File name:

Backdoor.exe

Full analysis: https://app.any.run/tasks/cb9e52b5-0539-43d3-9786-5450106380e8
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: August 04, 2024, 16:48:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
remcos
rat
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
MD5:

86827E82DD183CCDE7F048EDD5A3EABD

SHA1:

7CF0CE6EA5413AD210F94A5B5A2785E6C3C4D600

SHA256:

279138C9FFCC8CF25E7A51180BEDDF98AF939B1FD5290F14D1F2894C9C9E94F1

SSDEEP:

768:bFa2klu2GgzTBedNcIiLe5cwfRC3yMaJU5tfj/AXUIzk+fnG:xXvCz1OcheVf7VUfknk+PG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Backdoor.exe (PID: 6564)

    • REMCOS has been detected

      • Backdoor.exe (PID: 6564)

    • REMCOS has been detected (YARA)

      • Backdoor.exe (PID: 6564)

  • SUSPICIOUS

    • Executes application which crashes

      • Backdoor.exe (PID: 6564)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 7160)

    • Connects to unusual port

      • Backdoor.exe (PID: 6564)

  • INFO

    • Creates files or folders in the user directory

      • Backdoor.exe (PID: 6564)
      • WerFault.exe (PID: 4344)

    • Reads the computer name

      • Backdoor.exe (PID: 6564)
      • ShellExperienceHost.exe (PID: 7160)

    • Reads Environment values

      • Backdoor.exe (PID: 6564)

    • Checks supported languages

      • Backdoor.exe (PID: 6564)
      • ShellExperienceHost.exe (PID: 7160)

    • Failed to create an executable file in Windows directory

      • Backdoor.exe (PID: 6564)

    • Checks proxy server information

      • WerFault.exe (PID: 4344)

    • Reads the software policy settings

      • WerFault.exe (PID: 4344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(6564) Backdoor.exe
ERROR
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:01:05 19:50:13+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 61440
InitializedDataSize: 28672
UninitializedDataSize: -
EntryPoint: 0x172ec
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #REMCOS backdoor.exe conhost.exe no specs shellexperiencehost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
4344C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6564 -s 1332C:\Windows\SysWOW64\WerFault.exe
Backdoor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6564"C:\Users\admin\AppData\Local\Temp\Backdoor.exe" C:\Users\admin\AppData\Local\Temp\Backdoor.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\backdoor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(6564) Backdoor.exe
ERROR
6592\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Backdoor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7160"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
Total events
7 216
Read events
7 209
Write events
7
Delete events
0

Modification events

(PID) Process:(6564) Backdoor.exeKey:HKEY_CURRENT_USER\SOFTWARE\remcos_mchoegueyhpfxrx
Operation:writeName:EXEpath
Value:
•ÝB&‡GÌôE Ð-áG.ؙ̙ÃeÌN¼ nùØt¦SÛÒ=ê,BM…~ï
(PID) Process:(7160) ShellExperienceHost.exeKey:\REGISTRY\A\{952eca19-c95c-38f2-bf64-e55a27f5965b}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D0000002C3BF02A8EE6DA01
(PID) Process:(4344) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
Operation:writeName:00180010F429971D
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000042CB6C300049C042863C8A748EF9A2B200000000020000000000106600000001000020000000258712765CF635BE0DD6B97E329049208A8E7FBC686DF1CBA15672F648ACA2A4000000000E80000000020000200000007B4BC16B982838E15AAA3EC77E33A9C1DA20F067EC06F01E17826EC22B9BDC2D800000003E85DC396BFEDF522D0608D56F5729BF6FCF73B97D521273B6AD5462745151B2F1ABA44986C792A1223A22CC0DCE881600E47CFA460EBE33CA78E37CF51001B2F6B45B01F77069A5215A71AC86B237280FE88C7C1049C8B3EF01A913E9B15CECFC97A13A56FAA12E22E9EF32BB26476498C98C13D7A2ED8D361793AC03C861E3400000005947052DD5B3128870FA2B97F17F4DAC1F1D205121F27D02AE26E57782607B098E3F6F7EA828AA0599D73133D93D5FD3608CD88D1182A85CBE4EB2FC44D2898B
(PID) Process:(4344) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:DeviceTicket
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000042CB6C300049C042863C8A748EF9A2B200000000020000000000106600000001000020000000B590D653DA142DAAE9F5F2669ABF3AD66B4FF6E2B28E5704DAB4E7373BA0B2AC000000000E8000000002000020000000D65DAFE8DAE6A8E4646EBBAA8C96C7EC32BC6708B462C887560A34938AB5903A50080000441BA8DDAAE40F31FBB2ED03CE156EC49FE1820ABE1AF753EB138DB7FA6A0730B644A7B39F9AC4B29AEFE5AB483DCA844D7036E2DDB07BFB4EA57EFAAD306300577464C88BB3BAE5EDA7D16C00BE942B33ADBC19C0A1122424C475E5E78678555CDD062A6C6B0DE3BE00B5845572CA203C87FE29E7038750D6F4786097E71B54E86A2BFF2BA4408A335DCA4DD29045B41226234FE26C3B006C307D46F4D707F07633C384F42C3EB957C46762B1A095C07B0F89104D6C140AB93EB86FBA520B7B5620665A8C5D758C3FB4091690F00C4A877E0DB6F4CEE8DCCE1530471DFFA9102F3A7DFBE6C87294BBE0385F81E3FD1C1E8DF5E14FE05A90DFAA62CBABFABD1113B7ADC697E2C5FB7C599080ECB14D83F04872BAB077C3154F0FA218AB606D42078FCFE69B11F20FA1C9A5511EB62891FD45F6EEFE97A7A6784E142F1114220DE2372A0FC9DBD315754F7F040C001F82D9ECED7905946778AC22C5C036D7B0A8C24B07B2B980ED1404D5BF40892052F718BFD67C410D5F4CA65C6D5BD47753CCBA30D7F8041C9665B00F17C4E2E476353A2A17E8AE3FABE4CC065C0C05224D0E1004F218FDA832100D939E236359A924033366355376DE2F0AC6B216B235824835F406902D0AB211FFB7E18BDAC8DEB88BF054BC305829E6A428FDD42538B9DE2C79CA1962426D3F96F75E5B12A8245227DF67190B0676DD5C624C286451752F80FE23C70FE228E356E2D371629C122A59FDDD178F0293F381291FFCF1605977385B17B4DBC44A8DB2F83952E9E7C83D653B1924F0D06B0CA38069D224A5C586EA4EDDB32B4BF3D971A190D24C366A24EACB48C2251C310CBCE0F08A44C41D0879B0762100381FAAF9ED9E9D40A7242EBA270BE613C3C654F5B5424A52420CE4474A472787F1348F6835E3D9185CF199D7E47A7A5EEB46EB982BD045DB0A89C4BE7853A1FC0E24B3584E34AA00994B3CB15405A572D22631974E4EF63515EC9053B8FAB762EF4000569AB62458C571A038FCEFAB8FBE4804CC29E55957CE4155A8CC5090F42E6DBEDCF8139EF0F59EBF72ABC52901B83ACAB30D67EFBE2A0664BC2014ADB8AC89FD69766CF9FAD133E87DAD17E9AD2EE7923CD16C42689DE72A84ACAEB6D2FAAFBA66D59F17BDFE0EFB4BFEB69501608A18A1E4FE4DA0A0A9CDD3A7AB940928993E8382B2B54542DD219D3ECBAE0849109AC4695EE9605E544F01E971ECD82B11619F5F92EAB1ECEB086C887C9A55E111B5B51F2EC33408D307153B53382F8C203082AAC47BEBE4BE340CCDA86B03ECA98F2FDF1011E015B0B301237F3A153E7461A4178C3DC39DA4BE8E4E0F81244FBB70EE340E7E60B2377EFE775821E7109031E770293440D7307B3B5F72255349B34457F920F4936933B830E8723555CDD6F44047A72910063D39A7BB2A44CA65916A1DFB191521FE99ABC1D4B4A03E988AD361CF5DFE41A91B228B08636BBBD3D507E6F685E2094453E40994E204611040D0A5C964CE974E145DBF39C72ACE9AE92FCCC44F825619861D71FDB185609100B5FF952AF8BE702E41ABE2435F73979F31D9B071FA156E74A6CCD490CCC8F0AC0D14BF210DAC0A8C8A9FD28ADB5CA10F5143A6D42CB22602D7C6A3ED3A2EE29EF61E64225654B59C293D0D081260C385CB97B1C3CB6CFE45743956A6D321CFD248BE8CCCFFA77A06C29BD8048E08A6074CEE991B1AEA144A39C83533D13FD1126544A0B7B71B06CEAE2E0F9371DCA25516C7C12A2BCAD094461C0F4CB013647DD6A8F28DE0CB450B780F09DEE9C8F61075C6A60321148282BAC34C7B7A6D680F5DDFF2210E07EDC9FC3442261F503A6B478DA4D7FCE7DCADDCECBD7DDDB38B87D63B0B8CF13B194BA16FF21D323464E8CB214FCB47DF2085021ABE5C99F4042B94B33CB1F2939EDF4665055B925590014DDB45D07B1C14702F7E799D226E8828A3DF52BFD16DC239F271872D170E8394C994930626DBF1771106F231901BAC366555A5162060A9A520508369A8B48602113C56C249E68A98926514661810EA941E39DE7DC21DD9DCA9D6EC477CCD2E0F7DF525B7C323CA90A62A89978A6B50F10365F211D31135BCAD2B5ED3984F7C0C8D9008FC51E870108AD94DF323A38A0E7509C118C903A7C4CBB32423201B16262C08622C002F74F959292D5FF44F9C1632F571C25296EF699BC3071A8269F427EA4EA474F95B113900277AB6D22735567973DE3DF757FF2A35881AF6B468E71C8585E5986CA04F21CECAE3AFBE8577040BC0A8F66235A6634F86672133B4C909661EABADE5C2D45F10C8556E556479E85A5554E0092BC65F5E5E154F146AD6E05A9211410895A3C87387BFD0539AF381EAB1911DA030EE3F316C41088BA0E9F3A53DC94F5C7AA00A9F56BAFC133156631705F885B0AD02E741499E18DA4D776F4AAA0E34116A8A7BF1056072C134296FC24A9E4E0CE9ACC62BFF673D6D3A359937B450BE220F52A87F426048B59DDF7F0F08FDD63BFEB55371B8A3616DFF6228A28D0F1ACD8C44D156F4F92B1FBDB31332EC86E7A37D9DB68A0A0920EA4CD75268AC4BA7F6457F1C20E3E65D83FC98FE2AD0328F065B6AC870B445B9CAD09FF9BAF724A02116509B5873B0251807086A5275819737ABA479B8F91A1AC53C0E9A4447655B205424481E7D2929A1081E952B97911E0E02125EF33AF1EC7BBD9C3585D9A6DEDB81F73FFAB26CDA485391EF0E2A3E83B64C3F6B83188220DC06337855CD6C6733D5493DC5761242550250464C427CE20888BD83F43FE47162B702651E112AE25A32BE3621F1E54BBBA6C6A7BD09099E3A848DB67F101A4288FC25445EE62C8B2C5EE8F57851D701FD509B08C1B26B0BDC0887B242E6BB27E62A4308652EDC00CBD9770A9FAAD5E5EE92FD8A5E0FC08DBA58C2483259932207259F3AFF2DBB11D3499E0F64CC1DB51DCFFC602463A70567DEDD42F50111C5D0EA41B815606BEAEFA8CC218AF28B384B6BF23FBCA5B922DA698EF2814000000099AE33F748DE78CA525D623D61ABBA5C588A6D4C1E3C213BB282A5874F4AE0E7C5522C9537781C36C11ECFC1AFD767A48E773E53B11D3D4A7317DEE1DF9A8602
(PID) Process:(4344) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:DeviceId
Value:
00180010F429971D
(PID) Process:(4344) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:ApplicationFlags
Value:
1
Executable files
0
Suspicious files
5
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
4344WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Backdoor.exe_382a7bdb530dfd148b5ad9c6b5e9f99bb2cf60_1735b03e_1d921851-c4b2-4397-bd1f-aae3a787171c\Report.wer —
MD5:—
SHA256:—
6564Backdoor.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\SysWOW64\Screens\0.pngimage
MD5:32839200FD3CBA1659FAB21C9E6E4AB2
SHA256:1223EADE49538570332BF2B828D66EA36CEF92BA859B00671EAAF1635F3EC5D3
4344WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER52FE.tmp.dmpbinary
MD5:43A48C88F7A3B064BE5370B4DF0C5EDA
SHA256:68BD91E563892CFFC56E9550E36E9C99C8FB672669B7052543C8B82B581AB053
6564Backdoor.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\SysWOW64\Screens\0.datbinary
MD5:F729D8DAA97A8F3918A18AE116383E77
SHA256:3038533742E5D618C1EC4F4230B9CE00A7D914121D0AA3153C4802C4040D0108
4344WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER53D9.tmp.WERInternalMetadata.xmlxml
MD5:C6919FD7885CA2A2EDAD7417C7992CD3
SHA256:8635689C022329B6CB107171C23EC585A8B573CE33EB93BAB468C1ABA81EA605
4344WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER53FA.tmp.xmlxml
MD5:68C8BFE17B8909309D59D5783C9EE8B3
SHA256:C00B361F5F05451DB131FA8D448C01D809B308D25FE0757F0E9E50C0361A6C83
4344WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:FB64A9EBEDF48D3895381D5B7D80743D
SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42
4344WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:82C30E45BF5F93A5DB1D5E47F913053B
SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967
4344WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Backdoor.exe.6564.dmpbinary
MD5:255D88DE67E451084BA1E8879FA99B6F
SHA256:2751AAF4341C1EF41F6D4C5E623E5556E6A7161D6BBF4739067BB2FFC544A367
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
35
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5140
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6756
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6804
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4160
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3140
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6564
Backdoor.exe
113.166.143.124:2404
—
VNPT Corp
VN
unknown
5336
SearchApp.exe
95.100.146.19:443
www.bing.com
Akamai International B.V.
CZ
unknown
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5140
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.bing.com
  • 95.100.146.19
  • 95.100.146.17
  • 95.100.146.35
  • 95.100.146.40
  • 95.100.146.8
  • 95.100.146.26
  • 95.100.146.32
  • 95.100.146.27
  • 95.100.146.33
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.133
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.76
  • 20.190.160.17
whitelisted
th.bing.com
  • 95.100.146.33
  • 95.100.146.19
  • 95.100.146.17
  • 95.100.146.35
  • 95.100.146.40
  • 95.100.146.8
  • 95.100.146.26
  • 95.100.146.32
  • 95.100.146.27
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
watson.events.data.microsoft.com
  • 52.168.117.173
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Backdoor.exe