File name:

shaderblox.exe

Full analysis: https://app.any.run/tasks/220bf40d-e587-4c78-82f2-d779678eac26
Verdict: Malicious activity
Analysis date: November 15, 2024, 09:52:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

861ADC01C5013F1D864FD396844F357B

SHA1:

5868EFA057C721956652FC6FD4F5DAAA9F1B98A6

SHA256:

22D9589D957CE908A420CAB3F60A7B59DAA80F04B18D2F5D8BF6A994D251127B

SSDEEP:

786432:kUHxvVfDRqDp2711eJLxmGSJvBVgtJCIz5sjHcRRuD:txv1RqDp2711eJL0GI5atJCIVsjHcTuD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • shaderblox.exe (PID: 5788)
      • shaderbloxxx.exe (PID: 3964)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • shaderblox.exe (PID: 5788)

    • The process creates files with name similar to system file names

      • shaderblox.exe (PID: 5788)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 6436)

    • Drops 7-zip archiver for unpacking

      • shaderblox.exe (PID: 5788)

    • Get information on the list of running processes

      • shaderbloxxx.exe (PID: 3964)
      • cmd.exe (PID: 3728)
      • cmd.exe (PID: 6300)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 7140)

    • Process drops legitimate windows executable

      • shaderblox.exe (PID: 5788)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4232)
      • cmd.exe (PID: 5616)
      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 1048)

    • Application launched itself

      • shaderbloxxx.exe (PID: 3964)

    • Starts CMD.EXE for commands execution

      • shaderbloxxx.exe (PID: 3964)

    • Cryptography encrypted command line is found

      • cmd.exe (PID: 3004)
      • powershell.exe (PID: 7052)
      • cmd.exe (PID: 5584)
      • powershell.exe (PID: 2652)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3004)
      • cmd.exe (PID: 5584)

    • Checks for external IP

      • shaderbloxxx.exe (PID: 3964)

    • The executable file from the user directory is run by the CMD process

      • c.exe (PID: 4236)

    • Uses TASKKILL.EXE to kill Browsers

      • c.exe (PID: 4236)

  • INFO

    • Checks supported languages

      • shaderblox.exe (PID: 5788)

    • Application launched itself

      • msedge.exe (PID: 5832)
      • chrome.exe (PID: 7164)
      • chrome.exe (PID: 3568)
      • msedge.exe (PID: 1432)

    • Manual execution by a user

      • shaderbloxxx.exe (PID: 3964)
      • notepad.exe (PID: 624)
      • OpenWith.exe (PID: 1028)
      • notepad.exe (PID: 3580)
      • notepad.exe (PID: 2124)
      • notepad.exe (PID: 6740)

    • Reads the computer name

      • shaderblox.exe (PID: 5788)

    • Sends debugging messages

      • chrome.exe (PID: 7164)
      • chrome.exe (PID: 3568)
      • msedge.exe (PID: 1432)

    • Create files in a temporary directory

      • shaderblox.exe (PID: 5788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Unreal Game Inc.
FileDescription: HyperionChronicles is an immersive strategy game built with Unreal Engine, where players engage in tactical warfare and resource management.
FileVersion: 1.0.0
LegalCopyright: Copyright © 2024 Unreal Game Inc.
ProductName: shaderbloxxx
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
58
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start shaderblox.exe shaderbloxxx.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs shaderbloxxx.exe no specs shaderbloxxx.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs notepad.exe no specs cmd.exe no specs conhost.exe no specs c.exe no specs taskkill.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs openwith.exe no specs taskkill.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --mojo-platform-channel-handle=1448 --field-trial-handle=1444,i,7072226130349051096,10618792424284692301,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
624"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Passwords.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
860"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1464 --field-trial-handle=1408,i,5366068683723528642,4596195251599711612,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1008"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ffbc821dc40,0x7ffbc821dc4c,0x7ffbc821dc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1028"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\queue.sqlite3C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1048C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /IM "chrome.exe" /F"C:\Windows\System32\cmd.exe—shaderbloxxx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1432"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=DefaultC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1712tasklistC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2124"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Cards.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
17 155
Read events
17 130
Write events
25
Delete events
0

Modification events

(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Programs\shaderbloxxx
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:KeepShortcuts
Value:
true
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:ShortcutName
Value:
shaderbloxxx
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:DisplayName
Value:
shaderbloxxx 1.0.0
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\shaderbloxxx\Uninstall shaderbloxxx.exe" /currentuser
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\shaderbloxxx\Uninstall shaderbloxxx.exe" /currentuser /S
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:DisplayVersion
Value:
1.0.0
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Programs\shaderbloxxx\shaderbloxxx.exe,0
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:Publisher
Value:
Unreal Game Inc.
(PID) Process:(5788) shaderblox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\375acf32-c128-5b13-ace5-9823cf2bad6a
Operation:writeName:NoModify
Value:
1
Executable files
24
Suspicious files
137
Text files
56
Unknown types
5

Dropped files

PID
Process
Filename
Type
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\app-64.7z —
MD5:—
SHA256:—
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\StdUtils.dllexecutable
MD5:C6A6E03F77C313B267498515488C5740
SHA256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\nsExec.dllexecutable
MD5:EC0504E6B8A11D5AAD43B296BEEB84B2
SHA256:5D9CEB1CE5F35AEA5F9E5A0C0EDEEEC04DFEFE0C77890C80C70E98209B58B962
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\chrome_100_percent.pakpgc
MD5:8626E1D68E87F86C5B4DABDF66591913
SHA256:2CAA1DA9B6A6E87BDB673977FEE5DD771591A1B6ED5D3C5F14B024130A5D1A59
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\LICENSE.electron.txttext
MD5:4D42118D35941E0F664DDDBD83F633C5
SHA256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\locales\ar.pakpgc
MD5:FDBAD4C84AC66EE78A5C8DD16D259C43
SHA256:A62B848A002474A8EA37891E148CBAF4AF09BDBA7DAFEBDC0770C9A9651F7E3B
5788shaderblox.exeC:\Users\admin\AppData\Local\Temp\nsb15B0.tmp\7z-out\locales\am.pakpgc
MD5:2C933F084D960F8094E24BEE73FA826C
SHA256:FA1E44215BD5ACC7342C431A3B1FDDB6E8B6B02220B4599167F7D77A29F54450
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
47
DNS requests
24
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.16.164.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1880
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6772
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6772
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
2.16.164.122:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6944
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
2.23.209.180:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1880
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1880
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.122
  • 2.16.164.89
  • 2.16.164.18
  • 2.16.164.99
  • 2.16.164.40
  • 2.16.164.51
  • 2.16.164.114
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.218.209.163
whitelisted
www.bing.com
  • 2.23.209.180
  • 2.23.209.173
  • 2.23.209.162
  • 2.23.209.175
  • 2.23.209.179
  • 2.23.209.181
  • 2.23.209.171
  • 2.23.209.177
  • 2.23.209.166
whitelisted
google.com
  • 142.250.186.46
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.71
whitelisted
th.bing.com
  • 2.23.209.135
  • 2.23.209.137
  • 2.23.209.133
  • 2.23.209.132
  • 2.23.209.141
  • 2.23.209.131
  • 2.23.209.143
  • 2.23.209.142
  • 2.23.209.140
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
3964
shaderbloxxx.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Google\Chrome\User Data directory exists )
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Google\Chrome\User Data directory exists )
msedge.exe
[1115/095420.117:ERROR:tcp_socket_win.cc(382)] bind() returned an error: Only one usage of each socket address (protocol/network address/port) is normally permitted. (0x2740)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
shaderblox.exe