File name:

4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba

Full analysis: https://app.any.run/tasks/63c486e0-a00f-4833-9c25-4bb23e3e63d0
Verdict: Malicious activity
Threats:

Gh0st RAT is a malware with advanced trojan functionality that enables attackers to establish full control over the victim’s system. The spying capabilities of Gh0st RAT made it a go-to tool for numerous criminal groups in high-profile attacks against government and corporate organizations. The most common vector of attack involving this malware begins with spam and phishing emails.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 21:14:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gh0st
rat
vmprotect
rdp
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

BB7176253AA11BBC81C2B28F7503B5B3

SHA1:

8E573CD153865A36BFD3AB96C485A6D6816583F3

SHA256:

4C065B7D5CC7D723D42EDD112EF347CA025664A97B62D40EA7621451183B02BA

SSDEEP:

49152:ZaKoXA2V5VqZMBys8KZB6j/uDGspoHc+bi3vt2NCjE2NWgwvnfKKoTCZ+gKyEYV1:ZaKr2VHqZMR8KZB6j/vHc+bilgWEqWg0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 4200)
      • svchcst.exe (PID: 2800)
      • svchcst.exe (PID: 2644)

    • GH0ST mutex has been found

      • Ghiya.exe (PID: 6004)
      • Ghiya.exe (PID: 660)
      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)
      • Ghiya.exe (PID: 668)
      • Ghiya.exe (PID: 3956)
      • svchcst.exe (PID: 2644)

    • Starts CMD.EXE for self-deleting

      • AK74.exe (PID: 1452)
      • AK74.exe (PID: 6392)

    • GH0ST has been detected

      • AK74.exe (PID: 1452)
      • AK74.exe (PID: 6392)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 3784)
      • wscript.exe (PID: 5800)

    • Changes the autorun value in the registry

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)

    • Create files in the Startup directory

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • AK47.exe (PID: 5008)
      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)
      • AK74.exe (PID: 1452)
      • Ghiya.exe (PID: 660)
      • svchcst.exe (PID: 2644)

    • Mutex name with non-standard characters

      • AK47.exe (PID: 6644)
      • AK47.exe (PID: 5008)
      • AK47.exe (PID: 4268)
      • AK47.exe (PID: 968)

    • Reads security settings of Internet Explorer

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)
      • svchcst.exe (PID: 2644)

    • Starts CMD.EXE for commands execution

      • AK74.exe (PID: 1452)
      • AK74.exe (PID: 6392)

    • Application launched itself

      • Ghiya.exe (PID: 6004)
      • Ghiya.exe (PID: 668)

    • Hides command output

      • cmd.exe (PID: 6044)
      • cmd.exe (PID: 968)

    • Creates or modifies Windows services

      • AK47.exe (PID: 5008)
      • Ghiya.exe (PID: 660)

    • Executes as Windows Service

      • Ghiya.exe (PID: 6004)
      • Ghiya.exe (PID: 668)

    • The process executes VB scripts

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 3784)
      • wscript.exe (PID: 5800)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 5800)
      • wscript.exe (PID: 3784)

    • Creates files in the driver directory

      • Ghiya.exe (PID: 660)

    • Drops a system driver (possible attempt to evade defenses)

      • Ghiya.exe (PID: 660)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6044)
      • cmd.exe (PID: 968)

    • There is functionality for taking screenshot (YARA)

      • Ghiya.exe (PID: 660)
      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)

    • There is functionality for enable RDP (YARA)

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)

    • Connects to unusual port

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)

  • INFO

    • Checks supported languages

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)
      • AK47.exe (PID: 5008)
      • AK47.exe (PID: 6644)
      • Ghiya.exe (PID: 6004)
      • AK74.exe (PID: 1452)
      • Ghiya.exe (PID: 660)
      • svchcst.exe (PID: 2644)
      • AK74.exe (PID: 6392)
      • Ghiya.exe (PID: 668)
      • AK47.exe (PID: 4268)
      • AK47.exe (PID: 968)
      • Ghiya.exe (PID: 3956)

    • Create files in a temporary directory

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)
      • svchcst.exe (PID: 2644)

    • The sample compiled with chinese language support

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)
      • AK47.exe (PID: 5008)

    • Process checks computer location settings

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)
      • svchcst.exe (PID: 2644)

    • Reads the computer name

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)
      • Ghiya.exe (PID: 6004)
      • AK47.exe (PID: 5008)
      • AK74.exe (PID: 1452)
      • Ghiya.exe (PID: 660)
      • svchcst.exe (PID: 2644)
      • AK74.exe (PID: 6392)
      • Ghiya.exe (PID: 668)

    • Autorun file from Startup directory

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)

    • Creates files or folders in the user directory

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)

    • VMProtect protector has been detected

      • 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe (PID: 5064)

    • UPX packer has been detected

      • Ghiya.exe (PID: 660)

    • Manual execution by a user

      • svchcst.exe (PID: 2800)
      • svchcst.exe (PID: 2644)

    • Checks proxy server information

      • slui.exe (PID: 7408)

    • Reads the software policy settings

      • slui.exe (PID: 7408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:03:29 14:48:39+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 3530752
InitializedDataSize: 835584
UninitializedDataSize: -
EntryPoint: 0x2dfb0a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 1.0.0.0
FileDescription: Windows 配置程序
ProductName: Windows 核心进程
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
23
Malicious processes
10
Suspicious processes
3

Behavior graph

Click at the process to see the details
start #GH0ST 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe ak47.exe no specs ak47.exe ak74.exe #GH0ST ghiya.exe no specs cmd.exe no specs #GH0ST ghiya.exe conhost.exe no specs ping.exe no specs wscript.exe no specs wscript.exe no specs svchcst.exe no specs #GH0ST svchcst.exe ak47.exe no specs ak47.exe no specs ak74.exe no specs #GH0ST ghiya.exe no specs cmd.exe no specs #GH0ST ghiya.exe no specs conhost.exe no specs ping.exe no specs slui.exe 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660C:\WINDOWS\SysWOW64\Ghiya.exe -acsiC:\Windows\SysWOW64\Ghiya.exe
Ghiya.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\windows\syswow64\ghiya.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
668C:\WINDOWS\SysWOW64\Ghiya.exe -autoC:\Windows\SysWOW64\Ghiya.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\syswow64\ghiya.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
728ping -n 2 127.0.0.1 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
968C:\Users\admin\AppData\Local\Temp\\AK47.exeC:\Users\admin\AppData\Local\Temp\AK47.exe—svchcst.exe
User:
admin
Company:
FEIM Studios
Integrity Level:
HIGH
Description:
A Free Enterprise Instant Messenger
Exit code:
0
Version:
3, 5, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\ak47.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
968C:\WINDOWS\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\admin\AppData\Local\Temp\AK74.exe > nulC:\Windows\SysWOW64\cmd.exe—AK74.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1452C:\Users\admin\AppData\Local\Temp\\AK74.exeC:\Users\admin\AppData\Local\Temp\AK74.exe
4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ak74.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2644"C:\Users\admin\AppData\Roaming\Microsoft\svchcst.exe" C:\Users\admin\AppData\Roaming\Microsoft\svchcst.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Windows 配置程序
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\svchcst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
2800"C:\Users\admin\AppData\Roaming\Microsoft\svchcst.exe" C:\Users\admin\AppData\Roaming\Microsoft\svchcst.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Windows 配置程序
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\svchcst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3784"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\VBS3.vbs" C:\Windows\SysWOW64\wscript.exe—4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3956C:\WINDOWS\SysWOW64\Ghiya.exe -acsiC:\Windows\SysWOW64\Ghiya.exe
Ghiya.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\syswow64\ghiya.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
8 877
Read events
8 855
Write events
22
Delete events
0

Modification events

(PID) Process:(5008) AK47.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é
Operation:writeName:Description
Value:
¹ÜÀí»ùÓÚ×é¼þ¶ÔÏóÄ£Ð͵ĺËÐÄ·þÎñ¡£Èç¹û·þÎñ±»½ûÓ㬼ÆËã»ú½«ÎÞ·¨Õý³£ÔËÐС£
(PID) Process:(5008) AK47.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters
Operation:writeName:ServiceDll
Value:
C:\WINDOWS\system32\1100625.txt
(PID) Process:(5008) AK47.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Svchost
Operation:writeName:Ö÷¶¯·ÀÓù·þÎñÄ£¿é
Value:
Ö÷¶¯·ÀÓù·þÎñÄ£¿é
(PID) Process:(5064) 4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CA48010000
(PID) Process:(1452) AK74.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Select
Operation:writeName:MarkTime
Value:
2025-03-24 21:14
(PID) Process:(660) Ghiya.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:Type
Value:
2
(PID) Process:(660) Ghiya.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:Start
Value:
1
(PID) Process:(660) Ghiya.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:ErrorControl
Value:
0
(PID) Process:(660) Ghiya.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:ImagePath
Value:
system32\DRIVERS\QAssist.sys
(PID) Process:(660) Ghiya.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QAssist
Operation:writeName:DisplayName
Value:
QAssist
Executable files
8
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
50644c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exeC:\Users\admin\AppData\Roaming\Microsoft\Config.initext
MD5:29CE53E2A4A446614CCC8D64D346BDE4
SHA256:56225BE6838BC6E93EA215891EACF28844AE27A9F8B2B29BF19D3A8C2B1F58DF
50644c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnkbinary
MD5:2B5656D410454452770AD1D2A7D31E96
SHA256:8CF0F72C4E7EEEDD0E2BE96ADF9FA9FD38FD546B7A9D71AF745E43F6019BD21E
50644c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exeC:\Users\admin\AppData\Local\Temp\AK74.exeexecutable
MD5:B0998AA7D5071D33DAA5B60B9C3C9735
SHA256:3080B6BB456564899B0D99D4131BD6A0B284D31F7D80EF773E4872D94048D49A
50644c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exeC:\Users\admin\AppData\Roaming\svchcst.exeexecutable
MD5:BB7176253AA11BBC81C2B28F7503B5B3
SHA256:4C065B7D5CC7D723D42EDD112EF347CA025664A97B62D40EA7621451183B02BA
50644c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exeC:\Users\admin\AppData\Roaming\Microsoft\VBS3.vbstext
MD5:088F887CB20E86A8BB069B8F4C5D0F40
SHA256:66DBE72E0F8AD54EBA1C8BF1A988B640CD7568A8663A249A0D373326EE94CAF8
660Ghiya.exeC:\Windows\System32\drivers\QAssist.sysexecutable
MD5:4E34C068E764AD0FF0CB58BC4F143197
SHA256:6CCE28B275D5EC20992BB13790976CAF434AB46DDBFD5CFD431D33424943122B
50644c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exeC:\Users\admin\AppData\Roaming\Microsoft\svchcst.exeexecutable
MD5:F296D17ACAC68EB5D140108928BDBC3A
SHA256:306BADA0CF72BD1A1762FE1941F838B9F9226B5E035E460CEECE3AED11AE0E9A
1452AK74.exeC:\Windows\SysWOW64\Ghiya.exeexecutable
MD5:B0998AA7D5071D33DAA5B60B9C3C9735
SHA256:3080B6BB456564899B0D99D4131BD6A0B284D31F7D80EF773E4872D94048D49A
2644svchcst.exeC:\Users\admin\AppData\Local\Temp\AK74.exeexecutable
MD5:B0998AA7D5071D33DAA5B60B9C3C9735
SHA256:3080B6BB456564899B0D99D4131BD6A0B284D31F7D80EF773E4872D94048D49A
50644c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exeC:\Users\admin\AppData\Local\Temp\AK47.exeexecutable
MD5:423EB994ED553294F8A6813619B8DA87
SHA256:050B4F2D5AE8EAECD414318DC8E222A56F169626DA6CA8FEB7EDD78E8B1F0218
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
156
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5064
4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba.exe
43.249.193.73:54997
—
CHINA UNICOM China169 Backbone
CN
unknown
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
2516
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
7408
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
unknown
google.com
  • 142.250.184.238
unknown
cf1549064127.f3322.net
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4c065b7d5cc7d723d42edd112ef347ca025664a97b62d40ea7621451183b02ba