File name:

Zagreus Builder.exe

Full analysis: https://app.any.run/tasks/94a09bb2-498b-459a-b70e-8b15dba42736
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 15:33:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
stealer
telegram
confuser
neshta
discordgrabber
generic
ims-api
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

88CD6943FC236ACFD406B339FFACBE46

SHA1:

0F736349C4FD9189F9235AA38B064838FF283636

SHA256:

5E0F46628ECEC878ED244BCCEAA2981B947DB254CF34DFC0B7F4A8D5C211A842

SSDEEP:

49152:oUpLxivo6RKPQS6r7vwNYR8nU/NX+dwZPVqXPbVwuDk/kTsxPSc1lLr2f29UNlkL:6rRyQJnoNYR8eNuWPIPSuDNTZ2N8GP20

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NESHTA mutex has been found

      • ZagreuS Builder.exe (PID: 6048)

    • Actions looks like stealing of personal data

      • Cicada.exe (PID: 6108)
      • ZagreuS Builder.exe (PID: 6048)

    • DISCORDGRABBER has been detected (YARA)

      • Cicada.exe (PID: 6108)

    • Executing a file with an untrusted certificate

      • FileCoAuth.exe (PID: 7664)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Zagreus Builder.exe (PID: 4108)
      • ZagreuS Builder.exe (PID: 6048)

    • Reads the date of Windows installation

      • Zagreus Builder.exe (PID: 4108)

    • Reads security settings of Internet Explorer

      • Zagreus Builder.exe (PID: 4108)
      • ZagreuS Builder.exe (PID: 6048)

    • Mutex name with non-standard characters

      • ZagreuS Builder.exe (PID: 6048)

    • Write to the desktop.ini file (may be used to cloak folders)

      • Cicada.exe (PID: 6108)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Cicada.exe (PID: 6108)

    • Checks for external IP

      • Cicada.exe (PID: 6108)
      • svchost.exe (PID: 2196)

    • There is functionality for taking screenshot (YARA)

      • ZagreuS Builder.exe (PID: 6048)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Cicada.exe (PID: 6108)

    • Starts a Microsoft application from unusual location

      • FileCoAuth.exe (PID: 7664)

  • INFO

    • Checks supported languages

      • Zagreus Builder.exe (PID: 4108)
      • ZagreuS Builder.exe (PID: 6048)
      • ZagreuS Builder.exe (PID: 5936)
      • Cicada.exe (PID: 6108)

    • Reads the machine GUID from the registry

      • Zagreus Builder.exe (PID: 4108)
      • ZagreuS Builder.exe (PID: 5936)
      • Cicada.exe (PID: 6108)

    • Reads the computer name

      • Zagreus Builder.exe (PID: 4108)
      • ZagreuS Builder.exe (PID: 6048)
      • ZagreuS Builder.exe (PID: 5936)

    • Process checks computer location settings

      • Zagreus Builder.exe (PID: 4108)
      • ZagreuS Builder.exe (PID: 6048)

    • Creates files in the program directory

      • Cicada.exe (PID: 6108)

    • Disables trace logs

      • Cicada.exe (PID: 6108)

    • Reads the software policy settings

      • Cicada.exe (PID: 6108)

    • Create files in a temporary directory

      • Cicada.exe (PID: 6108)

    • Reads CPU info

      • Cicada.exe (PID: 6108)

    • Checks proxy server information

      • Cicada.exe (PID: 6108)

    • Confuser has been detected (YARA)

      • Cicada.exe (PID: 6108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(6108) Cicada.exe
Telegram-Tokens (1)7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
Telegram-Info-Links
7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
Get info about bothttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/getMe
Get incoming updateshttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/getUpdates
Get webhookhttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
End-PointsendDocument
Args
chat_id (1)6068287209
caption (1)==== RL STEALER ==== ⏰ Date => 03/24/2025 3:33 💻System => Windows 10 Pro (64 Bit) 👤 User =%3
Token7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
End-PointsendDocument
Args
Token7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
End-PointsendDocument
Args
chat_id (1)6068287209
caption (1)==== RL STEALER ==== ⏰ Date => 03/24/2025 3:33 💻System => Windows 10 Pro (64 Bit) 👤 User => admin 🆔 PC => DESKTOP-JGLLJLD 🏴 Country => [Norway] 🔍 IP => 45.13.191.92 📝 Language => 🇺🇸 en-US 🔓 Antivirus => Windows De
Token7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
End-PointsendDocument
Args
chat_id (1)6068287209
caption (1)==== RL STEALER ====
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:02 02:46:12+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1333248
InitializedDataSize: 6656
UninitializedDataSize: -
EntryPoint: 0x14774e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: Zagreus Builder.exe
LegalCopyright:
OriginalFileName: Zagreus Builder.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
8
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start zagreus builder.exe #NESHTA zagreus builder.exe #DISCORDGRABBER cicada.exe zagreus builder.exe no specs svchost.exe sppextcomobj.exe no specs slui.exe no specs filecoauth.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2140C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4108"C:\Users\admin\Desktop\Zagreus Builder.exe" C:\Users\admin\Desktop\Zagreus Builder.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\zagreus builder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5936"C:\Users\admin\AppData\Local\Temp\3582-490\ZagreuS Builder.exe" C:\Users\admin\AppData\Local\Temp\3582-490\ZagreuS Builder.exe—ZagreuS Builder.exe
User:
admin
Company:
ZagreuS Corporation
Integrity Level:
MEDIUM
Description:
ZagreuS Builder
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\zagreus builder.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6048"C:\Users\admin\AppData\Local\Temp\ZagreuS Builder.exe" C:\Users\admin\AppData\Local\Temp\ZagreuS Builder.exe
Zagreus Builder.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\zagreus builder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6108"C:\Users\admin\AppData\Local\Temp\Cicada.exe" C:\Users\admin\AppData\Local\Temp\Cicada.exe
Zagreus Builder.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RL
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cicada.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
ims-api
(PID) Process(6108) Cicada.exe
Telegram-Tokens (1)7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
Telegram-Info-Links
7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
Get info about bothttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/getMe
Get incoming updateshttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/getUpdates
Get webhookhttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
End-PointsendDocument
Args
chat_id (1)6068287209
caption (1)==== RL STEALER ==== ⏰ Date => 03/24/2025 3:33 💻System => Windows 10 Pro (64 Bit) 👤 User =%3
Token7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
End-PointsendDocument
Args
Token7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
End-PointsendDocument
Args
chat_id (1)6068287209
caption (1)==== RL STEALER ==== ⏰ Date => 03/24/2025 3:33 💻System => Windows 10 Pro (64 Bit) 👤 User => admin 🆔 PC => DESKTOP-JGLLJLD 🏴 Country => [Norway] 🔍 IP => 45.13.191.92 📝 Language => 🇺🇸 en-US 🔓 Antivirus => Windows De
Token7382141956:AAEtnjwughN0sZTQ_wzEG2EuQEvAFP_LdF8
End-PointsendDocument
Args
chat_id (1)6068287209
caption (1)==== RL STEALER ====
7176"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7664"C:\Users\admin\AppData\Local\Temp\3582-490\FileCoAuth.exe" -EmbeddingC:\Users\admin\AppData\Local\Temp\3582-490\FileCoAuth.exe—FileCoAuth.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
4 018
Read events
4 004
Write events
14
Delete events
0

Modification events

(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6108) Cicada.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cicada_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
11
Suspicious files
16
Text files
39
Unknown types
0

Dropped files

PID
Process
Filename
Type
6108Cicada.exeC:\Users\admin\AppData\Local\Temp\places.raw —
MD5:—
SHA256:—
6048ZagreuS Builder.exeC:\Users\admin\AppData\Local\Temp\3582-490\ZagreuS Builder.exeexecutable
MD5:E538C0DF99242DB4EEBEDB0EAF655CCA
SHA256:38551A319BF73A435F849C42A52818236BFB59C2F73F3658198C0C2F5773D383
6108Cicada.exeC:\ProgramData\DESKTOP-JGLLJLD\InstalledSoftware.txttext
MD5:9FE3E9FBA5C9F39C7C244BD808A9777F
SHA256:6FD5F361A1FEAA428050DA60111432F85E03ED3D7571D5B86CEC3C77296C9D10
4108Zagreus Builder.exeC:\Users\admin\AppData\Local\Temp\Cicada.exeexecutable
MD5:9400A5310BB2DE623439B244CBEF49B8
SHA256:3CDEF3A60769CE6B68A9200A4A4BCBBDADD374D8CECE69C14FF24B2B3869F192
6108Cicada.exeC:\ProgramData\DESKTOP-JGLLJLD\FileGrabber\Desktop\maptraffic.rtftext
MD5:BBA6F8594B672C695417E077E8F2BCA4
SHA256:B01DC8C09A3DB1613A829D4CFFF144DBD5364D12A5B64F7C38C3303B0317FB62
6108Cicada.exeC:\ProgramData\DESKTOP-JGLLJLD\FileGrabber\Desktop\behindlearn.pngimage
MD5:BD063635ADDE4F63F960E07234F6A0CE
SHA256:CC01C207014C62C42D77914E086B2B433090BCB116054D78E1882DB436030C1F
6108Cicada.exeC:\ProgramData\DESKTOP-JGLLJLD\FileGrabber\Documents\elmb.rtftext
MD5:BE078DDDF9EAD08556A997ED33EB1646
SHA256:D39062DA0E818D6F8383C56C9691A19D560ADD70740C4E26C9C6B4573A734674
6108Cicada.exeC:\ProgramData\DESKTOP-JGLLJLD\FileGrabber\Desktop\valleyreceived.jpgimage
MD5:0A88FEF13A4492B52A50F914C6640AAC
SHA256:662CDD43E887A33C7432A84C9D44874711412A3086B18EBC88745093EFC0D55B
6108Cicada.exeC:\ProgramData\DESKTOP-JGLLJLD\FileGrabber\Documents\areacool.rtftext
MD5:EBD446E2A4090BACAC78B7163F388E3B
SHA256:7E2EDDA4A1FB72F7B356A7C1D97A6440448FE652FB1903AB24121E2FA6408DB8
6108Cicada.exeC:\Users\admin\AppData\Local\Temp\tmpC45B.tmp.datbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
40
DNS requests
20
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.22.242.90:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.22.242.90:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6108
Cicada.exe
GET
200
208.95.112.1:80
http://ip-api.com/xml
unknown
—
—
whitelisted
6108
Cicada.exe
GET
200
208.95.112.1:80
http://ip-api.com/xml
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6108
Cicada.exe
GET
200
208.95.112.1:80
http://ip-api.com/xml
unknown
—
—
whitelisted
6108
Cicada.exe
GET
200
208.95.112.1:80
http://ip-api.com/xml
unknown
—
—
whitelisted
7792
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7792
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.22.242.90:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6108
Cicada.exe
162.125.72.15:443
dl.dropboxusercontent.com
DROPBOX
US
whitelisted
6108
Cicada.exe
104.21.48.1:443
freegeoip.app
CLOUDFLARENET
—
whitelisted
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6108
Cicada.exe
104.21.85.189:443
ipbase.com
CLOUDFLARENET
—
suspicious

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.22.242.90
  • 2.22.242.121
whitelisted
dl.dropboxusercontent.com
  • 162.125.72.15
whitelisted
freegeoip.app
  • 104.21.48.1
  • 104.21.32.1
  • 104.21.80.1
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.112.1
whitelisted
client.wns.windows.com
  • 20.197.71.89
whitelisted
ipbase.com
  • 104.21.85.189
  • 172.67.209.71
unknown
login.live.com
  • 40.126.31.71
  • 20.190.159.4
  • 40.126.31.69
  • 40.126.31.0
  • 20.190.159.64
  • 40.126.31.129
  • 20.190.159.68
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
api.ipify.org
  • 104.26.13.205
  • 172.67.74.152
  • 104.26.12.205
shared

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Checker Domain (freegeoip .app)
6108
Cicada.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] SNI External IP Domain Lookup (freegeoip .app)
6108
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
6108
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
2196
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain Domain in DNS Lookup (ipbase .com)
6108
Cicada.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (ipbase .com in TLS SNI)
6108
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
6108
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
6108
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
6108
Cicada.exe
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zagreus Builder.exe