File name:

hddregtectecbr.rar

Full analysis: https://app.any.run/tasks/f70eeb2d-561d-4612-b2d6-7b1aeec67e27
Verdict: Malicious activity
Analysis date: March 24, 2025, 01:02:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
delphi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

DFF04004F3DF606B307F49F190A12890

SHA1:

0253E4736F53921581F19CA828BEDF921B18FBFC

SHA256:

212F9E268EAC298460769A6A27546F4894B5A871251FC468859F70D8339FA751

SSDEEP:

98304:vg6zJBvuaM4Pk8XNtVHTiJVfiAaMJtK7hRvOSDrftYNWqiIiiBLUqYROnh6yyg02:b6eKjpxhukbYEo74NJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • HDD Regenerator 1.71.exe (PID: 1052)
      • HDD Regenerator 1.71.exe (PID: 6268)
      • HDD Regenerator.exe (PID: 6964)
      • HDD Regenerator.exe (PID: 5956)
      • HDD Regenerator.exe (PID: 4152)
      • HDD Regenerator.exe (PID: 6256)
      • HDD Regenerator.exe (PID: 5556)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6488)
      • ShellExperienceHost.exe (PID: 3304)
      • msiexec.exe (PID: 2152)
      • HDD Regenerator.exe (PID: 5956)
      • HDD Regenerator.exe (PID: 5556)

    • Adds/modifies Windows certificates

      • msiexec.exe (PID: 5304)

    • There is functionality for taking screenshot (YARA)

      • HDD Regenerator 1.71.exe (PID: 6268)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3176)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 1388)

    • Creates/Modifies COM task schedule object

      • HDD Regenerator.exe (PID: 5956)
      • msiexec.exe (PID: 1388)

    • Application launched itself

      • HDD Regenerator.exe (PID: 6964)
      • HDD Regenerator.exe (PID: 6256)
      • hddreg.exe (PID: 2140)

    • Reads the BIOS version

      • HDD Regenerator.exe (PID: 5956)
      • HDD Regenerator.exe (PID: 5556)
      • hddreg.exe (PID: 1300)

    • Detected use of alternative data streams (AltDS)

      • HDD Regenerator.exe (PID: 5956)
      • HDD Regenerator.exe (PID: 5556)
      • hddreg.exe (PID: 1300)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 6488)

    • Reads Internet Explorer settings

      • HDD Regenerator.exe (PID: 5556)

    • Reads Microsoft Outlook installation path

      • HDD Regenerator.exe (PID: 5556)

  • INFO

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 5256)
      • msiexec.exe (PID: 5304)
      • slui.exe (PID: 4244)
      • HDD Regenerator.exe (PID: 5956)
      • HDD Regenerator.exe (PID: 5556)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 5256)
      • HDD Regenerator 1.71.exe (PID: 6268)
      • msiexec.exe (PID: 5304)
      • HDD Regenerator.exe (PID: 5556)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 5256)
      • msiexec.exe (PID: 5304)
      • slui.exe (PID: 2136)
      • msiexec.exe (PID: 1388)
      • slui.exe (PID: 4244)
      • HDD Regenerator.exe (PID: 5556)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 208)
      • BackgroundTransferHost.exe (PID: 1600)
      • BackgroundTransferHost.exe (PID: 1852)
      • BackgroundTransferHost.exe (PID: 5256)
      • BackgroundTransferHost.exe (PID: 5756)
      • msiexec.exe (PID: 5304)
      • notepad.exe (PID: 5304)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6488)
      • msiexec.exe (PID: 5304)
      • msiexec.exe (PID: 1388)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6488)
      • msiexec.exe (PID: 5304)
      • msiexec.exe (PID: 1388)

    • Checks supported languages

      • HDD Regenerator 1.71.exe (PID: 6268)
      • msiexec.exe (PID: 1388)
      • msiexec.exe (PID: 2152)
      • ShellExperienceHost.exe (PID: 3304)
      • HDD Regenerator.exe (PID: 6964)
      • HDD Regenerator.exe (PID: 5956)
      • HDD Regenerator.exe (PID: 6256)
      • HDD Regenerator.exe (PID: 5556)
      • hddreg.exe (PID: 2140)
      • hddreg.exe (PID: 1300)

    • Reads the computer name

      • HDD Regenerator 1.71.exe (PID: 6268)
      • msiexec.exe (PID: 1388)
      • msiexec.exe (PID: 2152)
      • ShellExperienceHost.exe (PID: 3304)
      • HDD Regenerator.exe (PID: 5956)
      • HDD Regenerator.exe (PID: 5556)
      • hddreg.exe (PID: 1300)

    • Create files in a temporary directory

      • HDD Regenerator 1.71.exe (PID: 6268)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 1388)
      • HDD Regenerator.exe (PID: 5556)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1388)

    • Process checks computer location settings

      • msiexec.exe (PID: 2152)

    • Compiled with Borland Delphi (YARA)

      • slui.exe (PID: 4244)

    • Creates files in the program directory

      • HDD Regenerator.exe (PID: 5956)
      • HDD Regenerator.exe (PID: 5556)
      • hddreg.exe (PID: 1300)

    • Manages system restore points

      • SrTasks.exe (PID: 4304)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6488)

    • Manual execution by a user

      • HDD Regenerator.exe (PID: 4152)
      • HDD Regenerator.exe (PID: 6256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
27
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs hdd regenerator 1.71.exe no specs hdd regenerator 1.71.exe msiexec.exe msiexec.exe msiexec.exe no specs shellexperiencehost.exe no specs vssvc.exe no specs slui.exe srtasks.exe no specs conhost.exe no specs hdd regenerator.exe no specs hdd regenerator.exe no specs notepad.exe no specs hdd regenerator.exe no specs hdd regenerator.exe hdd regenerator.exe hddreg.exe no specs conhost.exe no specs hddreg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1052"C:\Users\admin\AppData\Local\Temp\Rar$EXb6488.49076\hddregtectecbr\HDD Regenerator for windows\HDD Regenerator 1.71.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb6488.49076\hddregtectecbr\HDD Regenerator for windows\HDD Regenerator 1.71.exe—WinRAR.exe
User:
admin
Company:
Abstradrome
Integrity Level:
MEDIUM
Description:
Setup Launcher Unicode
Exit code:
3221226540
Version:
1.71.0012
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb6488.49076\hddregtectecbr\hdd regenerator for windows\hdd regenerator 1.71.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1300hddreg 0 49 49 75 124C:\Program Files (x86)\HDD Regenerator\hddreg.exe—hddreg.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\program files (x86)\hdd regenerator\hddreg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1388C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1600"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1852"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2136"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2140hddreg 0 49 49 75 124C:\Program Files (x86)\HDD Regenerator\hddreg.exe—HDD Regenerator.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\program files (x86)\hdd regenerator\hddreg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2152C:\Windows\syswow64\MsiExec.exe -Embedding 82C50FBD25A29F8ADCF1C08A3F200F17 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3176C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
21 184
Read events
20 826
Write events
337
Delete events
21

Modification events

(PID) Process:(1600) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1600) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1600) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(208) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(208) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(208) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5256) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5256) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5256) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5756) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
18
Suspicious files
45
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
5256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D —
MD5:—
SHA256:—
5256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2bef3c6b-ed3f-4855-99a6-af24cfab4733.down_data —
MD5:—
SHA256:—
6268HDD Regenerator 1.71.exeC:\Users\admin\AppData\Local\Temp\_is5545.tmp —
MD5:—
SHA256:—
6268HDD Regenerator 1.71.exeC:\Users\admin\AppData\Local\Temp\{039F881B-E804-40F1-B8FF-8D4EF83F5253}\HDD Regenerator.msi —
MD5:—
SHA256:—
6268HDD Regenerator 1.71.exeC:\Users\admin\AppData\Local\Downloaded Installations\{228F06BD-CBEE-4656-AC2A-CB927745EDED}\HDD Regenerator.msi —
MD5:—
SHA256:—
6488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6488.49076\hddregtectecbr\HDD Regenerator for windows\Serial.txttext
MD5:0FF0768F5B6F44490B3892B5C9727FE6
SHA256:EACD99CF9FF10354F2B15E63B926D7FF9B16F4710201518B1BFBE41FF75067EC
5256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:EBF599BFCEA18E13BA1DE58844A46003
SHA256:3707F217C369D8DEAA95E1715CC8C3A3D951BC18323F5B8DCB98672327B0502B
6488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6488.49076\hddregtectecbr\HDD Regenerator for windows\HDD Regenerator 1.71.exeexecutable
MD5:BA116275C603F05D0ADD900558DBA381
SHA256:FD56814BDBC6C71753A41728ADEB095F8109657614D31ABBBBED138538A95FF7
5256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5e0b3f16-e8e5-4329-a7d5-5a224956a9a6.aa3cf0e7-6052-4a30-8384-40791214e36b.down_metabinary
MD5:52F6609F315C1CF2E9B40272BA32ABE9
SHA256:7DF4ACFA08A3C4254B249292D45F0D6F8AE08D83A1681B4371C3F2A1CB72442A
1388msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
45
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5256
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4724
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4244
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5304
msiexec.exe
GET
200
184.30.131.114:80
http://crl.verisign.com/pca3.crl
unknown
—
—
whitelisted
5304
msiexec.exe
GET
200
184.30.131.114:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCEBEQMhPZ4tSh0avCknEynU0%3D
unknown
—
—
whitelisted
4244
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5304
msiexec.exe
GET
200
184.30.131.114:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCEBEQMhPZ4tSh0avCknEynU0%3D
unknown
—
—
whitelisted
1388
msiexec.exe
GET
200
184.30.131.114:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCEBEQMhPZ4tSh0avCknEynU0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4724
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4724
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.131
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.20
  • 40.126.32.76
  • 20.190.160.67
  • 40.126.32.74
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hddregtectecbr.rar