File name:

VNC-5.0.6-Windows.exe

Full analysis: https://app.any.run/tasks/9324517b-dad6-47b2-b534-7b7ea2ed4af2
Verdict: Malicious activity
Analysis date: June 30, 2024, 03:33:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A55FDE0C7B8178246C200F80DE36CFBF

SHA1:

91161A1967CCD07C25A16975C672639AC9017C34

SHA256:

500D6EB4F5FF7D86BDFD2AE20BF05738DB6B1B3C52FEDD354DF27CD3DA178D75

SSDEEP:

98304:OInpCxa1t0vmFoNtv34IxltirRqbvHKS51pYTN0a08nPmCqkZo8UPrl/2zXqieb4:Ju7o+qC4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VNC-5.0.6-Windows.exe (PID: 1276)
      • VNC-5.0.6-Windows.tmp (PID: 884)
      • VNC-5.0.6-Windows.exe (PID: 2060)
      • VNC-Viewer-5.0.6-Windows.tmp (PID: 4796)
      • VNC-Viewer-5.0.6-Windows.exe (PID: 4380)
      • vnc-printer-1_8_0-x86_x64_win32.exe (PID: 2560)
      • vnc-printer-1_8_0-x86_x64_win32.tmp (PID: 5100)
      • printerinst.exe (PID: 5484)

    • Creates a writable file in the system directory

      • printerinst.exe (PID: 5484)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • VNC-5.0.6-Windows.exe (PID: 1276)
      • VNC-5.0.6-Windows.exe (PID: 2060)
      • VNC-5.0.6-Windows.tmp (PID: 884)
      • VNC-Viewer-5.0.6-Windows.exe (PID: 4380)
      • VNC-Viewer-5.0.6-Windows.tmp (PID: 4796)
      • vnc-printer-1_8_0-x86_x64_win32.exe (PID: 2560)
      • vnc-printer-1_8_0-x86_x64_win32.tmp (PID: 5100)
      • printerinst.exe (PID: 5484)

    • Reads the date of Windows installation

      • VNC-5.0.6-Windows.tmp (PID: 3180)

    • Reads security settings of Internet Explorer

      • VNC-5.0.6-Windows.tmp (PID: 3180)

    • Reads the Windows owner or organization settings

      • VNC-5.0.6-Windows.tmp (PID: 884)
      • VNC-Viewer-5.0.6-Windows.tmp (PID: 4796)
      • vnc-printer-1_8_0-x86_x64_win32.tmp (PID: 5100)

    • Process drops legitimate windows executable

      • VNC-5.0.6-Windows.tmp (PID: 884)
      • VNC-Viewer-5.0.6-Windows.tmp (PID: 4796)
      • vnc-printer-1_8_0-x86_x64_win32.tmp (PID: 5100)
      • printerinst.exe (PID: 5484)

    • Searches for installed software

      • VNC-5.0.6-Windows.tmp (PID: 884)

    • Executes as Windows Service

      • vncserver.exe (PID: 5864)

    • Application launched itself

      • vncserver.exe (PID: 5864)
      • vncserver.exe (PID: 2452)

  • INFO

    • Checks supported languages

      • VNC-5.0.6-Windows.exe (PID: 1276)
      • VNC-5.0.6-Windows.exe (PID: 2060)
      • VNC-5.0.6-Windows.tmp (PID: 884)
      • vnclicensewiz64.exe (PID: 2764)
      • VNC-Viewer-5.0.6-Windows.tmp (PID: 4796)
      • VNC-Viewer-5.0.6-Windows.exe (PID: 4380)
      • vnc-printer-1_8_0-x86_x64_win32.exe (PID: 2560)
      • vnc-printer-1_8_0-x86_x64_win32.tmp (PID: 5100)
      • printerinst.exe (PID: 5484)
      • VNC-5.0.6-Windows.tmp (PID: 3180)
      • vncserver.exe (PID: 2300)
      • vncserver.exe (PID: 4020)
      • vncserver.exe (PID: 4104)
      • vncserver.exe (PID: 2252)
      • vncserver.exe (PID: 5864)
      • vncserver.exe (PID: 5968)
      • vncserver.exe (PID: 8)
      • vncserver.exe (PID: 2452)
      • vncserver.exe (PID: 5132)
      • vnclicensewiz.exe (PID: 5952)

    • Create files in a temporary directory

      • VNC-5.0.6-Windows.exe (PID: 1276)
      • VNC-5.0.6-Windows.exe (PID: 2060)
      • VNC-5.0.6-Windows.tmp (PID: 884)
      • VNC-Viewer-5.0.6-Windows.exe (PID: 4380)
      • VNC-Viewer-5.0.6-Windows.tmp (PID: 4796)
      • vnc-printer-1_8_0-x86_x64_win32.exe (PID: 2560)
      • vnc-printer-1_8_0-x86_x64_win32.tmp (PID: 5100)

    • Reads the computer name

      • VNC-5.0.6-Windows.tmp (PID: 3180)
      • VNC-5.0.6-Windows.tmp (PID: 884)
      • vnc-printer-1_8_0-x86_x64_win32.tmp (PID: 5100)
      • printerinst.exe (PID: 5484)
      • vncserver.exe (PID: 2300)
      • vncserver.exe (PID: 4020)
      • vncserver.exe (PID: 2252)
      • vncserver.exe (PID: 5864)
      • vncserver.exe (PID: 5968)
      • vncserver.exe (PID: 2452)
      • vncserver.exe (PID: 5132)
      • vnclicensewiz.exe (PID: 5952)
      • VNC-Viewer-5.0.6-Windows.tmp (PID: 4796)
      • vncserver.exe (PID: 8)
      • vncserver.exe (PID: 4104)

    • Process checks computer location settings

      • VNC-5.0.6-Windows.tmp (PID: 3180)

    • Creates files in the program directory

      • VNC-5.0.6-Windows.tmp (PID: 884)
      • VNC-Viewer-5.0.6-Windows.tmp (PID: 4796)
      • vnc-printer-1_8_0-x86_x64_win32.tmp (PID: 5100)

    • Creates a software uninstall entry

      • VNC-Viewer-5.0.6-Windows.tmp (PID: 4796)
      • VNC-5.0.6-Windows.tmp (PID: 884)
      • vnc-printer-1_8_0-x86_x64_win32.tmp (PID: 5100)

    • Reads the machine GUID from the registry

      • vncserver.exe (PID: 2300)
      • vncserver.exe (PID: 5864)
      • vncserver.exe (PID: 2452)

    • Reads CPU info

      • vncserver.exe (PID: 2452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0x9c40
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: RealVNC Ltd
FileDescription: VNC® Setup
FileVersion:
LegalCopyright: Copyright © 2002-2013 RealVNC Ltd.
ProductName: VNC Server
ProductVersion: 5.0.6
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
29
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
start vnc-5.0.6-windows.exe vnc-5.0.6-windows.tmp no specs vnc-5.0.6-windows.exe vnc-5.0.6-windows.tmp vnclicensewiz64.exe no specs vnc-viewer-5.0.6-windows.exe vnc-viewer-5.0.6-windows.tmp vnc-printer-1_8_0-x86_x64_win32.exe vnc-printer-1_8_0-x86_x64_win32.tmp printerinst.exe conhost.exe no specs vncserver.exe no specs conhost.exe no specs vncserver.exe no specs conhost.exe no specs vncserver.exe no specs conhost.exe no specs vncserver.exe no specs conhost.exe no specs vncserver.exe no specs conhost.exe no specs vncserver.exe no specs conhost.exe no specs vncserver.exe no specs vncserver.exe no specs conhost.exe no specs vncserver.exe no specs conhost.exe no specs vnclicensewiz.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
8"C:\Program Files\RealVNC\VNC Server\vncserver.exe" -stopC:\Program Files\RealVNC\VNC Server\vncserver.exe—VNC-5.0.6-Windows.tmp
User:
admin
Company:
RealVNC Ltd
Integrity Level:
HIGH
Description:
VNC® Server
Exit code:
0
Version:
5.0.6 (r113416)
Modules
Images
c:\program files\realvnc\vnc server\vncserver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
884"C:\Users\admin\AppData\Local\Temp\is-E0PRM.tmp\VNC-5.0.6-Windows.tmp" /SL5="$170292,6930355,54272,C:\Users\admin\AppData\Local\Temp\VNC-5.0.6-Windows.exe" /SPAWNWND=$502AC /NOTIFYWND=$80040 C:\Users\admin\AppData\Local\Temp\is-E0PRM.tmp\VNC-5.0.6-Windows.tmp
VNC-5.0.6-Windows.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-e0prm.tmp\vnc-5.0.6-windows.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1276"C:\Users\admin\AppData\Local\Temp\VNC-5.0.6-Windows.exe" C:\Users\admin\AppData\Local\Temp\VNC-5.0.6-Windows.exe
explorer.exe
User:
admin
Company:
RealVNC Ltd
Integrity Level:
MEDIUM
Description:
VNC® Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\vnc-5.0.6-windows.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1428\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vncserver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2060"C:\Users\admin\AppData\Local\Temp\VNC-5.0.6-Windows.exe" /SPAWNWND=$502AC /NOTIFYWND=$80040 C:\Users\admin\AppData\Local\Temp\VNC-5.0.6-Windows.exe
VNC-5.0.6-Windows.tmp
User:
admin
Company:
RealVNC Ltd
Integrity Level:
HIGH
Description:
VNC® Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\vnc-5.0.6-windows.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2252"C:\Program Files\RealVNC\VNC Server\vncserver.exe" -start -showstatusC:\Program Files\RealVNC\VNC Server\vncserver.exe—VNC-5.0.6-Windows.tmp
User:
admin
Company:
RealVNC Ltd
Integrity Level:
HIGH
Description:
VNC® Server
Exit code:
0
Version:
5.0.6 (r113416)
Modules
Images
c:\program files\realvnc\vnc server\vncserver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2300"C:\Program Files\RealVNC\VNC Server\vncserver.exe" -service -noconsole -generatekeysC:\Program Files\RealVNC\VNC Server\vncserver.exe—VNC-5.0.6-Windows.tmp
User:
admin
Company:
RealVNC Ltd
Integrity Level:
HIGH
Description:
VNC® Server
Exit code:
0
Version:
5.0.6 (r113416)
Modules
Images
c:\program files\realvnc\vnc server\vncserver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vncserver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2452"C:\Program Files\RealVNC\VNC Server\vncserver.exe" -service -noconsole -slave 127.0.0.1::49736 -1062056510C:\Program Files\RealVNC\VNC Server\vncserver.exe—vncserver.exe
User:
SYSTEM
Company:
RealVNC Ltd
Integrity Level:
SYSTEM
Description:
VNC® Server
Version:
5.0.6 (r113416)
Modules
Images
c:\program files\realvnc\vnc server\vncserver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2560"C:\Program Files\RealVNC\VNC Server\vnc-printer-1_8_0-x86_x64_win32.exe" /DIR="C:\Program Files\RealVNC\VNC Server\Printer Driver" /SP- /VERYSILENT /NORESTART /RESTARTEXITCODE=32123C:\Program Files\RealVNC\VNC Server\vnc-printer-1_8_0-x86_x64_win32.exe
VNC-5.0.6-Windows.tmp
User:
admin
Company:
RealVNC Ltd.
Integrity Level:
HIGH
Description:
VNC® Printer Driver Setup
Exit code:
0
Version:
Modules
Images
c:\program files\realvnc\vnc server\vnc-printer-1_8_0-x86_x64_win32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
9 293
Read events
9 214
Write events
79
Delete events
0

Modification events

(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.4.2 (a)
(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\RealVNC\VNC Viewer
(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\RealVNC\VNC Viewer\
(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:Inno Setup: Icon Group
Value:
RealVNC
(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
desktopicon,quicklaunchicon
(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:Inno Setup: Language
Value:
default
(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:DisplayName
Value:
VNC Viewer 5.0.6
(PID) Process:(4796) VNC-Viewer-5.0.6-Windows.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealVNCViewer_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\RealVNC\VNC Viewer\VNCViewer.exe,0
Executable files
73
Suspicious files
16
Text files
24
Unknown types
0

Dropped files

PID
Process
Filename
Type
884VNC-5.0.6-Windows.tmpC:\Users\admin\AppData\Local\Temp\is-BD5R2.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
884VNC-5.0.6-Windows.tmpC:\Program Files\RealVNC\VNC Server\saslib.dllexecutable
MD5:E967D7C16733BADCC1727B64265E52A4
SHA256:F48629A8BACB778719E27554CD790DABAB7D1940F4B9CFD77ACE1B93BAD0CDC2
884VNC-5.0.6-Windows.tmpC:\Program Files\RealVNC\VNC Server\is-O0RQI.tmpexecutable
MD5:A7AA51017D4FB08EFA75F01CCEED482E
SHA256:53A9A2195DC879920775EBC6F8809EC90F86D7B4F288E71B20921FD11B040882
884VNC-5.0.6-Windows.tmpC:\Users\admin\AppData\Local\Temp\is-BD5R2.tmp\vnclicensewiz64.exeexecutable
MD5:6848A00F66709BE7C72353C99E625725
SHA256:0038E168F30CE5896DE4984E8AEBBAA55B63E7E1DEB03B8C2A6B2251590CF22F
884VNC-5.0.6-Windows.tmpC:\Program Files\RealVNC\VNC Server\desktop_dupl.dllexecutable
MD5:1B932AEE21660AD1BC10362500735818
SHA256:431896022AD8E3BFF03B4638EDA1CACC29E2091517333ECA1FE513A7D0EE0DA6
884VNC-5.0.6-Windows.tmpC:\Program Files\RealVNC\VNC Server\is-6KMLS.tmpexecutable
MD5:E967D7C16733BADCC1727B64265E52A4
SHA256:F48629A8BACB778719E27554CD790DABAB7D1940F4B9CFD77ACE1B93BAD0CDC2
884VNC-5.0.6-Windows.tmpC:\Program Files\RealVNC\VNC Server\vncconfig.exeexecutable
MD5:105208443AF6C4611BF13583B87D6FE0
SHA256:47E978ADD0D0050480E7DF67EABC107FDEA68B32C033550C474CA958C47388EF
1276VNC-5.0.6-Windows.exeC:\Users\admin\AppData\Local\Temp\is-S14F2.tmp\VNC-5.0.6-Windows.tmpexecutable
MD5:C765336F0DCF4EFDCC2101EED67CD30C
SHA256:C5177FDC6031728E10141745CD69EDBC91C92D14411A2DEC6E8E8CAA4F74AB28
884VNC-5.0.6-Windows.tmpC:\Program Files\RealVNC\VNC Server\is-G57UP.tmpexecutable
MD5:105208443AF6C4611BF13583B87D6FE0
SHA256:47E978ADD0D0050480E7DF67EABC107FDEA68B32C033550C474CA958C47388EF
2060VNC-5.0.6-Windows.exeC:\Users\admin\AppData\Local\Temp\is-E0PRM.tmp\VNC-5.0.6-Windows.tmpexecutable
MD5:C765336F0DCF4EFDCC2101EED67CD30C
SHA256:C5177FDC6031728E10141745CD69EDBC91C92D14411A2DEC6E8E8CAA4F74AB28
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
59
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2064
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
5440
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
2660
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
5440
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2480
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2272
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1544
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
1060
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
20.189.173.6:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3040
OfficeClickToRun.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
2064
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.22
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.133
  • 40.126.32.140
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
self.events.data.microsoft.com
  • 20.189.173.6
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
www.bing.com
  • 23.53.43.121
  • 23.53.43.115
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VNC-5.0.6-Windows.exe