File name:

CapCut_7418125124962107397_installer.exe

Full analysis: https://app.any.run/tasks/526b355f-ffd2-46d0-8a72-06bb5f06507d
Verdict: Malicious activity
Analysis date: February 06, 2025, 21:43:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

C91E097550EA6CCEDF592D8B83414E0D

SHA1:

021F3F26D86F98AF28DC987BAAD8714F64867207

SHA256:

4A9D815F284ADDA187982E2B24DA2BEAAD860739BC4B4CB1CF26408E7C221DD6

SSDEEP:

98304:hVb9nzGB0LtahqQP4CK+0TTdui7ej1EfTwb+4TA3SkFYInoeHaEfjhNkhooy7qsY:4Zotwoe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • CapCut_7418125124962107397_installer.exe (PID: 6224)
      • app_package_6a3e547b88.exe (PID: 5252)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • CapCut_7418125124962107397_installer.exe (PID: 6224)

    • Executable content was dropped or overwritten

      • CapCut_7418125124962107397_installer.exe (PID: 6224)
      • app_package_6a3e547b88.exe (PID: 5252)

    • There is functionality for taking screenshot (YARA)

      • CapCut_7418125124962107397_installer.exe (PID: 6224)
      • app_package_6a3e547b88.exe (PID: 5252)

    • Drops 7-zip archiver for unpacking

      • app_package_6a3e547b88.exe (PID: 5252)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 2072)
      • cmd.exe (PID: 5544)

    • Process drops legitimate windows executable

      • app_package_6a3e547b88.exe (PID: 5252)

    • Creates a software uninstall entry

      • app_package_6a3e547b88.exe (PID: 5252)

    • Application launched itself

      • CapCut.exe (PID: 4968)

    • Starts CMD.EXE for commands execution

      • CapCut.exe (PID: 4968)
      • VEDetector.exe (PID: 6468)

    • The process drops C-runtime libraries

      • app_package_6a3e547b88.exe (PID: 5252)

  • INFO

    • The sample compiled with english language support

      • CapCut_7418125124962107397_installer.exe (PID: 6224)
      • app_package_6a3e547b88.exe (PID: 5252)

    • Checks supported languages

      • CapCut_7418125124962107397_installer.exe (PID: 6224)
      • app_package_6a3e547b88.exe (PID: 5252)

    • Reads the computer name

      • CapCut_7418125124962107397_installer.exe (PID: 6224)
      • app_package_6a3e547b88.exe (PID: 5252)

    • Creates files or folders in the user directory

      • CapCut_7418125124962107397_installer.exe (PID: 6224)
      • app_package_6a3e547b88.exe (PID: 5252)
      • BackgroundTransferHost.exe (PID: 5000)

    • Create files in a temporary directory

      • CapCut_7418125124962107397_installer.exe (PID: 6224)
      • app_package_6a3e547b88.exe (PID: 5252)

    • Process checks whether UAC notifications are on

      • app_package_6a3e547b88.exe (PID: 5252)

    • The sample compiled with chinese language support

      • app_package_6a3e547b88.exe (PID: 5252)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 6848)
      • BackgroundTransferHost.exe (PID: 5000)
      • BackgroundTransferHost.exe (PID: 1760)
      • BackgroundTransferHost.exe (PID: 6380)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 5000)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 5000)

    • Qt framework related mutex has been found

      • CapCut.exe (PID: 4968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
21
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start capcut_7418125124962107397_installer.exe app_package_6a3e547b88.exe ucpdmgr.exe no specs conhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs capcut.exe no specs capcut.exe capcut.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs parfait_crash_handler.exe no specs vedetector.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs capcut_7418125124962107397_installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1216"C:\Users\admin\AppData\Local\CapCut\Apps\\CapCut.exe"C:\Users\admin\AppData\Local\CapCut\Apps\CapCut.exe—CapCut_7418125124962107397_installer.exe
User:
admin
Company:
ByteDance Pte. Ltd.
Integrity Level:
HIGH
Description:
CapCut
Exit code:
0
Version:
1.0.0.000000
Modules
Images
c:\users\admin\appdata\local\capcut\apps\capcut.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\setupapi.dll
1760"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2072C:\WINDOWS\System32\cmd.exe /c wmic csproduct get Name,UUID /valueC:\Windows\System32\cmd.exe—VEDetector.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2828"C:\Users\admin\AppData\Local\Temp\CapCut_7418125124962107397_installer.exe" C:\Users\admin\AppData\Local\Temp\CapCut_7418125124962107397_installer.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\capcut_7418125124962107397_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4516"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4764C:\Users\admin\AppData\Local\CapCut\Apps\5.5.0.2028\parfait_crash_handler.exe "--database=C:\Users\admin\AppData\Local\CapCut\User Data\Crash\\" "--metrics-dir=C:\Users\admin\AppData\Local\CapCut\User Data\Crash\\" --annotation=crop_type=6 --annotation=enable_crash_event=true --annotation=execute-if-childprocess-crash=true --annotation=is_debug=false --annotation=main_pid=4968 "--annotation=os_version=Windows NT 10.0.19045" --annotation=parfait_version=1.5.9.0 "--annotation=posthandler-copy-dir=C:\Users\admin\AppData\Local\CapCut\User Data\Crash/crash_post_reports" --annotation=posthandler-process-path=C:/Users/admin/AppData/Local/CapCut/Apps/5.5.0.2028/VECrashHandler.exe --annotation=posthandler-wait-result=true --annotation=posthandler-wait-timeout=120 --initial-client-data=0xee0,0xed8,0x1068,0xfd8,0xfb8,0x7ff81a41eff0,0x7ff81a41f008,0x7ff81a41f020C:\Users\admin\AppData\Local\CapCut\Apps\5.5.0.2028\parfait_crash_handler.exe—CapCut.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.5.9.0
4968"C:\Users\admin\AppData\Local\CapCut\Apps\5.5.0.2028\CapCut.exe" C:\Users\admin\AppData\Local\CapCut\Apps\5.5.0.2028\CapCut.exe
CapCut.exe
User:
admin
Company:
ByteDance
Integrity Level:
HIGH
Exit code:
0
Version:
5.5.0.2028
Modules
Images
c:\users\admin\appdata\local\capcut\apps\5.5.0.2028\capcut.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\capcut\apps\5.5.0.2028\veconfig.dll
c:\users\admin\appdata\local\capcut\apps\5.5.0.2028\vesafeguard.dll
c:\users\admin\appdata\local\capcut\apps\5.5.0.2028\vcruntime140.dll
c:\users\admin\appdata\local\capcut\apps\5.5.0.2028\vcruntime140_1.dll
5000"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5252"C:\Users\admin\AppData\Local\app_shell_cache_562354\app_package_6a3e547b88.exe" /s /create_desktop=1 /install_path="C:\Users\admin\AppData\Local\CapCut\Apps"C:\Users\admin\AppData\Local\app_shell_cache_562354\app_package_6a3e547b88.exe
CapCut_7418125124962107397_installer.exe
User:
admin
Company:
Bytedance Pte. Ltd.
Integrity Level:
HIGH
Description:
CapCut
Exit code:
0
Version:
5.5.0.2028
Modules
Images
c:\users\admin\appdata\local\app_shell_cache_562354\app_package_6a3e547b88.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
13 659
Read events
13 609
Write events
47
Delete events
3

Modification events

(PID) Process:(6848) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6848) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6848) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5000) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5000) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5000) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1760) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1760) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1760) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6380) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
737
Suspicious files
3 531
Text files
2 665
Unknown types
1

Dropped files

PID
Process
Filename
Type
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\app_shell_cache_562354\app_package_6a3e547b88.exe —
MD5:—
SHA256:—
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\Temp\nsv72E2.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\Temp\nsv72E2.tmp\res.zipcompressed
MD5:23E2490706D024BD70CCB906EBF0B62D
SHA256:FBB054F0880B81DE92BE6A9500C6757F4E1A3E8E335E31821D76B49DE8375C8C
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\Temp\nsv72E2.tmp\downloader_nsis_plugin.dllexecutable
MD5:F181413906A465FD0DD68CC4A3D98803
SHA256:E28FF7B8FC4B1EB2D1F394CE15DE2FC031CDA58DB645038C8C07581C31E79DDA
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\Temp\nsv72E2.tmp\shell_downloader.dllexecutable
MD5:C052C0A2ED833D924B7799625413AC1C
SHA256:098972CF9DDC9D574130E025A252A99B278DE9CC0AE700ACFB8C935C24EB1172
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\Temp\visual_effects_en.pngimage
MD5:8EA92C4B9D936D485757D19391F45043
SHA256:3A5E1EF48BD852386D5B155306F6B4098B53242C282B9BC54A2C2203301D90BA
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\Temp\nsv72E2.tmp\deviceregister_shared.dllexecutable
MD5:8BAAAEACB97679FB495E1C4F902F0A68
SHA256:7C2A74C4BE8D524A121E78E763C05C7B5CB58B524119AC8897C493E717A1D42A
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\Temp\intelligent_subtitles_en.pngimage
MD5:C51D1976F87828C0DCA46EF4D0243614
SHA256:463A0C124A0925FBB341855685B2B58525B100108D271679F2F95398D5F6C618
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\Temp\keyframe_en.pngimage
MD5:950E97619B630F384CB2EC5C8DD271C2
SHA256:620CFFEECF59C90DB73B0CD81F8F4378AEAD22AF98791111EEE877A07344DC55
6224CapCut_7418125124962107397_installer.exeC:\Users\admin\AppData\Local\Temp\speech_synthesis_en.pngimage
MD5:7E0FCA9AFBA9A7FBC15D378B8E550BAA
SHA256:49D5FA943BCEC39D1244E6C69801F20B5F9D01FC89D6F260236A3C1255B5FC98
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
88
DNS requests
43
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.14:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4536
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4536
svchost.exe
GET
200
2.16.241.14:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6192
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6192
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6872
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6016
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.14:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4536
svchost.exe
2.16.241.14:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.21.65.153:443
www.bing.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4536
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6224
CapCut_7418125124962107397_installer.exe
2.19.96.248:443
editor-api-sg.capcut.com
Akamai International B.V.
DE
unknown
6224
CapCut_7418125124962107397_installer.exe
2.16.238.20:443
maliva-mcs.byteoversea.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.16.241.14
  • 2.16.241.12
whitelisted
www.bing.com
  • 2.21.65.153
  • 2.21.65.154
  • 92.123.104.33
  • 92.123.104.38
  • 92.123.104.31
  • 92.123.104.59
  • 92.123.104.63
  • 92.123.104.32
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
editor-api-sg.capcut.com
  • 2.19.96.248
  • 2.19.96.202
  • 23.36.162.217
  • 23.36.162.199
unknown
maliva-mcs.byteoversea.com
  • 2.16.238.20
  • 2.16.238.17
  • 2.16.238.22
  • 2.16.238.28
  • 2.16.238.24
  • 2.16.238.8
  • 2.16.238.18
  • 2.16.238.14
  • 2.16.238.25
  • 23.53.42.8
  • 23.53.42.19
  • 23.53.42.17
  • 23.53.42.11
  • 23.53.42.10
  • 23.53.42.16
  • 23.53.42.9
  • 23.53.41.251
  • 23.53.42.18
  • 23.53.42.33
  • 23.53.42.27
  • 23.53.42.26
  • 23.53.42.32
  • 23.53.42.24
  • 23.53.42.34
  • 23.53.42.35
  • 23.53.42.25
  • 23.53.42.40
  • 2.19.126.145
  • 2.19.126.162
  • 2.19.126.138
  • 2.19.126.153
  • 2.19.126.137
  • 2.19.126.142
  • 2.19.126.148
  • 2.19.126.156
  • 2.19.126.158
whitelisted
sf16-va.tiktokcdn.com
  • 2.18.64.196
  • 2.18.64.214
whitelisted
sgali-mcs.byteoversea.com
  • 2.18.64.218
  • 2.18.64.216
  • 2.18.64.203
  • 2.18.64.196
  • 2.18.64.212
  • 2.18.64.202
  • 2.18.64.200
  • 2.18.64.214
  • 2.18.64.221
  • 23.53.42.18
  • 23.53.42.16
  • 23.53.42.17
  • 23.53.42.24
  • 23.53.42.27
  • 23.53.42.26
  • 23.53.42.19
  • 23.53.42.32
  • 23.53.42.25
whitelisted
lf16-capcut.faceulv.com
  • 95.101.54.241
  • 2.16.202.65
unknown

Threats

No threats detected
Process
Message
CapCut_7418125124962107397_installer.exe
checkBoxCreateShortcut status:1
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CapCut_7418125124962107397_installer.exe