File name:

sunshine-windows-installer.exe

Full analysis: https://app.any.run/tasks/59345b5c-8bb7-459e-b0dc-8ac64a2204cb
Verdict: Malicious activity
Analysis date: July 28, 2024, 23:27:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5:

B3A9D2D2C677F7AF2C3AC3DE54B93798

SHA1:

8E2DEBBE73EEDF9C00F1E10F393F4D9D9E6B9228

SHA256:

499A907E93B40F015534958E8F2BB1D13E9C1583C228A458E5F81D8703185977

SSDEEP:

98304:oprGgqBUZWw1iei8tLmRKAKLTwM3Ut4R/lH3UdXx9uPYByf4OJvMx+9rkKcyiVdv:2TastXICriMNgMiYz28ViPCPce4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • sunshine-windows-installer.exe (PID: 1712)
      • curl.exe (PID: 6232)
      • virtual_gamepad.exe (PID: 7772)
      • msiexec.exe (PID: 7860)
      • drvinst.exe (PID: 8712)
      • nefconw.exe (PID: 8644)

    • Starts NET.EXE for service management

      • net.exe (PID: 8912)
      • cmd.exe (PID: 8892)
      • net.exe (PID: 9040)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • sunshine-windows-installer.exe (PID: 1712)
      • virtual_gamepad.exe (PID: 7772)

    • Executable content was dropped or overwritten

      • sunshine-windows-installer.exe (PID: 1712)
      • curl.exe (PID: 6232)
      • virtual_gamepad.exe (PID: 7772)
      • nefconw.exe (PID: 8644)
      • drvinst.exe (PID: 8712)

    • Creates a software uninstall entry

      • sunshine-windows-installer.exe (PID: 1712)

    • Uses ICACLS.EXE to modify access control lists

      • ns5945.tmp (PID: 1136)
      • cmd.exe (PID: 6772)

    • Starts application with an unusual extension

      • sunshine-windows-installer.exe (PID: 1712)

    • Starts CMD.EXE for commands execution

      • ns5A30.tmp (PID: 2960)
      • ns5C64.tmp (PID: 2984)
      • ns6231.tmp (PID: 7584)
      • cmd.exe (PID: 7672)
      • nsEAAC.tmp (PID: 8836)

    • Executing commands from a ".bat" file

      • ns5A30.tmp (PID: 2960)
      • ns5C64.tmp (PID: 2984)
      • ns6231.tmp (PID: 7584)
      • nsEAAC.tmp (PID: 8836)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 1388)

    • Application launched itself

      • cmd.exe (PID: 7672)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7672)

    • The executable file from the user directory is run by the CMD process

      • virtual_gamepad.exe (PID: 7772)

    • Checks Windows Trust Settings

      • virtual_gamepad.exe (PID: 7772)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2748)

    • Reads the Windows owner or organization settings

      • virtual_gamepad.exe (PID: 7772)

    • Process drops legitimate windows executable

      • virtual_gamepad.exe (PID: 7772)

    • Drops a system driver (possible attempt to evade defenses)

      • virtual_gamepad.exe (PID: 7772)
      • msiexec.exe (PID: 7860)
      • drvinst.exe (PID: 8712)
      • nefconw.exe (PID: 8644)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7232)
      • sunshinesvc.exe (PID: 9080)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 8892)

  • INFO

    • Checks supported languages

      • sunshine-windows-installer.exe (PID: 1712)
      • ns5945.tmp (PID: 1136)
      • ns5A30.tmp (PID: 2960)
      • ns5C64.tmp (PID: 2984)
      • ns6231.tmp (PID: 7584)
      • identity_helper.exe (PID: 7556)
      • curl.exe (PID: 6232)
      • virtual_gamepad.exe (PID: 7772)
      • curl.exe (PID: 4548)
      • msiexec.exe (PID: 7860)
      • msiexec.exe (PID: 8048)

    • Create files in a temporary directory

      • sunshine-windows-installer.exe (PID: 1712)
      • curl.exe (PID: 6232)
      • virtual_gamepad.exe (PID: 7772)

    • Reads the computer name

      • sunshine-windows-installer.exe (PID: 1712)
      • curl.exe (PID: 6232)
      • curl.exe (PID: 4548)
      • identity_helper.exe (PID: 7556)
      • msiexec.exe (PID: 7860)
      • msiexec.exe (PID: 8048)
      • virtual_gamepad.exe (PID: 7772)

    • Creates files in the program directory

      • sunshine-windows-installer.exe (PID: 1712)
      • cmd.exe (PID: 6772)
      • virtual_gamepad.exe (PID: 7772)

    • Reads Microsoft Office registry keys

      • sunshine-windows-installer.exe (PID: 1712)
      • msedge.exe (PID: 6136)
      • msedge.exe (PID: 3940)

    • Application launched itself

      • msedge.exe (PID: 6136)
      • msedge.exe (PID: 3940)

    • Manual execution by a user

      • msedge.exe (PID: 3940)

    • Reads Environment values

      • identity_helper.exe (PID: 7556)
      • virtual_gamepad.exe (PID: 7772)
      • msiexec.exe (PID: 8048)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7804)

    • Reads the machine GUID from the registry

      • virtual_gamepad.exe (PID: 7772)

    • Reads the software policy settings

      • virtual_gamepad.exe (PID: 7772)

    • Checks proxy server information

      • reg.exe (PID: 7200)
      • virtual_gamepad.exe (PID: 7772)

    • Creates files or folders in the user directory

      • virtual_gamepad.exe (PID: 7772)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:28 20:33:36+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.42
CodeSize: 35840
InitializedDataSize: 73728
UninitializedDataSize: 402432
EntryPoint: 0x4280
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
228
Monitored processes
87
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start sunshine-windows-installer.exe slui.exe no specs msedge.exe no specs ns5945.tmp no specs conhost.exe no specs icacls.exe no specs msedge.exe no specs ns5a30.tmp no specs conhost.exe no specs cmd.exe no specs icacls.exe no specs msedge.exe no specs msedge.exe no specs icacls.exe no specs msedge.exe icacls.exe no specs icacls.exe no specs msedge.exe no specs ns5c64.tmp no specs conhost.exe no specs cmd.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs msedge.exe no specs netsh.exe no specs ns6231.tmp no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs curl.exe findstr.exe no specs curl.exe virtual_gamepad.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs nefconw.exe no specs nefconw.exe drvinst.exe drvinst.exe no specs nseaac.tmp no specs conhost.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sunshinesvc.exe no specs sunshine-windows-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1112icacls "C:\Program Files\Sunshine" /resetC:\Windows\System32\icacls.exe—ns5945.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1136"C:\Users\admin\AppData\Local\Temp\nsp11EA.tmp\ns5945.tmp" icacls "C:\Program Files\Sunshine" /resetC:\Users\admin\AppData\Local\Temp\nsp11EA.tmp\ns5945.tmp—sunshine-windows-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsp11ea.tmp\ns5945.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1388C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\Sunshine\scripts\add-firewall-rule.bat""C:\Windows\System32\cmd.exe—ns5C64.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1468"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2372 --field-trial-handle=2384,i,9919873122401949564,15552813696419212606,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1712"C:\Users\admin\AppData\Local\Temp\sunshine-windows-installer.exe" C:\Users\admin\AppData\Local\Temp\sunshine-windows-installer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\sunshine-windows-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2424C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2748"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3788 --field-trial-handle=2440,i,15253032227465673545,2868408939031417653,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2748C:\WINDOWS\system32\cmd.exe /c curl -s -L https://api.github.com/repos/nefarius/vigembus/releases/latest | findstr browser_download_urlC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2960"C:\Users\admin\AppData\Local\Temp\nsp11EA.tmp\ns5A30.tmp" "C:\Program Files\Sunshine\scripts\migrate-config.bat"C:\Users\admin\AppData\Local\Temp\nsp11EA.tmp\ns5A30.tmp—sunshine-windows-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsp11ea.tmp\ns5a30.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2968"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5976 --field-trial-handle=2440,i,15253032227465673545,2868408939031417653,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Total events
25 841
Read events
25 732
Write events
98
Delete events
11

Modification events

(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:DisplayName
Value:
Sunshine
(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:DisplayVersion
Value:
0.0.0
(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:Publisher
Value:
LizardByte
(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:UninstallString
Value:
"C:\Program Files\Sunshine\Uninstall.exe"
(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:NoRepair
Value:
1
(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:NoModify
Value:
1
(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Sunshine\Sunshine.exe
(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:HelpLink
Value:
https://sunshinestream.readthedocs.io/en/latest/about/installation.html
(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:URLInfoAbout
Value:
https://app.lizardbyte.dev/Sunshine
(PID) Process:(1712) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:Contact
Value:
https://app.lizardbyte.dev/Sunshine/support
Executable files
45
Suspicious files
110
Text files
120
Unknown types
21

Dropped files

PID
Process
Filename
Type
1712sunshine-windows-installer.exeC:\Program Files\Sunshine\sunshine.exeexecutable
MD5:71EDA1FE1133CBF77D3CB3402E2DF3DE
SHA256:8D220B89010EDDD993F6E3EDE99E67FCC0984D9B09AC8489A180A06AD22E9559
1712sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nsp11EA.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
1712sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nsp11EA.tmp\InstallOptions.dllexecutable
MD5:BAC67AF2C731D172568A188C63FFBC2E
SHA256:05D0DECB3A43D1B64F9AEC9BB2C6E760F8904FF82FC03C9548DA8AF7F9C827C5
1712sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nsp11EA.tmp\modern-header.bmpimage
MD5:92FCFB4F2E95D8BA0EC7DE564E62F68A
SHA256:1967D92ABD7EE2151CA9A50CEEF9210FDBF0023ECCEF294B2042F5FBBEE08067
1712sunshine-windows-installer.exeC:\Program Files\Sunshine\tools\ddprobe.exeexecutable
MD5:E9225AAA36C5D0F9F0AFDD350B4FFE7A
SHA256:8CC8DC7A4741D44C7846B84B02B43D8D0905A55B34A555C6E669D9509DAAFE4F
1712sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nsp11EA.tmp\UserInfo.dllexecutable
MD5:2C4D44DF9AEA8F958567D1F553BE57AB
SHA256:E4E377E4EE465CEB76764B20542EC59D780024B82765A7AE3338ACAA73C5D7B2
1712sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_packed_uv_type0_ps_perceptual_quantizer.hlsltext
MD5:770E5F40434C5B20DC0E4684A3869044
SHA256:D5F937713422D2122BF57F482CF14C9B7CF70DBDB2E7A881742334E22FD951F2
1712sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_planar_y_vs.hlsltext
MD5:2204BC27502CD5D11688560386D08BEE
SHA256:E029CDC9B794AC859A787F6E73F357FC62EFE1F6CB161EA59B43B874428E81C0
1712sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_planar_y_ps.hlsltext
MD5:A0189EE10A7066186095AE31703C4F5D
SHA256:38A257893B34D9854A033E353584242820E586DDB2D8245FD43AAE182EF38360
1712sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_planar_y_ps_linear.hlsltext
MD5:CCF41A6C14F7F15F15BE17B06B27AFE9
SHA256:5778FC50BC74B44B752273A24B262ED0F960CCFA5F92C2DBF8A06589F614D43D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
75
DNS requests
63
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3848
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEE4o94a2bBo7lCzSxA63QqU%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCL3A%2F%2FVHcvqtFzJz8jNiqv
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
760
lsass.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1428
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
104.126.37.136:443
www.bing.com
Akamai International B.V.
DE
unknown
1156
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
132
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5368
SearchApp.exe
13.107.246.45:443
fp-afd-nocache-ccp.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 104.126.37.136
  • 104.126.37.176
  • 104.126.37.154
  • 104.126.37.184
whitelisted
google.com
  • 216.58.206.46
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.45
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.69
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.73
  • 20.190.159.68
  • 20.190.159.0
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sunshine-windows-installer.exe