File name:

Build.exe

Full analysis: https://app.any.run/tasks/00acf458-fec6-4af7-a82c-1ee7f70f042d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 17:09:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
stealer
zerotrace
xor-url
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

0FD5CB63AD53B201219B325C5BF5C78A

SHA1:

76B78C8E777D6E031D570D6BE548DBA639E95A80

SHA256:

3131A5BAD13A3A2AAE3F6FE3438F092166B4171E4F07926C736F47C9868AF98F

SSDEEP:

6144:UBO/DXlALcSdK45tSyQj3OEIII+b2HgmbzdA:JDXlALcSdKetSphIIIVAr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Suspicious browser debugging (Possible cookie theft)

      • msedge.exe (PID: 7636)

    • Actions looks like stealing of personal data

      • Build.exe (PID: 7528)

    • Steals credentials from Web Browsers

      • Build.exe (PID: 7528)

    • ZEROTRACE has been detected (YARA)

      • Build.exe (PID: 7528)

    • XORed URL has been found (YARA)

      • Build.exe (PID: 7528)

  • SUSPICIOUS

    • Checks for external IP

      • Build.exe (PID: 7528)
      • svchost.exe (PID: 2196)

    • Starts CMD.EXE for commands execution

      • Build.exe (PID: 7528)

    • Starts application with an unusual extension

      • cmd.exe (PID: 8112)
      • cmd.exe (PID: 5352)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 8112)
      • cmd.exe (PID: 5352)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 8112)

    • Multiple wallet extension IDs have been found

      • Build.exe (PID: 7528)

    • Loads DLL from Mozilla Firefox

      • Build.exe (PID: 7528)

  • INFO

    • Disables trace logs

      • Build.exe (PID: 7528)

    • Checks supported languages

      • Build.exe (PID: 7528)
      • chcp.com (PID: 8164)
      • chcp.com (PID: 7372)

    • Reads the computer name

      • Build.exe (PID: 7528)

    • Reads the machine GUID from the registry

      • Build.exe (PID: 7528)

    • Checks proxy server information

      • Build.exe (PID: 7528)
      • slui.exe (PID: 1132)

    • Application launched itself

      • msedge.exe (PID: 7636)
      • msedge.exe (PID: 6080)
      • chrome.exe (PID: 1228)

    • Reads the software policy settings

      • Build.exe (PID: 7528)
      • slui.exe (PID: 1132)

    • Create files in a temporary directory

      • Build.exe (PID: 7528)

    • Changes the display of characters in the console

      • cmd.exe (PID: 8112)
      • cmd.exe (PID: 5352)

    • Reads CPU info

      • Build.exe (PID: 7528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(7528) Build.exe
Decrypted-URLs (1)https://github.com/LimerBoy/StormKitty
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2087:06:23 13:31:42+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 280576
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x467ee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: ZeroTrace
FileVersion: 1.0.0.0
InternalName: ZeroTrace.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: ZeroTrace.exe
ProductName: ZeroTrace
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
32
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL build.exe svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs findstr.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
472"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --no-appcompat-clear --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5116 --field-trial-handle=2388,i,9410952753477127017,13565199803438606905,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1228"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --remote-allow-origins=* --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data"C:\Program Files\Google\Chrome\Application\chrome.exe
Build.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
4294967295
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2096findstr AllC:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2560\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3100"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --mojo-platform-channel-handle=2368 --field-trial-handle=1980,i,17264966530900218019,259352962253129652,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ffc895cdc40,0x7ffc895cdc4c,0x7ffc895cdc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3300"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3320 --field-trial-handle=1980,i,17264966530900218019,259352962253129652,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4008"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2384 --field-trial-handle=2388,i,9410952753477127017,13565199803438606905,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
16 201
Read events
16 173
Write events
28
Delete events
0

Modification events

(PID) Process:(7528) Build.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7528) Build.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7636) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7636) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7636) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7528) Build.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7528) Build.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7528) Build.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7528) Build.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7528) Build.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Build_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
5
Suspicious files
105
Text files
85
Unknown types
1

Dropped files

PID
Process
Filename
Type
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10f697.TMP —
MD5:—
SHA256:—
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\LOG.oldtext
MD5:F8F8200E9DC617B01F93320DA6BB7870
SHA256:9FD3E46AB3D926076563DBB90176D38DD5F1427DCD851AF539B019CA62BE9FB9
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:A440B2B4E06AF56BCDC8AE0E4ABF7A0B
SHA256:EE6899D4DEE495E71C452A696AE4C984ED4DA5BF5E43078BF5EF10210F95D318
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOGtext
MD5:EA126612DA2F761231935A21D5A3DD47
SHA256:E9150C34F4383ED69DF76A4D4A79D751C7F4943233EF2518DFF16668E2C6F702
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\LOG.old~RF10f687.TMPtext
MD5:0BFBF23732791ECBD0B56480C3DE5152
SHA256:87C47D0E2E511DE24F20573FD90202DDCBB0C626118129769122FA870B8DF61A
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old~RF10f697.TMPtext
MD5:C1C75CFDA95DA438E30077FF767A6FDF
SHA256:CED5E0654E5732FDDB0AE882D981C3FA7171889874047821BDF00245DC8EA913
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\DevToolsActivePorttext
MD5:FDEBFE490E977277E9BB7AFF11485F5E
SHA256:B7B80B232919F6C8245CB9D2517CA7FC343ACBCB0BDF2E01573B41D1E1762EE5
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old~RF10f687.TMPtext
MD5:29F7449691899E3CFC14F94670812757
SHA256:1D1DF03022CD740C76320CAC538DE55D4521FF4EA32CE83275C982F1B308BBC6
7636msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.oldtext
MD5:D95248482054CC3F9158A60D13CE0BCE
SHA256:AF8C73D6599B0D7603D52E50A01CD7A6AF4F3D23C5023CDF26B81DC0C14E0609
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
58
DNS requests
33
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
—
13.107.6.158:443
https://business.bing.com/work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox
unknown
—
—
—
—
—
GET
—
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
—
1672
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
—
142.250.186.99:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=122
unknown
—
—
—
1672
SIHClient.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1672
SIHClient.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.32:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7528
Build.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7528
Build.exe
104.26.1.100:443
get.geojs.io
CLOUDFLARENET
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.32
  • 23.216.77.36
  • 23.216.77.31
  • 23.216.77.37
  • 23.216.77.41
  • 23.216.77.35
  • 23.216.77.38
  • 23.216.77.5
  • 23.216.77.8
  • 23.216.77.22
  • 23.216.77.19
  • 23.216.77.26
  • 23.216.77.21
  • 23.216.77.29
  • 23.216.77.15
  • 23.216.77.18
  • 23.216.77.25
  • 23.216.77.28
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
ipinfo.io
  • 34.117.59.81
whitelisted
get.geojs.io
  • 104.26.1.100
  • 104.26.0.100
  • 172.67.70.233
whitelisted
clientservices.googleapis.com
  • 142.250.186.99
whitelisted
accounts.google.com
  • 74.125.133.84
whitelisted
www.google.com
  • 216.58.206.68
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted

Threats

PID
Process
Class
Message
7528
Build.exe
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
7528
Build.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ipinfo.io
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ipinfo.io
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ipinfo.io
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ipinfo.io
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ipinfo.io
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Address Lookup Domain (get .geojs .io) in DNS Lookup
7528
Build.exe
Device Retrieving External IP Address Detected
ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Build.exe