URL:

https://drive.google.com/file/d/1-Q4vTbvqAzl764E6YiUeUquiqfHwfMoY/view?usp=sharing

Full analysis: https://app.any.run/tasks/d72063a1-fe0b-4e30-854c-65e24e86f6e4
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: August 06, 2024, 07:46:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
keylogger
Indicators:
MD5:

AD17F033FD5792BB77E607ADE72C37B8

SHA1:

E780688CFB70CC06E9A8305C8306D290BDA30AD5

SHA256:

5B2FAD94B7E48D88A9D3A038C8A7715483B263B02745EC39B86A675909528DE5

SSDEEP:

3:N8PMMtZJuloP9ETGTd/Zm8TkGZC:2AKhdYGZC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 3672)
      • findstr.exe (PID: 7360)

    • Drops the executable file immediately after the start

      • cmd.exe (PID: 6540)
      • Smithsonian.pif (PID: 3720)

    • Create files in the Startup directory

      • cmd.exe (PID: 3908)

    • REMCOS has been detected

      • Smithsonian.pif (PID: 3720)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 6540)
      • Smithsonian.pif (PID: 3720)

    • Reads security settings of Internet Explorer

      • Офіційний запит 398м24-7, № 399м24-7 .pdf.exe (PID: 2472)

    • Reads the date of Windows installation

      • Офіційний запит 398м24-7, № 399м24-7 .pdf.exe (PID: 2472)

    • Starts CMD.EXE for commands execution

      • Офіційний запит 398м24-7, № 399м24-7 .pdf.exe (PID: 2472)
      • cmd.exe (PID: 6540)

    • Get information on the list of running processes

      • cmd.exe (PID: 6540)

    • Application launched itself

      • cmd.exe (PID: 6540)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6540)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 6540)
      • Smithsonian.pif (PID: 3720)

    • Suspicious file concatenation

      • cmd.exe (PID: 7912)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6540)

    • The executable file from the user directory is run by the CMD process

      • Smithsonian.pif (PID: 3720)

    • Writes files like Keylogger logs

      • Smithsonian.pif (PID: 3720)

    • Connects to unusual port

      • Smithsonian.pif (PID: 3720)

    • Executing commands from ".cmd" file

      • Офіційний запит 398м24-7, № 399м24-7 .pdf.exe (PID: 2472)

  • INFO

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6280)

    • Checks supported languages

      • identity_helper.exe (PID: 3900)
      • Офіційний запит 398м24-7, № 399м24-7 .pdf.exe (PID: 2472)
      • Smithsonian.pif (PID: 3720)

    • The process uses the downloaded file

      • msedge.exe (PID: 7244)
      • WinRAR.exe (PID: 6124)

    • Reads the computer name

      • identity_helper.exe (PID: 3900)
      • Офіційний запит 398м24-7, № 399м24-7 .pdf.exe (PID: 2472)
      • Smithsonian.pif (PID: 3720)

    • Manual execution by a user

      • WinRAR.exe (PID: 6124)
      • WinRAR.exe (PID: 5104)
      • WinRAR.exe (PID: 3044)
      • WinRAR.exe (PID: 7828)
      • WinRAR.exe (PID: 5600)
      • WinRAR.exe (PID: 640)
      • Офіційний запит 398м24-7, № 399м24-7 .pdf.exe (PID: 2472)
      • cmd.exe (PID: 3908)

    • Reads Environment values

      • identity_helper.exe (PID: 3900)
      • Smithsonian.pif (PID: 3720)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 7828)
      • WinRAR.exe (PID: 3044)
      • WinRAR.exe (PID: 5600)
      • WinRAR.exe (PID: 640)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7828)
      • WinRAR.exe (PID: 3044)
      • WinRAR.exe (PID: 5600)
      • WinRAR.exe (PID: 640)

    • Application launched itself

      • msedge.exe (PID: 6280)

    • Create files in a temporary directory

      • Офіційний запит 398м24-7, № 399м24-7 .pdf.exe (PID: 2472)

    • Process checks computer location settings

      • Офіційний запит 398м24-7, № 399м24-7 .pdf.exe (PID: 2472)

    • Reads mouse settings

      • Smithsonian.pif (PID: 3720)

    • Creates files or folders in the user directory

      • Smithsonian.pif (PID: 3720)

    • Creates files in the program directory

      • Smithsonian.pif (PID: 3720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
63
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs winrar.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe msedge.exe no specs msedge.exe no specs winrar.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe winrar.exe офіційний запит 398м24-7, № 399м24-7             .pdf.exe cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs #REMCOS smithsonian.pif choice.exe no specs cmd.exe conhost.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Офіційний запит 398м24-7, № 399м24-7.part4.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1556"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6660 --field-trial-handle=2324,i,10052731566506525392,7205891021624188558,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1688"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6664 --field-trial-handle=2324,i,10052731566506525392,7205891021624188558,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2384"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5500 --field-trial-handle=2324,i,10052731566506525392,7205891021624188558,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2472"C:\Users\admin\Desktop\Офіційний запит 398м24-7, № 399м24-7 .pdf.exe" C:\Users\admin\Desktop\Офіційний запит 398м24-7, № 399м24-7 .pdf.exe
explorer.exe
User:
admin
Company:
TradeOptimize Dynamics
Integrity Level:
HIGH
Description:
Optimizes supply chain and logistics processes for efficient trade operations.
Exit code:
0
Version:
8.105.6.2898
Modules
Images
c:\users\admin\desktop\офіційний запит 398м24-7, № 399м24-7 .pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2476"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5492 --field-trial-handle=2324,i,10052731566506525392,7205891021624188558,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3008"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6808 --field-trial-handle=2324,i,10052731566506525392,7205891021624188558,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3044"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Офіційний запит 398м24-7, № 399м24-7.part2.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
32 761
Read events
32 540
Write events
218
Delete events
3

Modification events

(PID) Process:(6280) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6280) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6280) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6280) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6280) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6280) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(6280) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6280) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(6280) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6280) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
Executable files
7
Suspicious files
152
Text files
80
Unknown types
5

Dropped files

PID
Process
Filename
Type
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe5119.TMP —
MD5:—
SHA256:—
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RFe5119.TMP —
MD5:—
SHA256:—
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFe5119.TMP —
MD5:—
SHA256:—
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe5129.TMP —
MD5:—
SHA256:—
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFe5138.TMP —
MD5:—
SHA256:—
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6280msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
291
DNS requests
113
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2272
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2272
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7356
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
8168
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1723482621&P2=404&P3=2&P4=jWly19%2bknjSmA3BTukPLezzZvaxy076WwGU%2bvCGDg9Edou16Jqx22Bv4f07Wnhmpy03KbWCxomj3DzYgvHB53A%3d%3d
unknown
—
—
whitelisted
7380
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
8168
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1723482621&P2=404&P3=2&P4=jWly19%2bknjSmA3BTukPLezzZvaxy076WwGU%2bvCGDg9Edou16Jqx22Bv4f07Wnhmpy03KbWCxomj3DzYgvHB53A%3d%3d
unknown
—
—
whitelisted
8168
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1723482621&P2=404&P3=2&P4=jWly19%2bknjSmA3BTukPLezzZvaxy076WwGU%2bvCGDg9Edou16Jqx22Bv4f07Wnhmpy03KbWCxomj3DzYgvHB53A%3d%3d
unknown
—
—
whitelisted
8168
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1723482621&P2=404&P3=2&P4=jWly19%2bknjSmA3BTukPLezzZvaxy076WwGU%2bvCGDg9Edou16Jqx22Bv4f07Wnhmpy03KbWCxomj3DzYgvHB53A%3d%3d
unknown
—
—
whitelisted
8168
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8bc315ba-54e5-49f4-9b75-997d7071eb06?P1=1723482621&P2=404&P3=2&P4=jWly19%2bknjSmA3BTukPLezzZvaxy076WwGU%2bvCGDg9Edou16Jqx22Bv4f07Wnhmpy03KbWCxomj3DzYgvHB53A%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5796
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
876
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6628
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6628
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6628
msedge.exe
216.58.212.174:443
drive.google.com
GOOGLE
US
whitelisted
6628
msedge.exe
13.107.246.60:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6628
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
drive.google.com
  • 216.58.212.174
shared
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.60
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 23.48.23.26
  • 23.48.23.51
  • 2.19.126.145
  • 2.19.126.152
whitelisted
fonts.googleapis.com
  • 142.250.186.42
whitelisted
www.gstatic.com
  • 216.58.206.67
whitelisted
www.bing.com
  • 95.100.146.18
  • 95.100.146.19
  • 95.100.146.11
  • 95.100.146.10
  • 95.100.146.35
  • 95.100.146.32
  • 95.100.146.33
  • 95.100.146.27
  • 95.100.146.25
  • 95.100.146.40
  • 2.23.209.179
  • 2.23.209.176
  • 2.23.209.166
  • 2.23.209.171
  • 2.23.209.167
  • 2.23.209.175
  • 2.23.209.177
  • 2.23.209.168
  • 2.23.209.178
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://drive.google.com/file/d/1-Q4vTbvqAzl764E6YiUeUquiqfHwfMoY/view?usp=sharing