /c Maltoolkit.exe --shreadinggdipayloadremovesystemdll'stunnelgdipayloadcreateunlimitedsystemaccountsscreeninvertingpayloadpixelatedgdiglitchesmousefollowingpayloadinversegdipayload1000C:\Windows\System32\cmd.exe—adminGDI169.exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3762504530
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1432"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2384"C:\Users\admin\Desktop\adminGDI169.exe.exe" C:\Users\admin\Desktop\adminGDI169.exe.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\users\admin\desktop\admingdi169.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2448Maltoolkit.exe --shreadinggdipayloadremovesystemdll'stunnelgdipayloadcreateunlimitedsystemaccountsscreeninvertingpayloadpixelatedgdiglitchesmousefollowingpayloadinversegdipayload1000C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Maltoolkit.exe
cmd.exe
User:
admin
Company:
MALWAREMAN
Integrity Level:
MEDIUM
Description:
Maltoolkit
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\maltoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sspicli.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
2532"C:\Users\admin\Desktop\adminGDI169.exe.exe" C:\Users\admin\Desktop\adminGDI169.exe.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\users\admin\desktop\admingdi169.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2732"C:\Users\admin\Desktop\Maltoolkit.exe" C:\Users\admin\Desktop\Maltoolkit.exe—explorer.exe
User:
admin
Company:
MALWAREMAN
Integrity Level:
MEDIUM
Description:
Maltoolkit
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\maltoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2804Maltoolkit.exe --shreadinggdipayloadremovesystemdll'stunnelgdipayloadcreateunlimitedsystemaccountsscreeninvertingpayloadpixelatedgdiglitchesmousefollowingpayloadinversegdipayload1000C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Maltoolkit.exe
cmd.exe
User:
admin
Company:
MALWAREMAN
Integrity Level:
MEDIUM
Description:
Maltoolkit
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\maltoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2908cmd /c Maltoolkit.exe --shreadinggdipayloadremovesystemdll'stunnelgdipayloadcreateunlimitedsystemaccountsscreeninvertingpayloadpixelatedgdiglitchesmousefollowingpayloadinversegdipayload1000C:\Windows\System32\cmd.exe—adminGDI169.exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3762504530
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\apphelp.dll
2996"cmd.exe"C:\Windows\System32\cmd.exe—Maltoolkit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
15 411
Read events
15 344
Write events
67
Delete events
0

Modification events

(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
5
Suspicious files
9
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3572makecab.exeC:\Users\admin\AppData\Local\Temp\cab_3572_6binary
MD5:DDA1C310C86AC5428D44130A96E53BCA
SHA256:FB0E2BC7F199515BA130C707693D8C2570554076C3F0D844AFA6C66539836D03
3572makecab.exeC:\Users\admin\Desktop\~adminGDI169.exe.RPTtext
MD5:064918A3B937E6F31BFDD4A50480D88D
SHA256:804732606E6A0777CB4E002881854AFEF431EC5B4CEF6F28062454FCDD772735
3572makecab.exeC:\Users\admin\AppData\Local\Temp\inf_3572_4text
MD5:5D9466FC3F6A64D5CA6528EF13C9130F
SHA256:1FA0AF78417461F9E70E28694584A0ADBED143084CC5E08634E521CB2B878C21
3572makecab.exeC:\Users\admin\AppData\Local\Temp\cab_3572_8binary
MD5:DDA1C310C86AC5428D44130A96E53BCA
SHA256:FB0E2BC7F199515BA130C707693D8C2570554076C3F0D844AFA6C66539836D03
3572makecab.exeC:\Users\admin\Desktop\~adminGDI169.exe_LAYOUT.INFbinary
MD5:8BE34D8A9C6870F8D33EF67ACE6A1A00
SHA256:58C4485BE1AAE5A0F5F16FAF98DAE4520E576D73E04C35A557B78077AECCEFFA
3416iexpress.exeC:\Users\admin\Desktop\~adminGDI169.exe.DDFbinary
MD5:E47F3A2CC48ECA297B04DB3474F3BC0C
SHA256:C3E817B746CF0BDD516945A96C8BBB8B4C993F125FF30A74B1BECB18AFB1B4EA
3572makecab.exeC:\Users\admin\AppData\Local\Temp\cab_3572_7binary
MD5:F99F4932E2CA7EF3A0AC7F40F1C5E71D
SHA256:E93C2AE196EAE3E4C4E01D9411A4A6ED2DBC10F7DC1F6E800DAD5422A571840C
3572makecab.exeC:\Users\admin\AppData\Local\Temp\cab_3572_5binary
MD5:29B1745E465A8BC3D4B8984B7FE0E36D
SHA256:891414EC318A8B972064CDD311E23036A7592326CBA452C91DB14F1E74F60618
2732Maltoolkit.exeC:\Users\admin\AppData\Local\Temp\optionfile.SEDbinary
MD5:24DCE8A55BA8CB3D98860EB155F0E3A8
SHA256:89DDDBADF2A3C8FD39B65C18F37ED32469BC4BC1D9D65A9818059BE2F011DE03
3572makecab.exeC:\Users\admin\Desktop\~adminGDI169.exe.CABcompressed
MD5:5571C9EADA20AF46F55358CDBE5879E3
SHA256:F5326A8A8A6ED85A71C5ADE82B75AD41D033DD07F8AA1BD1053359530CBD00BE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
23
DNS requests
14
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3032
iexplore.exe
GET
404
67.27.235.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?12350f424d98b979
US
xml
341 b
whitelisted
1076
svchost.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a74158113368dad0
US
xml
341 b
whitelisted
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3cb40fb57f2ef7ff
US
xml
341 b
whitelisted
1076
svchost.exe
GET
404
8.253.95.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6937215a1f99fe7a
US
xml
341 b
whitelisted
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0bd78179f2c13cfd
US
xml
341 b
whitelisted
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4fc6619cbf5d2bbd
US
xml
341 b
whitelisted
3032
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?69473f7d56e03b6c
US
xml
341 b
whitelisted
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4206c1c789c60d12
US
xml
341 b
whitelisted
292
iexplore.exe
GET
404
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?adab7207e8c873ff
US
xml
341 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
568
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3032
iexplore.exe
216.58.212.142:443
www.youtube.com
GOOGLE
US
whitelisted
3032
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
292
iexplore.exe
184.86.251.27:443
www.bing.com
Akamai International B.V.
DE
suspicious
292
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
292
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3032
iexplore.exe
67.27.235.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious

DNS requests

Domain
IP
Reputation
www.youtube.com
  • 216.58.212.142
  • 142.250.185.78
  • 142.250.185.110
  • 142.250.185.142
  • 142.250.185.174
  • 142.250.185.206
  • 142.250.185.238
  • 142.250.186.78
  • 142.250.186.110
  • 142.250.181.238
  • 142.250.184.206
  • 142.250.184.238
  • 142.250.186.142
  • 142.250.74.206
  • 142.250.186.46
  • 172.217.18.14
whitelisted
ctldl.windowsupdate.com
  • 67.27.235.126
  • 67.27.159.254
  • 8.248.131.254
  • 67.27.233.126
  • 8.241.122.126
  • 67.27.235.254
  • 67.27.157.254
  • 8.248.115.254
  • 8.248.137.254
  • 8.248.135.254
  • 8.253.95.120
  • 8.253.95.249
  • 8.253.204.121
  • 67.27.234.126
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 184.86.251.27
  • 184.86.251.19
  • 184.86.251.22
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 23.212.215.152
whitelisted

Threats

Found threats are available for the paid subscriptions
11 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Maltoolkit.exe