File name:

666.exe

Full analysis: https://app.any.run/tasks/34f7b154-1c23-4ebd-bcbd-530f2a92498a
Verdict: Malicious activity
Analysis date: November 02, 2024, 16:32:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

E8335C96A6D84AE303D2908E79EBA24B

SHA1:

D2D1FFCDC96CC7AD4F6C13B36A10B11A512EC77A

SHA256:

60352F191D73298DA994108F5940C4811B1AFE7F7F9244367BE4F1EDE0E6C2D7

SSDEEP:

3072:rCYa+0Nu6vQAkQ5S7JmyxCbBKhiTbMoIL:YQLi8NiTbXk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE to view/add/change user profiles

      • net.exe (PID: 2312)
      • net.exe (PID: 6184)
      • net.exe (PID: 5356)
      • cmd.exe (PID: 4348)
      • net.exe (PID: 1204)
      • net.exe (PID: 3936)
      • cmd.exe (PID: 7456)
      • net.exe (PID: 6316)

    • Starts NET.EXE to view/change users localgroup

      • net.exe (PID: 6164)
      • cmd.exe (PID: 4348)
      • net.exe (PID: 5332)

  • SUSPICIOUS

    • Changes the desktop background image

      • reg.exe (PID: 5984)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 7456)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 7456)

    • Uses TASKKILL.EXE to kill Browsers

      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 7456)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 7456)

    • Executing commands from a ".bat" file

      • 666.exe (PID: 4868)
      • 666.exe (PID: 7056)

    • Starts CMD.EXE for commands execution

      • 666.exe (PID: 4868)
      • 666.exe (PID: 7056)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 7456)

    • The process executes VB scripts

      • cmd.exe (PID: 4348)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 6596)
      • explorer.exe (PID: 6408)

    • Reads security settings of Internet Explorer

      • StartMenuExperienceHost.exe (PID: 4704)

    • Reads the date of Windows installation

      • StartMenuExperienceHost.exe (PID: 4704)
      • SearchApp.exe (PID: 5532)

    • The process drops C-runtime libraries

      • MBAMInstallerService.exe (PID: 6480)
      • MBAMService.exe (PID: 7148)

    • Drops a system driver (possible attempt to evade defenses)

      • MBAMInstallerService.exe (PID: 6480)
      • MBVpnTunnelService.exe (PID: 8040)
      • MBAMService.exe (PID: 7620)
      • MBAMService.exe (PID: 7148)
      • drvinst.exe (PID: 7196)

    • Executes as Windows Service

      • MBAMInstallerService.exe (PID: 6480)
      • MBAMService.exe (PID: 7148)

    • Executable content was dropped or overwritten

      • MBSetup.exe (PID: 5388)
      • MBAMInstallerService.exe (PID: 6480)
      • explorer.exe (PID: 6596)
      • MBVpnTunnelService.exe (PID: 8040)
      • drvinst.exe (PID: 7196)
      • MBAMService.exe (PID: 7620)
      • MBAMService.exe (PID: 7148)

    • Drops 7-zip archiver for unpacking

      • MBAMInstallerService.exe (PID: 6480)

    • Process drops legitimate windows executable

      • MBAMInstallerService.exe (PID: 6480)
      • MBAMService.exe (PID: 7148)

    • Application launched itself

      • Malwarebytes.exe (PID: 1748)

  • INFO

    • Create files in a temporary directory

      • 666.exe (PID: 4868)
      • cmd.exe (PID: 4348)

    • Checks supported languages

      • chcp.com (PID: 6216)
      • 666.exe (PID: 4868)
      • SearchApp.exe (PID: 5532)
      • StartMenuExperienceHost.exe (PID: 4704)
      • TextInputHost.exe (PID: 4720)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 7456)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 6596)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 300)
      • explorer.exe (PID: 6596)

    • Reads the computer name

      • TextInputHost.exe (PID: 4720)
      • StartMenuExperienceHost.exe (PID: 4704)
      • SearchApp.exe (PID: 5532)

    • Process checks computer location settings

      • StartMenuExperienceHost.exe (PID: 4704)
      • SearchApp.exe (PID: 5532)

    • Sends debugging messages

      • StartMenuExperienceHost.exe (PID: 4704)

    • Checks proxy server information

      • SearchApp.exe (PID: 5532)
      • explorer.exe (PID: 6596)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 5532)

    • Reads the software policy settings

      • SearchApp.exe (PID: 5532)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 6632)
      • chrome.exe (PID: 1376)

    • Application launched itself

      • chrome.exe (PID: 6632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:07:30 08:52:45+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 2.5
CodeSize: 70656
InitializedDataSize: 26624
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
259
Monitored processes
109
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 666.exe conhost.exe no specs cmd.exe no specs chcp.com no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs rundll32.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs cscript.exe no specs explorer.exe no specs explorer.exe startmenuexperiencehost.exe no specs textinputhost.exe no specs searchapp.exe mobsync.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs mbsetup.exe no specs mbsetup.exe mbsetup.exe no specs mbsetup.exe mbaminstallerservice.exe rundll32.exe no specs 666.exe no specs 666.exe conhost.exe no specs cmd.exe no specs chcp.com no specs mbvpntunnelservice.exe conhost.exe no specs drvinst.exe mbamservice.exe mbamservice.exe ig.exe no specs malwarebytes.exe no specs help.exe no specs help.exe no specs mbamwsc.exe no specs malwarebytes.exe no specs malwarebytes.exe no specs mbamwsc.exe no specs mbupdatrv5.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs rundll32.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs explorer.exe no specs explorer.exe no specs startmenuexperiencehost.exe no specs tiworker.exe no specs searchapp.exe no specs mobsync.exe no specs 666.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300cscript //nologo C:\Users\admin\AppData\Local\Temp\msg.vbs C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
300C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1204net user "無路可走" "death" /add /y C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1376"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2080 --field-trial-handle=1908,i,11897072220825111232,4026521430511633490,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1396C:\WINDOWS\system32\net1 user "你是下一個" C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
1748"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe—explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
MEDIUM
Description:
Malwarebytes
Exit code:
0
Version:
5.0.0.997
1784taskkill /f /im iexplore.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2312net user "無路可走" C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2376reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "2" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2464"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus noneC:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe—MBAMService.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Exit code:
0
Version:
3.1.0.245
Total events
71 771
Read events
71 187
Write events
519
Delete events
65

Modification events

(PID) Process:(5264) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableTaskMgr
Value:
1
(PID) Process:(5984) reg.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:Wallpaper
Value:
C:\Users\admin\Desktop\666.jpg
(PID) Process:(2376) reg.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WallpaperStyle
Value:
2
(PID) Process:(7104) reg.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:TileWallpaper
Value:
0
(PID) Process:(5512) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{eaf65672-68c3-4f99-8d5c-104b5f4d8fff}
Operation:delete keyName:(default)
Value:
(PID) Process:(5512) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2f5c5e73-85a9-11eb-90a8-9a9b76358421}
Operation:delete keyName:(default)
Value:
(PID) Process:(5512) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2f5c5e72-85a9-11eb-90a8-9a9b76358421}
Operation:delete keyName:(default)
Value:
(PID) Process:(5512) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2f5c5e71-85a9-11eb-90a8-9a9b76358421}
Operation:delete keyName:(default)
Value:
(PID) Process:(5512) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
Operation:delete keyName:(default)
Value:
(PID) Process:(6596) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2f5c5e72-85a9-11eb-90a8-9a9b76358421}
Operation:writeName:Data
Value:
D60D00000DF0ADBA41000000080000000000008000000000000000300000000000000000FF06E703FF00000016000000FA99B7261F00000004400000030000000000000000000000000000000000000000005C005C003F005C00530054004F005200410047004500230056006F006C0075006D00650023007B00390030006300660033006400640036002D0030006100660037002D0031003100650063002D0062003400380030002D003800300036006500360066003600650036003900360033007D002300300030003000300030003000300030003100460035003000300030003000300023007B00350033006600350036003300300064002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005C005C003F005C0056006F006C0075006D0065007B00320066003500630035006500370032002D0038003500610039002D0031003100650062002D0039003000610038002D003900610039006200370036003300350038003400320031007D005C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004E005400460053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000
Executable files
1 459
Suspicious files
642
Text files
439
Unknown types
4

Dropped files

PID
Process
Filename
Type
5532SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133750387743883404.txt~RF8d7cb.TMP —
MD5:—
SHA256:—
4868666.exeC:\Users\admin\AppData\Local\Temp\B36A.tmp\B36B.tmp\B36C.battext
MD5:F2650F2B7CD26B6042303D74D8CB9560
SHA256:E6A31BAF0726C64A08E2D5E7AC4C28D56B43C3343BE0FB758230229D92584530
4348cmd.exeC:\Users\admin\AppData\Local\Temp\msg.vbstext
MD5:A622F171409E52016A6E87068DDF04F9
SHA256:C5A1E783B627884942F110313C780A2FE140C2C5A77E261A07ACFE97A9479C9B
4868666.exeC:\Users\admin\AppData\Local\Temp\666.jpgimage
MD5:B0058B62EEF8F75CC5817C2727581049
SHA256:7A437FEDC2CF3AC7CE6C6004A77C8D76745E92E5820FB2C3334AE21576EB1FFB
5532SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\Q84V0JUH\-UAIppANYxiGpRWJy2NDph4qOEw.gz[1].jsbinary
MD5:9E527B91C2D8B31B0017B76049B5E4E3
SHA256:38EDF0F961C1CCB287880B88F12F370775FC65B2E28227EEE215E849CDBE9BBC
5532SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\63\f4st08wpuYBQ5KWRJ3MqAsJB8zg[1].csstext
MD5:3D24779C6014BCFEFB3D9A80B8F3567B
SHA256:A7EF8FAA37710D7E90C9C8950C203C8DA82410780F872E4F217EE636250D831F
5532SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133750387743883404.txt.~tmptext
MD5:EBA9D627AEFA0148EA256382E454768F
SHA256:85F02886D53B7427792E54BCEE97D366AD46F78CF90AA25DCC3FAE29ED7FA7F8
5532SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dder
MD5:309C222F85BCA69AF3BF3301770614A4
SHA256:8A6AC095CD1CCF7E3AEC06632AAFE71FBC7FC2E12BE0D2E98A58E17CCB43067D
5532SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\63\9mPvCZxJ_M6qXqPOckJnlPKda1w[1].jsbinary
MD5:D311944C8E8FD4D967010526ED103B12
SHA256:1B6CEE7997ABFB5BD6127AA68056EF8FF4ACFADCE02A1BAD8A85AA9F8D23FD49
5532SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:4EFCFA02987AEE587E5B8334B528A455
SHA256:8FB27458976231F01004C08327A263ED8D2D5B434DC1940ED95860877DEC98B4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
64
TCP/UDP connections
160
DNS requests
148
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5532
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2776
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3600
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3600
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
172.64.149.23:80
http://crl.comodoca.com/AAACertificateServices.crl
unknown
—
—
whitelisted
—
—
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQRz3ETyLz2DaZTxGOH%2BA%2BjK7MkGAQUJGWTmAgB6E7U1kzqZFXhwPr7z7MCEQCmV%2Fd4sxrlI9ZnExcY0W6y
unknown
—
—
whitelisted
—
—
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQCeArDpSs6yEJyh6YNr4MLb
unknown
—
—
whitelisted
—
—
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Public%20RSA%20Timestamping%20CA%202020.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3396
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
23.32.185.131:80
www.microsoft.com
AKAMAI-AS
BR
whitelisted
5532
SearchApp.exe
2.23.209.182:443
r.bing.com
Akamai International B.V.
GB
whitelisted
5532
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5532
SearchApp.exe
2.23.209.179:443
r.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 23.32.185.131
  • 23.52.120.96
whitelisted
r.bing.com
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.149
  • 2.23.209.187
  • 2.23.209.185
  • 2.23.209.179
  • 2.23.209.130
  • 2.23.209.189
  • 2.23.209.148
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.bing.com
  • 2.23.209.179
  • 2.23.209.187
  • 2.23.209.185
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.149
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.148
  • 2.16.110.121
  • 2.16.110.171
  • 2.16.110.123
whitelisted
th.bing.com
  • 2.23.209.185
  • 2.23.209.149
  • 2.23.209.182
  • 2.23.209.189
  • 2.23.209.130
  • 2.23.209.176
  • 2.23.209.179
  • 2.23.209.187
  • 2.23.209.148
  • 2.23.209.140
  • 2.23.209.177
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.4
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.23
  • 20.190.159.2
  • 20.190.159.71
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
666.exe