File name:

ffmpeg.dll

Full analysis: https://app.any.run/tasks/839ed3e2-52e1-4996-96d5-3a2f92720942
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: February 24, 2025, 23:07:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rhadamanthys
stealer
evasion
shellcode
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections
MD5:

96DA624312BC22AE62CDE7DC17E0C1B4

SHA1:

3D24C03A79CCFC8756F8C33C0595FFE8ABEAC6EE

SHA256:

4F8C062DFA945053AA8E058B831A16201F5E07B3AF1C41FD07A7DFFBE80C84B0

SSDEEP:

98304:k74HN4sIPMjjoxKVCn7IalrLipqmhrLO1iNtfrBHAvQTp4/SEyUJT+tzay2pgmlN:Dc0Ry

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RHADAMANTHYS mutex has been found

      • aspnet_wp.exe (PID: 6796)
      • svchost.exe (PID: 6904)

    • Actions looks like stealing of personal data

      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • RHADAMANTHYS has been detected (YARA)

      • svchost.exe (PID: 7088)

    • Scans artifacts that could help determine the target

      • msedge.exe (PID: 6700)

    • RHADAMANTHYS has been detected (SURICATA)

      • svchost.exe (PID: 7088)

    • Steals credentials from Web Browsers

      • msedge.exe (PID: 6700)

  • SUSPICIOUS

    • Executes application which crashes

      • aspnet_wp.exe (PID: 6796)

    • The process checks if it is being run in the virtual environment

      • svchost.exe (PID: 6904)

    • Connects to unusual port

      • svchost.exe (PID: 6904)
      • tor.exe (PID: 7108)
      • svchost.exe (PID: 7088)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 6480)
      • wmlaunch.exe (PID: 7584)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • rundll32.exe (PID: 6480)

    • Reads security settings of Internet Explorer

      • msedge.exe (PID: 6700)

    • Application launched itself

      • msedge.exe (PID: 6700)
      • chrome.exe (PID: 2796)

    • Reads Mozilla Firefox installation path

      • msedge.exe (PID: 6700)

    • Searches for installed software

      • svchost.exe (PID: 7088)

    • Loads DLL from Mozilla Firefox

      • svchost.exe (PID: 7088)

  • INFO

    • Creates files or folders in the user directory

      • rundll32.exe (PID: 6480)
      • tor.exe (PID: 7108)
      • wmlaunch.exe (PID: 7584)

    • Checks supported languages

      • aspnet_wp.exe (PID: 6796)
      • tor.exe (PID: 7108)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)
      • wmlaunch.exe (PID: 7584)

    • Checks proxy server information

      • rundll32.exe (PID: 6480)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • Reads the software policy settings

      • rundll32.exe (PID: 6480)

    • Manual execution by a user

      • svchost.exe (PID: 6904)
      • svchost.exe (PID: 7088)

    • Reads the machine GUID from the registry

      • tor.exe (PID: 7108)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)
      • wmlaunch.exe (PID: 7584)

    • Reads the computer name

      • tor.exe (PID: 7108)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)
      • wmlaunch.exe (PID: 7584)

    • Create files in a temporary directory

      • svchost.exe (PID: 7088)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • Reads Environment values

      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • Process checks computer location settings

      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • Process checks whether UAC notifications are on

      • msedge.exe (PID: 6700)

    • The sample compiled with english language support

      • wmlaunch.exe (PID: 7584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:24 21:41:38+00:00
ImageFileCharacteristics: Executable, Large address aware, DLL
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 6956032
InitializedDataSize: 9451520
UninitializedDataSize: -
EntryPoint: 0xc241c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 166.155.1234.5678
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Тула Облачная Платформа — современное решение для масштабируемого развертывания и аналитики
CompanyName: Восточноевропейские Цифровые Проекты
FileDescription: Белёв
FileVersion: 166.155.1234.5678
InternalName: Белёв.dll
LegalCopyright:
OriginalFileName: Белёв.dll
ProductName: Тула Облачная Платформа
ProductVersion: 1.0.0
AssemblyVersion: 166.155.1234.5678
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
34
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe #RHADAMANTHYS aspnet_wp.exe #RHADAMANTHYS svchost.exe werfault.exe no specs #RHADAMANTHYS svchost.exe tor.exe conhost.exe no specs svchost.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmlaunch.exe dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
372"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4328 --field-trial-handle=2244,i,6926726498295738886,4705303265605965521,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
440"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1952,i,4737023876720142779,12286480253007784673,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1228"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3656 --field-trial-handle=1952,i,4737023876720142779,12286480253007784673,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2136"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2240 --field-trial-handle=2244,i,6926726498295738886,4705303265605965521,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2212"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1948 --field-trial-handle=1952,i,4737023876720142779,12286480253007784673,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2380"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\Temp\chrB058.tmp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\Temp\chrB058.tmp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff8214bdc40,0x7ff8214bdc4c,0x7ff8214bdc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2624"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\Temp\chrC24A.tmp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\Temp\chrC24A.tmp\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x294,0x298,0x29c,0x28c,0x2a4,0x7ff821945fd8,0x7ff821945fe4,0x7ff821945ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2796 --user-data-dir="C:\Users\admin\AppData\Local\Temp\chrB058.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/1145be74/03a0677f"C:\Program Files\Google\Chrome\Application\chrome.exe
svchost.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2796"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5136 --field-trial-handle=2244,i,6926726498295738886,4705303265605965521,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 097
Read events
9 080
Write events
16
Delete events
1

Modification events

(PID) Process:(6796) aspnet_wp.exeKey:HKEY_CURRENT_USER\SOFTWARE\SibCode
Operation:writeName:sn3
Value:
1E5C80235F7BB569B11B62486FFFFEAC96CA3875BD53F20ABFF1C91073F05B4645487718E5392013BB2405F11453FEEC3539353092EEED39BADF8B04F1C03734
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2796) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings
Operation:delete keyName:(default)
Value:
(PID) Process:(6700) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6700) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6700) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
Executable files
13
Suspicious files
170
Text files
83
Unknown types
0

Dropped files

PID
Process
Filename
Type
6480rundll32.exeC:\Users\admin\AppData\Local\tor\tor.tar.gz —
MD5:—
SHA256:—
6480rundll32.exeC:\Users\admin\AppData\Local\tor\data\geoip —
MD5:—
SHA256:—
6480rundll32.exeC:\Users\admin\AppData\Local\tor\data\geoip6 —
MD5:—
SHA256:—
6480rundll32.exeC:\Users\admin\AppData\Local\tor\tor\pluggable_transports\README.CONJURE.mdtext
MD5:E8A0ED61E606D9BE2895B78220F657DD
SHA256:653AD671BB58B2E3C6570B2C27228AD84B5A116FC62994E75EE6E16CB80F4AF7
6480rundll32.exeC:\Users\admin\AppData\Local\tor\torrctext
MD5:57B4F27FFB9C017A8BDF81C109179082
SHA256:15DBCAC432065E5CC1636EB84949097B5B0FF578286043786C5463663867E863
7108tor.exeC:\Users\admin\AppData\Roaming\tor\state.tmptext
MD5:E9D7CCD32CC559483AA229E75A178FFF
SHA256:BA27BA76FE98C5DAB38436792A219F954DEE4FD0571747C024AB2AD7A3606720
2796chrome.exeC:\Users\admin\AppData\Local\Temp\chrB058.tmp\Crashpad\settings.datbinary
MD5:450D56E0E003D130D41659642EF6E5E5
SHA256:0DA82E8EF2BB747C05ACEB8B15FD794203275A6AB2FBB61D4EE459849FB2566E
7108tor.exeC:\Users\admin\AppData\Roaming\tor\cached-microdesc-consensus.tmptext
MD5:4EF5053BFF9EDE7198EB3E7BFC354A1B
SHA256:5C816A0C98F7908F288CABFA3C3DEF7B299332BCF35072CA1B6C146BB4228F25
7108tor.exeC:\Users\admin\AppData\Roaming\tor\cached-microdescs.newtext
MD5:A8F464AF0C51EE7618575EAAD53FB293
SHA256:F4761999DF29CEAE81C0300DCC8DAF314181F0B47A3BF1868C6DA51BC6D35D59
7108tor.exeC:\Users\admin\AppData\Roaming\tor\cached-microdesc-consensustext
MD5:4EF5053BFF9EDE7198EB3E7BFC354A1B
SHA256:5C816A0C98F7908F288CABFA3C3DEF7B299332BCF35072CA1B6C146BB4228F25
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
71
DNS requests
48
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3884
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3884
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6480
rundll32.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/45.86.203.67
unknown
—
—
whitelisted
6480
rundll32.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/45.86.203.67
unknown
—
—
whitelisted
6280
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4328
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3884
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3884
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.86.251.22:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.147
  • 23.48.23.156
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 23.219.150.101
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.bing.com
  • 184.86.251.22
  • 184.86.251.27
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
login.live.com
  • 40.126.31.1
  • 40.126.31.67
  • 40.126.31.128
  • 40.126.31.71
  • 20.190.159.128
  • 40.126.31.130
  • 40.126.31.69
  • 20.190.159.64
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 2.19.246.123
whitelisted
dist.torproject.org
  • 204.8.99.144
  • 204.8.99.146
  • 116.202.120.165
  • 116.202.120.166
whitelisted
api.ipify.org
  • 104.26.12.205
  • 172.67.74.152
  • 104.26.13.205
shared

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6480
rundll32.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6480
rundll32.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6480
rundll32.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6480
rundll32.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
7108
tor.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 273
7108
tor.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 209
7108
tor.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 288
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chrB058.tmp directory exists )
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chrC24A.tmp directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ffmpeg.dll