File name:

3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe

Full analysis: https://app.any.run/tasks/f9fd5628-c764-422d-b632-3eecb0f8bde0
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 12:25:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

FAEC5F662A40F71437E135A199BB3C93

SHA1:

8FF0D46CD7DA8828ACC0DE537E5BFF4B77AE5CAF

SHA256:

3C5EB974A1ABB3E853D53A0C7928A31D706FBC5A3A0CE202EDE5DD5597670022

SSDEEP:

24576:rzNDJm6B8KY1EykcNydZQrt5RcLkeS61fusLdLUaLhFg8u:3NDM6B8KSEykcNydZQrt5RcLkeS61fup

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)
      • app.exe (PID: 7544)
      • app.exe (PID: 7624)

    • Changes the autorun value in the registry

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)

    • Steals credentials from Web Browsers

      • My.RawFile.exe (PID: 8000)

    • Actions looks like stealing of personal data

      • My.RawFile.exe (PID: 8000)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)
      • My.RawFile.exe (PID: 8000)
      • app.exe (PID: 7544)

    • Reads security settings of Internet Explorer

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)
      • app.exe (PID: 7544)
      • app.exe (PID: 7624)

    • Process drops legitimate windows executable

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)

    • Application launched itself

      • app.exe (PID: 7544)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • My.RawFile.exe (PID: 8000)

    • Connects to SMTP port

      • My.RawFile.exe (PID: 8000)

  • INFO

    • Checks supported languages

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)
      • app.exe (PID: 7544)
      • app.exe (PID: 7624)
      • aspnet_compiler.exe (PID: 8040)

    • Reads the machine GUID from the registry

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)
      • app.exe (PID: 7544)
      • app.exe (PID: 7624)

    • Creates files or folders in the user directory

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)
      • app.exe (PID: 7544)
      • BackgroundTransferHost.exe (PID: 7920)
      • My.RawFile.exe (PID: 8000)

    • The sample compiled with english language support

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)

    • Reads the software policy settings

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)
      • app.exe (PID: 7544)
      • app.exe (PID: 7624)
      • BackgroundTransferHost.exe (PID: 7920)
      • My.RawFile.exe (PID: 8000)

    • Create files in a temporary directory

      • 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe (PID: 2384)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7696)
      • BackgroundTransferHost.exe (PID: 7416)
      • BackgroundTransferHost.exe (PID: 7920)

    • Reads the computer name

      • app.exe (PID: 7624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:03:22 06:00:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 440320
InitializedDataSize: 61952
UninitializedDataSize: -
EntryPoint: 0x6d71e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.41.5.120
ProductVersionNumber: 2.41.5.120
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Genuine Software Integrity Service
CompanyName: Peakbrick
FileDescription: IpBusEnum
FileVersion: 2.41.5.120
InternalName: IpBusEnum.exe
LegalCopyright: Copyright © 2017
OriginalFileName: IpBusEnum.exe
ProductName: IpBusEnum
ProductVersion: 2.41.5.120
AssemblyVersion: 2.41.5.120
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
15
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe sppextcomobj.exe no specs slui.exe app.exe app.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe my.rawfile.exe aspnet_compiler.exe no specs aspnet_compiler.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2152"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2384"C:\Users\admin\AppData\Local\Temp\3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe" C:\Users\admin\AppData\Local\Temp\3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe
explorer.exe
User:
admin
Company:
Peakbrick
Integrity Level:
MEDIUM
Description:
IpBusEnum
Exit code:
4294967295
Version:
2.41.5.120
Modules
Images
c:\users\admin\appdata\local\temp\3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3332C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4068"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5776"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5960C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7416"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7544"C:\Users\admin\AppData\Roaming\app.exe" C:\Users\admin\AppData\Roaming\app.exe
3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe
User:
admin
Company:
Peakbrick
Integrity Level:
MEDIUM
Description:
IpBusEnum
Version:
2.41.5.120
Modules
Images
c:\users\admin\appdata\roaming\app.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7624"C:\Users\admin\AppData\Roaming\app.exe" C:\Users\admin\AppData\Roaming\app.exe—app.exe
User:
admin
Company:
Peakbrick
Integrity Level:
MEDIUM
Description:
IpBusEnum
Version:
2.41.5.120
Modules
Images
c:\users\admin\appdata\roaming\app.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
14 188
Read events
14 155
Write events
33
Delete events
0

Modification events

(PID) Process:(2384) 3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Application
Value:
C:\Users\admin\AppData\Roaming\app.exe
(PID) Process:(7696) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7696) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7696) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7920) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7920) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7920) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5776) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5776) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5776) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
7
Suspicious files
9
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7920BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\38305b48-5d24-4830-960a-2e7c25997ef0.down_data —
MD5:—
SHA256:—
23843c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exeC:\Users\admin\AppData\Local\Temp\mscorsvw1.exeexecutable
MD5:BA428E7084F97B488865397D11059748
SHA256:3E824F0D325FD32F8100DDF6B506AD6250BE48286AC20726DCB23A9CEDF3E4C1
23843c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:CAD86C6274097B4D0A003C8F353E90AA
SHA256:9124471DB80CA1AFE10FA0BD6E61603A542DE3BA68F2EE08930E006DFB00E7DB
23843c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:3B5E0BD6640456A749D9155E6C135727
SHA256:C362A3D2B661C6066A02FC169FAAA1976C2F6160DA5837C7E68B7E0F67B794ED
23843c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956binary
MD5:BE3FA868F93E0291614A9E305BC134DC
SHA256:96C7D954177D822ACC58E36DB55AA695A00E3474F5A84915FFEE94A01CE34EDF
23843c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956binary
MD5:1EA27366E034EB9447A33CE639C01489
SHA256:788D210EF206A4D11B6B506BF52124EE03FCA4E8A9389FAD43772202A7E29452
23843c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exeC:\Users\admin\AppData\Roaming\app.exeexecutable
MD5:FAEC5F662A40F71437E135A199BB3C93
SHA256:3C5EB974A1ABB3E853D53A0C7928A31D706FBC5A3A0CE202EDE5DD5597670022
23843c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exeC:\Users\admin\AppData\Roaming\app_signed.exeexecutable
MD5:74978504807EA85E9BB2907909789A61
SHA256:C684F93834A4A20E2FB814BDD4931484F24010F80643CAE6F0D6399EC1936C6C
7920BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
7544app.exeC:\Users\admin\AppData\Roaming\My.RawFile.txttext
MD5:380C757CD867F6756F06C4E00C2F723B
SHA256:7FCA323662320DC398D2F0647BE5C7B60190126E8C795F12A1F4636978371D6C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
29
DNS requests
23
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2384
3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2384
3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7920
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7880
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8000
My.RawFile.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
5800
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7880
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2384
3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2384
3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe
2.19.217.218:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4208
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.164
  • 23.48.23.167
  • 23.48.23.194
  • 23.48.23.176
  • 23.48.23.173
  • 23.48.23.143
  • 23.48.23.180
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.65
  • 20.190.160.4
  • 20.190.160.3
  • 40.126.32.68
  • 20.190.160.67
  • 20.190.160.20
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
www.bing.com
  • 23.212.110.176
  • 23.212.110.178
  • 23.212.110.184
  • 23.212.110.179
  • 23.212.110.171
  • 23.212.110.169
  • 23.212.110.177
  • 23.212.110.160
  • 23.212.110.170
whitelisted
checkip.dyndns.org
  • 132.226.8.169
  • 193.122.6.168
  • 132.226.247.73
  • 158.101.44.242
  • 193.122.130.0
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
8000
My.RawFile.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3c5eb974a1abb3e853d53a0c7928a31d706fbc5a3a0ce202ede5dd5597670022.mrg.exe