File name:

11.exe

Full analysis: https://app.any.run/tasks/b56e0787-da1e-4764-900c-3c45f81acd32
Verdict: Malicious activity
Threats:

Chaos ransomware is a malware family known for its destructive capabilities and diverse variants. It first appeared in 2021 as a ransomware builder and later acted as a wiper. Unlike most ransomware strains that encrypt data to extort payment, early Chaos variants permanently corrupted files, while later versions adopted more conventional encryption techniques.

Malware Trends Tracker     >>>
Analysis date: July 28, 2024, 04:58:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
crypto-regex
chaos
ransomware
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

99177A95442CB3CD77F9359C948C9FBE

SHA1:

764AF2058A89C8FFA7E704BDB84D4492BCAE5BE2

SHA256:

612EB5C3269A264D1516904E24FE1BDFA17CB8A06441F03C483216EB52A9F526

SSDEEP:

3072:vd9Qr9cIB/WcwALWP+nWVWRzO/LZLYq5r+6BQJAjrEzUV7kMq3LBl:cr9ck+KWP+nqei/Gq5aIjiUxFqt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 11.exe (PID: 6696)

    • Create files in the Startup directory

      • svchost.exe (PID: 7396)
      • svchost.exe (PID: 5712)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 5336)

    • Deletes shadow copies

      • cmd.exe (PID: 7788)
      • cmd.exe (PID: 7184)
      • cmd.exe (PID: 6024)
      • cmd.exe (PID: 5948)

    • CHAOS has been detected (YARA)

      • svchost.exe (PID: 7396)

    • Actions looks like stealing of personal data

      • svchost.exe (PID: 7396)
      • svchost.exe (PID: 5712)

    • Renames files like ransomware

      • svchost.exe (PID: 5712)
      • svchost.exe (PID: 7396)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 11.exe (PID: 6696)
      • svchost.exe (PID: 7396)
      • svchost.exe (PID: 5712)

    • Reads the date of Windows installation

      • 11.exe (PID: 6696)
      • svchost.exe (PID: 5712)
      • svchost.exe (PID: 7396)

    • The process creates files with name similar to system file names

      • 11.exe (PID: 6696)

    • Executable content was dropped or overwritten

      • 11.exe (PID: 6696)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 7396)
      • svchost.exe (PID: 5712)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7876)
      • wbengine.exe (PID: 3384)
      • vds.exe (PID: 2492)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 7396)

    • Start notepad (likely ransomware note)

      • svchost.exe (PID: 7396)
      • svchost.exe (PID: 5712)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4164)

    • Write to the desktop.ini file (may be used to cloak folders)

      • svchost.exe (PID: 7396)

    • Starts itself from another location

      • 11.exe (PID: 6696)

  • INFO

    • Checks supported languages

      • 11.exe (PID: 6696)
      • svchost.exe (PID: 7396)
      • svchost.exe (PID: 5712)
      • PLUGScheduler.exe (PID: 4164)
      • svchost.exe (PID: 6696)

    • Creates files or folders in the user directory

      • 11.exe (PID: 6696)
      • svchost.exe (PID: 5712)
      • svchost.exe (PID: 7396)

    • Reads the computer name

      • 11.exe (PID: 6696)
      • svchost.exe (PID: 5712)
      • PLUGScheduler.exe (PID: 4164)
      • svchost.exe (PID: 6696)

    • Process checks computer location settings

      • 11.exe (PID: 6696)
      • svchost.exe (PID: 7396)
      • svchost.exe (PID: 5712)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 7984)
      • notepad.exe (PID: 464)
      • Taskmgr.exe (PID: 7336)
      • notepad.exe (PID: 1196)
      • notepad.exe (PID: 7592)
      • WMIC.exe (PID: 5924)
      • Taskmgr.exe (PID: 1076)
      • notepad.exe (PID: 6064)

    • Create files in a temporary directory

      • svchost.exe (PID: 7396)
      • svchost.exe (PID: 5712)

    • Manual execution by a user

      • Taskmgr.exe (PID: 4648)
      • Taskmgr.exe (PID: 7336)
      • notepad.exe (PID: 1196)
      • svchost.exe (PID: 5712)
      • notepad.exe (PID: 7592)
      • Taskmgr.exe (PID: 1076)
      • Taskmgr.exe (PID: 468)

    • Reads Microsoft Office registry keys

      • svchost.exe (PID: 7396)
      • svchost.exe (PID: 5712)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 4164)

    • Reads the machine GUID from the registry

      • svchost.exe (PID: 5712)
      • svchost.exe (PID: 7396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:28 04:58:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 189952
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x3042e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 11.exe
LegalCopyright:
OriginalFileName: 11.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
314
Monitored processes
39
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start start 11.exe THREAT svchost.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs taskmgr.exe no specs taskmgr.exe notepad.exe no specs plugscheduler.exe no specs notepad.exe no specs svchost.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe no specs notepad.exe no specs taskmgr.exe no specs taskmgr.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
464"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Roaming\read_it.txtC:\Windows\System32\notepad.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
468"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
1076"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
1196"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2340wbadmin delete catalog -quietC:\Windows\System32\wbadmin.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® BLB Backup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2492C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3384"C:\WINDOWS\system32\wbengine.exe"C:\Windows\System32\wbengine.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Block Level Backup Engine Service EXE
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3848bcdedit /set {default} bootstatuspolicy ignoreallfailures C:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
Total events
27 026
Read events
26 911
Write events
93
Delete events
22

Modification events

(PID) Process:(6696) 11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6696) 11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6696) 11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6696) 11.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7396) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7396) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(7396) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(7396) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(8144) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(8144) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Description
Operation:writeName:FirmwareModified
Value:
1
Executable files
1
Suspicious files
23
Text files
622
Unknown types
7

Dropped files

PID
Process
Filename
Type
7396svchost.exeC:\Users\admin\Desktop\11.exe.Gol_1killtext
MD5:C2AACBFB823EE7EDD3A66D9AD2342295
SHA256:B60CBBA2BACEA667EA19AF859D2556F898BD07D78CE7DD1EBEF779EF8A32D699
7396svchost.exeC:\Users\admin\Desktop\definedhit.jpg.Gol_1killtext
MD5:926DF366D6BB09E66F802CFD6EED7CE5
SHA256:9FE7B76AD4B9A18290943875384FCDFC059411B98BD0D09C2F61216A3DABB61A
7396svchost.exeC:\Users\admin\Desktop\augustsets.rtf.Gol_1killtext
MD5:34270D3919013EE8AA9436E671A91A72
SHA256:0B1D4EB31BA764E566AF7FAB67EEED643C95DD5BC6FDC724C47FFDBAD9E5C1E2
7396svchost.exeC:\Users\admin\Desktop\consideredapple.jpgtext
MD5:763430154CE49957F495C1359F8502DF
SHA256:06D9BA77855CB4081A863C939CB3BF459175482785ACFE26EA1CDDD18143DCB8
7396svchost.exeC:\Users\admin\Desktop\customevidence.png.Gol_1killtext
MD5:EED22201B3E590EACBFA922C68F7944C
SHA256:376DCE48DCB685537F65A583A88FD715F8B9C54F5F827B1C0A71F922A00D081A
669611.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:99177A95442CB3CD77F9359C948C9FBE
SHA256:612EB5C3269A264D1516904E24FE1BDFA17CB8A06441F03C483216EB52A9F526
7396svchost.exeC:\Users\admin\Desktop\componentsonly.jpg.Gol_1killtext
MD5:4A873C2C3C1A1F4FE01F87C382A72D79
SHA256:C42DFC1FBD6C0FEFD25A4BAF5253C5F3221B061BA1FCA5060F12BEB9B095CD9A
7396svchost.exeC:\Users\admin\Desktop\11.exetext
MD5:C2AACBFB823EE7EDD3A66D9AD2342295
SHA256:B60CBBA2BACEA667EA19AF859D2556F898BD07D78CE7DD1EBEF779EF8A32D699
7396svchost.exeC:\Users\admin\Desktop\augustsets.rtftext
MD5:34270D3919013EE8AA9436E671A91A72
SHA256:0B1D4EB31BA764E566AF7FAB67EEED643C95DD5BC6FDC724C47FFDBAD9E5C1E2
7396svchost.exeC:\Users\admin\Desktop\read_it.txttext
MD5:FD81F4F12C2E9ECC21818DE1C27A84F0
SHA256:AD8408438868D3A62F80E9BE24839DF806D7196358C71CC9A7340486A528639C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
53
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5168
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
2444
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5368
SearchApp.exe
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
5368
SearchApp.exe
92.123.104.33:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6012
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5692
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6396
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 92.123.104.33
  • 92.123.104.28
  • 92.123.104.32
  • 92.123.104.34
  • 92.123.104.31
  • 88.221.221.178
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.142
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.44
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
self.events.data.microsoft.com
  • 13.89.178.26
  • 52.168.117.170
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
s-ring.msedge.net
  • 13.107.3.254
unknown

Threats

No threats detected
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
11.exe