File name:

.exe

Full analysis: https://app.any.run/tasks/cbfd7426-8f3d-40bc-86ad-ff6a32de5848
Verdict: Malicious activity
Analysis date: June 21, 2025, 17:40:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
clipper
diamotrix
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

F6B479BF545A9010EC08CF931A5A0FA4

SHA1:

5940CE075DAE974E042588FDDB6CA6C7F5AE754A

SHA256:

49948543F0F14E1E1F86216E38477FCC10DF6686D725AA0D87E293B9C37722E5

SSDEEP:

24576:nfJZEdPsHWYWz+xwoVF9gbTIib7ujAEp4:n8pGWYWz+xwo1gbTIib7ujAE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • sihost.exe (PID: 4180)
      • svchost.exe (PID: 4204)
      • explorer.exe (PID: 4772)
      • svchost.exe (PID: 5048)
      • svchost.exe (PID: 4248)
      • StartMenuExperienceHost.exe (PID: 5160)
      • RuntimeBroker.exe (PID: 5224)
      • SearchApp.exe (PID: 5328)
      • RuntimeBroker.exe (PID: 5448)
      • dllhost.exe (PID: 5604)
      • RuntimeBroker.exe (PID: 4376)
      • ApplicationFrameHost.exe (PID: 5096)
      • UserOOBEBroker.exe (PID: 5936)
      • TextInputHost.exe (PID: 2772)
      • svchost.exe (PID: 6984)
      • dllhost.exe (PID: 2484)
      • default-browser-agent.exe (PID: 2512)
      • firefox.exe (PID: 2148)
      • taskhostw.exe (PID: 2368)
      • RuntimeBroker.exe (PID: 7092)
      • firefox.exe (PID: 2792)

    • Runs injected code in another process

      • cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe (PID: 4676)

    • Changes the autorun value in the registry

      • cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe (PID: 4676)
      • explorer.exe (PID: 4772)

    • DIAMOTRIX has been detected (SURICATA)

      • explorer.exe (PID: 4772)
      • ApplicationFrameHost.exe (PID: 5096)
      • RuntimeBroker.exe (PID: 5448)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe (PID: 4676)

    • Executes application which crashes

      • sihost.exe (PID: 4180)
      • ApplicationFrameHost.exe (PID: 5096)

    • Connects to the server without a host name

      • sihost.exe (PID: 4180)
      • ApplicationFrameHost.exe (PID: 5096)
      • explorer.exe (PID: 4772)

    • Reads security settings of Internet Explorer

      • StartMenuExperienceHost.exe (PID: 6532)

    • Reads the date of Windows installation

      • StartMenuExperienceHost.exe (PID: 6532)

  • INFO

    • Checks supported languages

      • cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe (PID: 4676)
      • default-browser-agent.exe (PID: 2512)
      • TextInputHost.exe (PID: 7008)
      • StartMenuExperienceHost.exe (PID: 6532)
      • SearchApp.exe (PID: 6936)

    • Reads the machine GUID from the registry

      • cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe (PID: 4676)
      • StartMenuExperienceHost.exe (PID: 5160)
      • TextInputHost.exe (PID: 2772)
      • default-browser-agent.exe (PID: 2512)
      • SearchApp.exe (PID: 6936)

    • Reads the computer name

      • cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe (PID: 4676)
      • StartMenuExperienceHost.exe (PID: 6532)
      • TextInputHost.exe (PID: 7008)
      • SearchApp.exe (PID: 6936)

    • Reads security settings of Internet Explorer

      • taskhostw.exe (PID: 2368)
      • Taskmgr.exe (PID: 1480)
      • Taskmgr.exe (PID: 7008)
      • explorer.exe (PID: 4772)
      • sihost.exe (PID: 4180)
      • RuntimeBroker.exe (PID: 5224)

    • Creates files in the program directory

      • cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe (PID: 4676)

    • Launching a file from a Registry key

      • cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe (PID: 4676)
      • explorer.exe (PID: 4772)

    • Checks proxy server information

      • sihost.exe (PID: 4180)
      • ApplicationFrameHost.exe (PID: 5096)
      • explorer.exe (PID: 4772)
      • SearchApp.exe (PID: 6936)
      • RuntimeBroker.exe (PID: 5448)

    • Process checks computer location settings

      • SearchApp.exe (PID: 6936)
      • StartMenuExperienceHost.exe (PID: 6532)

    • Reads the software policy settings

      • SearchApp.exe (PID: 6936)

    • Creates files or folders in the user directory

      • dllhost.exe (PID: 5604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Clipper DOS Executable (33.3)
.exe | Generic Win/DOS Executable (33)
.exe | DOS Executable Generic (33)
.vxd | VXD Driver (0.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:06:21 17:41:45+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 10
CodeSize: 23040
InitializedDataSize: 227840
UninitializedDataSize: -
EntryPoint: 0x24c4
OSVersion: 5.2
ImageVersion: 1
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
30
Malicious processes
6
Suspicious processes
16

Behavior graph

Click at the process to see the details
start cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe #DIAMOTRIX explorer.exe taskmgr.exe no specs taskmgr.exe slui.exe no specs taskmgr.exe no specs taskmgr.exe startmenuexperiencehost.exe no specs textinputhost.exe no specs searchapp.exe firefox.exe taskhostw.exe dllhost.exe default-browser-agent.exe textinputhost.exe firefox.exe sihost.exe svchost.exe svchost.exe runtimebroker.exe svchost.exe #DIAMOTRIX applicationframehost.exe startmenuexperiencehost.exe runtimebroker.exe searchapp.exe #DIAMOTRIX runtimebroker.exe dllhost.exe useroobebroker.exe svchost.exe runtimebroker.exe

Process information

PID
CMD
Path
Indicators
Parent process
1132"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
1480"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\powrprof.dll
2148"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent do-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe
default-browser-agent.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\imm32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
2356C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2368taskhostw.exeC:\Windows\System32\taskhostw.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mrmcorer.dll
c:\windows\system32\psapi.dll
2484C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
2512"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task "308046B0AF4A39CB"C:\Program Files\Mozilla Firefox\default-browser-agent.exe
svchost.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
136.0
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\shcore.dll
c:\windows\system32\netutils.dll
c:\program files\mozilla firefox\default-browser-agent.exe
2772"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Exit code:
1
Version:
123.26505.0.0
Modules
Images
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2792"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent do-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4180sihost.exeC:\Windows\System32\sihost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Shell Infrastructure Host
Exit code:
3221225477
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\sihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
Total events
17 121
Read events
16 969
Write events
140
Delete events
12

Modification events

(PID) Process:(2368) taskhostw.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\default$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~microsoft.skype.skypedesktop
Operation:writeName:Data
Value:
434201000A0201002A06ABDDDBC2062A000000
(PID) Process:(2368) taskhostw.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppListBackup\ListOfTaskBackedUpTiles_2475948406
Operation:writeName:ListOfTaskBackedUpTiles_2475948406
Value:
{"tileId":"W~Microsoft.Skype.SkypeDesktop", "appIconLightAssetId":"", "appIconDarkAssetId":"", "displayName":"", "sortName":"", "suiteName":"", "packageId":"", "action":"2", "shortcutArgs":"", "targetPath":""}
(PID) Process:(4676) cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exeKey:HKEY_CURRENT_USER\SOFTWARE\bbeecafdaeec
Operation:writeName:CurrentPath
Value:
C:\Users\admin\AppData\Local\Temp\cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe
(PID) Process:(4676) cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\ProgramData\bbeecafdaeec.exe"
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\Users\admin\AppData\Local\Temp\cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe"
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\bbeecafdaeec
Operation:writeName:CurrentPath
Value:
C:\Users\admin\AppData\Local\Temp\cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exe
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\ProgramData\bbeecafdaeec.exe"
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
1
Suspicious files
11
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2792firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.tmpbinary
MD5:D2C7052C32C70B908D170A3BB6CDF82C
SHA256:BDDF58AADB0DC65B1C59EB38BE1FA4BFF6442DAF9644D9C47E93AD595AC12DD2
2792firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.binbinary
MD5:D2C7052C32C70B908D170A3BB6CDF82C
SHA256:BDDF58AADB0DC65B1C59EB38BE1FA4BFF6442DAF9644D9C47E93AD595AC12DD2
4676cbfd7426-8f3d-40bc-86ad-ff6a32de5848.exeC:\ProgramData\bbeecafdaeec.exeexecutable
MD5:F6B479BF545A9010EC08CF931A5A0FA4
SHA256:49948543F0F14E1E1F86216E38477FCC10DF6686D725AA0D87E293B9C37722E5
7008Taskmgr.exeC:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
6936SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4A5F18709B3A08C92D4CB9874C48EF27
SHA256:EFF6960CB940B6E5F620AB980661E8457F7E1478F7D73D7F2ABD28B5DD1CB1DF
6936SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\Q84V0JUH\6hU_LneafI_NFLeDvM367ebFaKQ[1].jsbinary
MD5:C6C21B7634D82C53FB86080014D86E66
SHA256:D39E9BA92B07F4D50B11A49965E9B162452D7B9C9F26D9DCB07825727E31057E
4772explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
6936SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZWUI0EBX\www.bing[1].xmltext
MD5:E57EA70E7569D1A6E640E1DA1F90A0D4
SHA256:8CBAFF0BA6A292FE29681CECD33B12DE9028D0E8C6EE3265579623C74229EBEC
6936SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:988F6CF042BD991FE1952D4B8A183F44
SHA256:B2259BC5AA81E7EFEEE89E32C1D09D58355926D3548D9353640214689001841F
6936SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:DF367B9525354CC5543C9247210072ED
SHA256:68511E58CC309F2895652008EF4A7C0B18C023D5EDBC435BCE4E83F8BE640D09
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
34
DNS requests
20
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4772
explorer.exe
POST
200
185.156.72.89:80
http://185.156.72.89/nzcwzue/pqrfxn.php
unknown
—
—
unknown
2596
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.24.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2536
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2536
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
4772
explorer.exe
POST
200
185.156.72.89:80
http://185.156.72.89/nzcwzue/pqrfxn.php
unknown
—
—
unknown
4180
sihost.exe
POST
200
185.156.72.89:80
http://185.156.72.89/nzcwzue/pqrfxn.php
unknown
—
—
unknown
2348
WerFault.exe
GET
200
184.24.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2648
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2596
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2596
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4772
explorer.exe
185.156.72.89:80
—
Tov Vaiz Partner
RU
unknown
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.3
  • 20.190.159.75
  • 40.126.31.129
  • 40.126.31.71
  • 40.126.31.69
  • 40.126.31.130
  • 20.190.159.2
  • 40.126.31.1
  • 20.190.159.4
  • 20.190.159.128
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 184.24.77.30
  • 184.24.77.18
  • 184.24.77.24
  • 184.24.77.17
  • 184.24.77.27
  • 184.24.77.22
  • 184.24.77.29
  • 184.24.77.19
  • 184.24.77.16
  • 184.24.77.28
  • 184.24.77.39
  • 184.24.77.37
  • 184.24.77.38
  • 184.24.77.35
  • 184.24.77.40
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
4772
explorer.exe
A Network Trojan was detected
ET MALWARE Diamotrix POST Request M3
4772
explorer.exe
A Network Trojan was detected
ET MALWARE Diamotrix POST Request M3
4180
sihost.exe
Potentially Bad Traffic
ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
5096
ApplicationFrameHost.exe
A Network Trojan was detected
ET MALWARE Diamotrix POST Request M3
5448
RuntimeBroker.exe
A Network Trojan was detected
ET MALWARE Diamotrix POST Request M3
No debug info