File name:

ffmpeg.dll

Full analysis: https://app.any.run/tasks/839ed3e2-52e1-4996-96d5-3a2f92720942
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: February 24, 2025, 23:07:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rhadamanthys
stealer
evasion
shellcode
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections
MD5:

96DA624312BC22AE62CDE7DC17E0C1B4

SHA1:

3D24C03A79CCFC8756F8C33C0595FFE8ABEAC6EE

SHA256:

4F8C062DFA945053AA8E058B831A16201F5E07B3AF1C41FD07A7DFFBE80C84B0

SSDEEP:

98304:k74HN4sIPMjjoxKVCn7IalrLipqmhrLO1iNtfrBHAvQTp4/SEyUJT+tzay2pgmlN:Dc0Ry

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RHADAMANTHYS mutex has been found

      • aspnet_wp.exe (PID: 6796)
      • svchost.exe (PID: 6904)

    • Actions looks like stealing of personal data

      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • RHADAMANTHYS has been detected (YARA)

      • svchost.exe (PID: 7088)

    • Scans artifacts that could help determine the target

      • msedge.exe (PID: 6700)

    • Steals credentials from Web Browsers

      • msedge.exe (PID: 6700)

    • RHADAMANTHYS has been detected (SURICATA)

      • svchost.exe (PID: 7088)

  • SUSPICIOUS

    • The process checks if it is being run in the virtual environment

      • svchost.exe (PID: 6904)

    • Connects to unusual port

      • svchost.exe (PID: 6904)
      • tor.exe (PID: 7108)
      • svchost.exe (PID: 7088)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 6480)
      • wmlaunch.exe (PID: 7584)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • rundll32.exe (PID: 6480)

    • Application launched itself

      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • Reads security settings of Internet Explorer

      • msedge.exe (PID: 6700)

    • Reads Mozilla Firefox installation path

      • msedge.exe (PID: 6700)

    • Searches for installed software

      • svchost.exe (PID: 7088)

    • Loads DLL from Mozilla Firefox

      • svchost.exe (PID: 7088)

    • Executes application which crashes

      • aspnet_wp.exe (PID: 6796)

  • INFO

    • Creates files or folders in the user directory

      • rundll32.exe (PID: 6480)
      • tor.exe (PID: 7108)
      • wmlaunch.exe (PID: 7584)

    • Checks proxy server information

      • rundll32.exe (PID: 6480)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • Checks supported languages

      • aspnet_wp.exe (PID: 6796)
      • tor.exe (PID: 7108)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)
      • wmlaunch.exe (PID: 7584)

    • Manual execution by a user

      • svchost.exe (PID: 7088)
      • svchost.exe (PID: 6904)

    • Reads the machine GUID from the registry

      • tor.exe (PID: 7108)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)
      • wmlaunch.exe (PID: 7584)

    • Reads the computer name

      • tor.exe (PID: 7108)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)
      • wmlaunch.exe (PID: 7584)

    • Create files in a temporary directory

      • svchost.exe (PID: 7088)
      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • Reads Environment values

      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • Process checks computer location settings

      • chrome.exe (PID: 2796)
      • msedge.exe (PID: 6700)

    • Process checks whether UAC notifications are on

      • msedge.exe (PID: 6700)

    • Reads the software policy settings

      • rundll32.exe (PID: 6480)

    • The sample compiled with english language support

      • wmlaunch.exe (PID: 7584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:24 21:41:38+00:00
ImageFileCharacteristics: Executable, Large address aware, DLL
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 6956032
InitializedDataSize: 9451520
UninitializedDataSize: -
EntryPoint: 0xc241c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 166.155.1234.5678
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Тула Облачная Платформа — современное решение для масштабируемого развертывания и аналитики
CompanyName: Восточноевропейские Цифровые Проекты
FileDescription: Белёв
FileVersion: 166.155.1234.5678
InternalName: Белёв.dll
LegalCopyright:
OriginalFileName: Белёв.dll
ProductName: Тула Облачная Платформа
ProductVersion: 1.0.0
AssemblyVersion: 166.155.1234.5678
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
34
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe #RHADAMANTHYS aspnet_wp.exe #RHADAMANTHYS svchost.exe werfault.exe no specs #RHADAMANTHYS svchost.exe tor.exe conhost.exe no specs svchost.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmlaunch.exe dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
372"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4328 --field-trial-handle=2244,i,6926726498295738886,4705303265605965521,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
440"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1952,i,4737023876720142779,12286480253007784673,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1228"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3656 --field-trial-handle=1952,i,4737023876720142779,12286480253007784673,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2136"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2240 --field-trial-handle=2244,i,6926726498295738886,4705303265605965521,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2212"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1948 --field-trial-handle=1952,i,4737023876720142779,12286480253007784673,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2380"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\Temp\chrB058.tmp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\Temp\chrB058.tmp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff8214bdc40,0x7ff8214bdc4c,0x7ff8214bdc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2624"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\Temp\chrC24A.tmp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\Temp\chrC24A.tmp\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x294,0x298,0x29c,0x28c,0x2a4,0x7ff821945fd8,0x7ff821945fe4,0x7ff821945ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2796 --user-data-dir="C:\Users\admin\AppData\Local\Temp\chrB058.tmp" --explicitly-allowed-ports=8000 --disable-gpu --new-window "http://127.0.0.1:8000/1145be74/03a0677f"C:\Program Files\Google\Chrome\Application\chrome.exe
svchost.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2796"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5136 --field-trial-handle=2244,i,6926726498295738886,4705303265605965521,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 097
Read events
9 080
Write events
16
Delete events
1

Modification events

(PID) Process:(6796) aspnet_wp.exeKey:HKEY_CURRENT_USER\SOFTWARE\SibCode
Operation:writeName:sn3
Value:
1E5C80235F7BB569B11B62486FFFFEAC96CA3875BD53F20ABFF1C91073F05B4645487718E5392013BB2405F11453FEEC3539353092EEED39BADF8B04F1C03734
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2796) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2796) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings
Operation:delete keyName:(default)
Value:
(PID) Process:(6700) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6700) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6700) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
Executable files
13
Suspicious files
170
Text files
83
Unknown types
0

Dropped files

PID
Process
Filename
Type
6480rundll32.exeC:\Users\admin\AppData\Local\tor\tor.tar.gz —
MD5:—
SHA256:—
6480rundll32.exeC:\Users\admin\AppData\Local\tor\data\geoip —
MD5:—
SHA256:—
6480rundll32.exeC:\Users\admin\AppData\Local\tor\data\geoip6 —
MD5:—
SHA256:—
6480rundll32.exeC:\Users\admin\AppData\Local\tor\tor\pluggable_transports\pt_config.jsonbinary
MD5:C51F6F4BF9DDA946F49F71535E484933
SHA256:5C330E6C014B21A51B8183A31BD2D6C0B4A31A0BEBFEF34B4169E5BBCAF75184
6480rundll32.exeC:\Users\admin\AppData\Local\tor\tor\pluggable_transports\snowflake-client.exeexecutable
MD5:19E08354647E90E275B15993A178866A
SHA256:7A960180DD080C482C8D093E91322295B55A0E0E4D6C86C668D366BBAEFBCD8E
6480rundll32.exeC:\Users\admin\AppData\Local\tor\tor\tor-gencert.exeexecutable
MD5:09E800C9B862C2D9B7D80E3828C230D9
SHA256:C3859E3C547BF9C966385B1D2043F8FEDE4A6A69C60B0EC565C9A02D5C90D593
7108tor.exeC:\Users\admin\AppData\Roaming\tor\unverified-microdesc-consensus.tmptext
MD5:4EF5053BFF9EDE7198EB3E7BFC354A1B
SHA256:5C816A0C98F7908F288CABFA3C3DEF7B299332BCF35072CA1B6C146BB4228F25
7108tor.exeC:\Users\admin\AppData\Roaming\tor\statetext
MD5:E9D7CCD32CC559483AA229E75A178FFF
SHA256:BA27BA76FE98C5DAB38436792A219F954DEE4FD0571747C024AB2AD7A3606720
6480rundll32.exeC:\Users\admin\AppData\Local\tor\tor\pluggable_transports\lyrebird.exeexecutable
MD5:D05BC11D05587FC957679F89200FF0C0
SHA256:700E13724B8A84BA4B5284D6F5C4425E295131E07B8BEBDE63C77A128AA99071
7108tor.exeC:\Users\admin\AppData\Roaming\tor\unverified-microdesc-consensustext
MD5:4EF5053BFF9EDE7198EB3E7BFC354A1B
SHA256:5C816A0C98F7908F288CABFA3C3DEF7B299332BCF35072CA1B6C146BB4228F25
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
71
DNS requests
48
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3884
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3884
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6480
rundll32.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/45.86.203.67
unknown
—
—
whitelisted
4328
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6480
rundll32.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/45.86.203.67
unknown
—
—
whitelisted
4328
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6280
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3884
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3884
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.86.251.22:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.147
  • 23.48.23.156
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 23.219.150.101
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.bing.com
  • 184.86.251.22
  • 184.86.251.27
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
login.live.com
  • 40.126.31.1
  • 40.126.31.67
  • 40.126.31.128
  • 40.126.31.71
  • 20.190.159.128
  • 40.126.31.130
  • 40.126.31.69
  • 20.190.159.64
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 2.19.246.123
whitelisted
dist.torproject.org
  • 204.8.99.144
  • 204.8.99.146
  • 116.202.120.165
  • 116.202.120.166
whitelisted
api.ipify.org
  • 104.26.12.205
  • 172.67.74.152
  • 104.26.13.205
shared

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6480
rundll32.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6480
rundll32.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6480
rundll32.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6480
rundll32.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
7108
tor.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 273
7108
tor.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 209
7108
tor.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 288
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chrB058.tmp directory exists )
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\chrC24A.tmp directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ffmpeg.dll