File name:

1 (325)

Full analysis: https://app.any.run/tasks/91d70e28-55c3-490a-a188-2f6b408de492
Verdict: Malicious activity
Analysis date: March 24, 2025, 21:07:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pykspa
worm
evasion
sinkhole
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

6EC3670524D99CECD05F314BB9DC8000

SHA1:

A09AF51D2C58F957EB65A120E5DC611AD9BAEDD3

SHA256:

40833A25C278F835625A763FA5890F7E464115E1E828BB2D19F5FB4C326FE139

SSDEEP:

24576:YWo/GQUCC1Qrk/LICnLlgu0yBszURztR4:YWo/GQUCCark/LICnLlgu0yBsARztR4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • hajwhnbjdnd.exe (PID: 6620)
      • zbmqv.exe (PID: 7352)
      • zbmqv.exe (PID: 7388)
      • regedit.exe (PID: 7632)
      • hajwhnbjdnd.exe (PID: 6424)
      • zbmqv.exe (PID: 6596)
      • zbmqv.exe (PID: 6588)

    • PYKSPA mutex has been found

      • hajwhnbjdnd.exe (PID: 6620)
      • zbmqv.exe (PID: 7352)
      • zbmqv.exe (PID: 7388)
      • hajwhnbjdnd.exe (PID: 6424)
      • hajwhnbjdnd.exe (PID: 6524)
      • zbmqv.exe (PID: 6596)
      • zbmqv.exe (PID: 6588)

    • Changes the autorun value in the registry

      • zbmqv.exe (PID: 7352)
      • zbmqv.exe (PID: 7388)
      • hajwhnbjdnd.exe (PID: 6620)
      • hajwhnbjdnd.exe (PID: 6424)
      • zbmqv.exe (PID: 6596)
      • zbmqv.exe (PID: 6588)

    • Changes appearance of the Explorer extensions

      • hajwhnbjdnd.exe (PID: 6620)
      • zbmqv.exe (PID: 7352)
      • zbmqv.exe (PID: 7388)
      • hajwhnbjdnd.exe (PID: 6424)
      • zbmqv.exe (PID: 6596)
      • zbmqv.exe (PID: 6588)

    • Modify registry editing tools (regedit)

      • zbmqv.exe (PID: 6588)
      • zbmqv.exe (PID: 6596)

    • PYKSPA has been detected (SURICATA)

      • zbmqv.exe (PID: 6596)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1 (325).exe (PID: 5508)
      • hajwhnbjdnd.exe (PID: 6620)
      • hajwhnbjdnd.exe (PID: 6424)
      • zbmqv.exe (PID: 6596)

    • Reads security settings of Internet Explorer

      • 1 (325).exe (PID: 5508)
      • hajwhnbjdnd.exe (PID: 6620)
      • zbmqv.exe (PID: 7352)
      • ShellExperienceHost.exe (PID: 7740)
      • droevlgslqpexoaui.exe (PID: 6376)
      • hajwhnbjdnd.exe (PID: 6424)
      • zbmqv.exe (PID: 6596)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 2260)

    • Potential Corporate Privacy Violation

      • zbmqv.exe (PID: 6596)

    • Checks for external IP

      • zbmqv.exe (PID: 6596)
      • svchost.exe (PID: 2180)

    • Suspicious files were dropped or overwritten

      • zbmqv.exe (PID: 6596)

    • Connects to unusual port

      • zbmqv.exe (PID: 6596)

    • Creates file in the systems drive root

      • zbmqv.exe (PID: 6596)

  • INFO

    • Create files in a temporary directory

      • 1 (325).exe (PID: 5508)
      • hajwhnbjdnd.exe (PID: 6620)
      • zbmqv.exe (PID: 7352)
      • zbmqv.exe (PID: 6596)

    • Reads the computer name

      • 1 (325).exe (PID: 5508)
      • hajwhnbjdnd.exe (PID: 6620)
      • zbmqv.exe (PID: 7352)
      • ShellExperienceHost.exe (PID: 7740)
      • PLUGScheduler.exe (PID: 2260)
      • droevlgslqpexoaui.exe (PID: 6376)
      • hajwhnbjdnd.exe (PID: 6524)
      • zbmqv.exe (PID: 6596)
      • zbmqv.exe (PID: 6588)
      • zbmqv.exe (PID: 7388)

    • Checks supported languages

      • 1 (325).exe (PID: 5508)
      • hajwhnbjdnd.exe (PID: 6620)
      • zbmqv.exe (PID: 7352)
      • zbmqv.exe (PID: 7388)
      • ShellExperienceHost.exe (PID: 7740)
      • OfficeClickToRun.exe (PID: 2952)
      • wjfukztewaymeufy.exe (PID: 6456)
      • droevlgslqpexoaui.exe (PID: 6376)
      • hajwhnbjdnd.exe (PID: 6524)
      • zbmqv.exe (PID: 6588)
      • zbmqv.exe (PID: 6596)

    • Process checks computer location settings

      • 1 (325).exe (PID: 5508)
      • hajwhnbjdnd.exe (PID: 6620)
      • zbmqv.exe (PID: 7352)
      • droevlgslqpexoaui.exe (PID: 6376)
      • wjfukztewaymeufy.exe (PID: 6456)

    • Process checks whether UAC notifications are on

      • hajwhnbjdnd.exe (PID: 6620)
      • zbmqv.exe (PID: 7388)
      • zbmqv.exe (PID: 7352)
      • hajwhnbjdnd.exe (PID: 6424)
      • zbmqv.exe (PID: 6596)

    • Creates files or folders in the user directory

      • zbmqv.exe (PID: 7352)
      • zbmqv.exe (PID: 6596)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 2260)
      • zbmqv.exe (PID: 6596)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 2952)

    • Manual execution by a user

      • droevlgslqpexoaui.exe (PID: 6376)
      • wjfukztewaymeufy.exe (PID: 6456)

    • Checks proxy server information

      • zbmqv.exe (PID: 6596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2008:12:30 15:40:22+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7.1
CodeSize: 28672
InitializedDataSize: 1007616
UninitializedDataSize: -
EntryPoint: 0x41d2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
275
Monitored processes
18
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 1 (325).exe #PYKSPA hajwhnbjdnd.exe sppextcomobj.exe no specs slui.exe no specs #PYKSPA zbmqv.exe #PYKSPA zbmqv.exe regedit.exe no specs regedit.exe shellexperiencehost.exe no specs officeclicktorun.exe plugscheduler.exe no specs droevlgslqpexoaui.exe no specs #PYKSPA hajwhnbjdnd.exe wjfukztewaymeufy.exe no specs #PYKSPA hajwhnbjdnd.exe no specs #PYKSPA zbmqv.exe #PYKSPA zbmqv.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2180C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2260"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\clbcatq.dll
c:\windows\system32\taskschd.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\xmllite.dll
2600C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2952"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /serviceC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Click-to-Run (SxS)
Version:
16.0.16026.20140
Modules
Images
c:\windows\system32\windows.networking.connectivity.dll
c:\windows\system32\windows.security.authentication.onlineid.dll
c:\windows\system32\onecoreuapcommonproxystub.dll
c:\windows\system32\slc.dll
c:\windows\system32\sppc.dll
c:\windows\system32\dsreg.dll
c:\windows\system32\msvcp110_win.dll
5508"C:\Users\admin\AppData\Local\Temp\1 (325).exe" C:\Users\admin\AppData\Local\Temp\1 (325).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1 (325).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6376"C:\Users\admin\AppData\Local\Temp\droevlgslqpexoaui.exe" C:\Users\admin\AppData\Local\Temp\droevlgslqpexoaui.exe—explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\droevlgslqpexoaui.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6424"C:\Users\admin\AppData\Local\Temp\hajwhnbjdnd.exe" "c:\users\admin\appdata\local\temp\droevlgslqpexoaui.exe*"C:\Users\admin\AppData\Local\Temp\hajwhnbjdnd.exe
droevlgslqpexoaui.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\hajwhnbjdnd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6456"C:\Users\admin\AppData\Local\Temp\wjfukztewaymeufy.exe" .C:\Users\admin\AppData\Local\Temp\wjfukztewaymeufy.exe—explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\wjfukztewaymeufy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6524"C:\Users\admin\AppData\Local\Temp\hajwhnbjdnd.exe" "c:\users\admin\appdata\local\temp\wjfukztewaymeufy.exe*."C:\Users\admin\AppData\Local\Temp\hajwhnbjdnd.exe
wjfukztewaymeufy.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\hajwhnbjdnd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6588"C:\Users\admin\AppData\Local\Temp\zbmqv.exe" "-C:\Users\admin\AppData\Local\Temp\wjfukztewaymeufy.exe"C:\Users\admin\AppData\Local\Temp\zbmqv.exe
hajwhnbjdnd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\zbmqv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
6 399
Read events
5 994
Write events
385
Delete events
20

Modification events

(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:oxpamxnuiicm
Value:
mbzqizviciiyskxshi.exe
(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:nxqcpbsapqlwl
Value:
wjfukztewaymeufy.exe .
(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:rdymbpisjmjwncm
Value:
kbbuohfuqyasoixulohg.exe
(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:wjfukztewaymeufy
Value:
mbzqizviciiyskxshi.exe .
(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:mbzqizviciiyskxshi
Value:
C:\Users\admin\AppData\Local\Temp\mbzqizviciiyskxshi.exe
(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:droevlgslqpexoaui
Value:
C:\Users\admin\AppData\Local\Temp\mbzqizviciiyskxshi.exe .
(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:oxpamxnuiicm
Value:
C:\Users\admin\AppData\Local\Temp\kbbuohfuqyasoixulohg.exe
(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:nxqcpbsapqlwl
Value:
C:\Users\admin\AppData\Local\Temp\zrsmhbaqnwzspkayquooa.exe .
(PID) Process:(6620) hajwhnbjdnd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableRegistryTools
Value:
1
Executable files
35
Suspicious files
60
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6620hajwhnbjdnd.exeC:\Users\admin\AppData\Local\Temp\kbbuohfuqyasoixulohg.exeexecutable
MD5:6EC3670524D99CECD05F314BB9DC8000
SHA256:40833A25C278F835625A763FA5890F7E464115E1E828BB2D19F5FB4C326FE139
6620hajwhnbjdnd.exeC:\Users\admin\AppData\Local\Temp\wjfukztewaymeufy.exeexecutable
MD5:6EC3670524D99CECD05F314BB9DC8000
SHA256:40833A25C278F835625A763FA5890F7E464115E1E828BB2D19F5FB4C326FE139
6620hajwhnbjdnd.exeC:\Users\admin\AppData\Local\Temp\droevlgslqpexoaui.exeexecutable
MD5:6EC3670524D99CECD05F314BB9DC8000
SHA256:40833A25C278F835625A763FA5890F7E464115E1E828BB2D19F5FB4C326FE139
6620hajwhnbjdnd.exeC:\Users\admin\AppData\Local\Temp\xnmexpmavcdupiwsikc.exeexecutable
MD5:6EC3670524D99CECD05F314BB9DC8000
SHA256:40833A25C278F835625A763FA5890F7E464115E1E828BB2D19F5FB4C326FE139
7352zbmqv.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\SysWOW64\edlmopvswmwwaczedopwpzno.zhibinary
MD5:812B0DCEE6999DAF3CD44FCF0DEBA072
SHA256:F0DA7793F2C696780FE8BD76C39E3F4B38B0CC72C7939E20CB476B6ABB427DC4
6620hajwhnbjdnd.exeC:\Users\admin\AppData\Local\Temp\zrsmhbaqnwzspkayquooa.exeexecutable
MD5:6EC3670524D99CECD05F314BB9DC8000
SHA256:40833A25C278F835625A763FA5890F7E464115E1E828BB2D19F5FB4C326FE139
6620hajwhnbjdnd.exeC:\Users\admin\AppData\Local\Temp\qjlgcxxomwausofexcxylp.exeexecutable
MD5:6EC3670524D99CECD05F314BB9DC8000
SHA256:40833A25C278F835625A763FA5890F7E464115E1E828BB2D19F5FB4C326FE139
7352zbmqv.exeC:\Users\admin\AppData\Local\Temp\djygpxkoz.regtext
MD5:A8702BDFF482E47B2E74B115FFAAF779
SHA256:15BD561433C476CB5E4AD5EB3AFE7ECA32841149FFDC21E1D33181532669EE6B
6620hajwhnbjdnd.exeC:\Users\admin\AppData\Local\Temp\zbmqv.exeexecutable
MD5:0D0B492C46796161F526352F3E890E47
SHA256:4FFC04061A7B338BB0291DA7A1B8637FBCCBB17C00C5FAFC3CB0F4952A21A494
7352zbmqv.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files (x86)\edlmopvswmwwaczedopwpzno.zhibinary
MD5:812B0DCEE6999DAF3CD44FCF0DEBA072
SHA256:F0DA7793F2C696780FE8BD76C39E3F4B38B0CC72C7939E20CB476B6ABB427DC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
70
DNS requests
356
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.24.77.23:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5312
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6596
zbmqv.exe
GET
301
188.114.97.3:80
http://www.showmyipaddress.com/
unknown
—
—
malicious
6596
zbmqv.exe
GET
—
104.19.222.79:80
http://whatismyipaddress.com/
unknown
—
—
whitelisted
6596
zbmqv.exe
GET
301
188.114.97.3:80
http://www.showmyipaddress.com/
unknown
—
—
malicious
6596
zbmqv.exe
GET
403
104.19.222.79:80
http://whatismyipaddress.com/
unknown
—
—
whitelisted
6828
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6828
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6596
zbmqv.exe
GET
301
188.114.97.3:80
http://www.showmyipaddress.com/
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
184.24.77.23:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
—
—
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 184.24.77.23
  • 184.24.77.37
  • 184.24.77.29
  • 184.24.77.11
  • 184.24.77.10
  • 184.24.77.7
  • 184.24.77.42
  • 184.24.77.30
  • 184.24.77.38
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 20.198.162.78
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.130
  • 20.190.159.0
  • 20.190.159.4
  • 20.190.159.128
  • 20.190.159.71
  • 40.126.31.73
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 23.54.109.203
  • 2.23.77.188
  • 184.30.131.245
whitelisted
self.events.data.microsoft.com
  • 20.42.73.31
  • 104.46.162.226
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted

Threats

PID
Process
Class
Message
6596
zbmqv.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (showmyipaddress .com in HTTP Host)
6596
zbmqv.exe
A Network Trojan was detected
ET MALWARE Win32/Pykspa.C Public IP Check
6596
zbmqv.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (showmyipaddress .com in HTTP Host)
6596
zbmqv.exe
A Network Trojan was detected
ET MALWARE Win32/Pykspa.C Public IP Check
2180
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (whatismyipaddress .com)
6596
zbmqv.exe
A Network Trojan was detected
ET MALWARE Win32/Pykspa.C Public IP Check
6596
zbmqv.exe
A Network Trojan was detected
ET MALWARE Win32/Pykspa.C Public IP Check
6596
zbmqv.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (showmyipaddress .com in HTTP Host)
6596
zbmqv.exe
A Network Trojan was detected
ET MALWARE Win32/Pykspa.C Public IP Check
6596
zbmqv.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (showmyipaddress .com in HTTP Host)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (325)