File name:

shaderblox.exe

Full analysis: https://app.any.run/tasks/220bf40d-e587-4c78-82f2-d779678eac26
Verdict: Malicious activity
Analysis date: November 15, 2024, 09:52:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

861ADC01C5013F1D864FD396844F357B

SHA1:

5868EFA057C721956652FC6FD4F5DAAA9F1B98A6

SHA256:

22D9589D957CE908A420CAB3F60A7B59DAA80F04B18D2F5D8BF6A994D251127B

SSDEEP:

786432:kUHxvVfDRqDp2711eJLxmGSJvBVgtJCIz5sjHcRRuD:txv1RqDp2711eJL0GI5atJCIVsjHcTuD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • shaderblox.exe (PID: 5788)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • shaderblox.exe (PID: 5788)

    • Process drops legitimate windows executable

      • shaderblox.exe (PID: 5788)

    • Drops 7-zip archiver for unpacking

      • shaderblox.exe (PID: 5788)

    • Executable content was dropped or overwritten

      • shaderblox.exe (PID: 5788)
      • shaderbloxxx.exe (PID: 3964)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 6436)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 7140)

    • Get information on the list of running processes

      • shaderbloxxx.exe (PID: 3964)
      • cmd.exe (PID: 3728)
      • cmd.exe (PID: 6300)

    • Application launched itself

      • shaderbloxxx.exe (PID: 3964)

    • Starts CMD.EXE for commands execution

      • shaderbloxxx.exe (PID: 3964)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4232)
      • cmd.exe (PID: 5616)
      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 1048)

    • Cryptography encrypted command line is found

      • cmd.exe (PID: 3004)
      • powershell.exe (PID: 7052)
      • powershell.exe (PID: 2652)
      • cmd.exe (PID: 5584)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3004)
      • cmd.exe (PID: 5584)

    • Checks for external IP

      • shaderbloxxx.exe (PID: 3964)

    • Uses TASKKILL.EXE to kill Browsers

      • c.exe (PID: 4236)

    • The executable file from the user directory is run by the CMD process

      • c.exe (PID: 4236)

  • INFO

    • Checks supported languages

      • shaderblox.exe (PID: 5788)

    • Reads the computer name

      • shaderblox.exe (PID: 5788)

    • Manual execution by a user

      • shaderbloxxx.exe (PID: 3964)
      • notepad.exe (PID: 624)
      • notepad.exe (PID: 3580)
      • notepad.exe (PID: 6740)
      • notepad.exe (PID: 2124)
      • OpenWith.exe (PID: 1028)

    • Application launched itself

      • msedge.exe (PID: 5832)
      • chrome.exe (PID: 7164)
      • chrome.exe (PID: 3568)
      • msedge.exe (PID: 1432)

    • Sends debugging messages

      • chrome.exe (PID: 7164)
      • chrome.exe (PID: 3568)
      • msedge.exe (PID: 1432)

    • Create files in a temporary directory

      • shaderblox.exe (PID: 5788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Unreal Game Inc.
FileDescription: HyperionChronicles is an immersive strategy game built with Unreal Engine, where players engage in tactical warfare and resource management.
FileVersion: 1.0.0
LegalCopyright: Copyright © 2024 Unreal Game Inc.
ProductName: shaderbloxxx
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
58
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start shaderblox.exe shaderbloxxx.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs shaderbloxxx.exe no specs shaderbloxxx.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs notepad.exe no specs cmd.exe no specs conhost.exe no specs c.exe no specs taskkill.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs openwith.exe no specs taskkill.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --mojo-platform-channel-handle=1448 --field-trial-handle=1444,i,7072226130349051096,10618792424284692301,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
624"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Passwords.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
860"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1464 --field-trial-handle=1408,i,5366068683723528642,4596195251599711612,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1008"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ffbc821dc40,0x7ffbc821dc4c,0x7ffbc821dc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1028"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\queue.sqlite3C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1048C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /IM "chrome.exe" /F"C:\Windows\System32\cmd.exe—shaderbloxxx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1432"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=DefaultC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1712tasklistC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2124"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Cards.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
17 155
Read events
17 130
Write events
25
Delete events
0

Modification events

(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Programs\shaderbloxxx
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:KeepShortcuts
Value:
true
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:ShortcutName
Value:
shaderbloxxx
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:DisplayName
Value:
shaderbloxxx 1.0.0
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\shaderbloxxx\Uninstall shaderbloxxx.exe" /currentuser
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\shaderbloxxx\Uninstall shaderbloxxx.exe" /currentuser /S
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:DisplayVersion
Value:
1.0.0
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Programs\shaderbloxxx\shaderbloxxx.exe,0
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:Publisher
Value:
Unreal Game Inc.
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:NoModify
Value:
1
Executable files
24
Suspicious files
137
Text files
56
Unknown types
5

Dropped files

PID
Process
Filename
Type
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\app-64.7z —
MD5:—
SHA256:—
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\StdUtils.dllexecutable
MD5:C6A6E03F77C313B267498515488C5740
SHA256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\locales\cs.pakpgc
MD5:EEEE212072EA6589660C9EB216855318
SHA256:DE92F14480770401E39E22DCF3DD36DE5AD3ED22E44584C31C37CD99E71C4A43
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\chrome_200_percent.pakbinary
MD5:48515D600258D60019C6B9C6421F79F6
SHA256:07BEE34E189FE9A8789AED78EA59AD41414B6E611E7D74DA62F8E6CA36AF01CE
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\nsis7z.dllexecutable
MD5:80E44CE4895304C6A3A831310FBF8CD0
SHA256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\nsExec.dllexecutable
MD5:EC0504E6B8A11D5AAD43B296BEEB84B2
SHA256:5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\locales\de.pakpgc
MD5:CF22EC11A33BE744A61F7DE1A1E4514F
SHA256:7CC213E2C9A2D2E2E463083DD030B86DA6BBA545D5CEE4C04DF8F80F9A01A641
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
47
DNS requests
24
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.16.164.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1880
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6772
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6772
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
2.16.164.122:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6944
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
2.23.209.180:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1880
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1880
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.122
  • 2.16.164.89
  • 2.16.164.18
  • 2.16.164.99
  • 2.16.164.40
  • 2.16.164.51
  • 2.16.164.114
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.218.209.163
whitelisted
www.bing.com
  • 2.23.209.180
  • 2.23.209.173
  • 2.23.209.162
  • 2.23.209.175
  • 2.23.209.179
  • 2.23.209.181
  • 2.23.209.171
  • 2.23.209.177
  • 2.23.209.166
whitelisted
google.com
  • 142.250.186.46
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.71
whitelisted
th.bing.com
  • 2.23.209.135
  • 2.23.209.137
  • 2.23.209.133
  • 2.23.209.132
  • 2.23.209.141
  • 2.23.209.131
  • 2.23.209.143
  • 2.23.209.142
  • 2.23.209.140
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
3964
shaderbloxxx.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Google\Chrome\User Data directory exists )
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Google\Chrome\User Data directory exists )
msedge.exe
[1115/095420.117:ERROR:tcp_socket_win.cc(382)] bind() returned an error: Only one usage of each socket address (protocol/network address/port) is normally permitted. (0x2740)
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
shaderblox.exe