File name:

Listary.exe

Full analysis: https://app.any.run/tasks/fb161b08-1063-4b05-bea7-8203bbfb3d39
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 26, 2024, 17:21:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4D7B3F9C65DF47AAAB7D8D2CBC7C1742

SHA1:

D4295BC74F8695BB98EB1535967C30328F9A1B49

SHA256:

62E1ED1D67B9C9B250ECBAB667556A3A149D55E363B3563A197A60C10B523FE6

SSDEEP:

196608:aH/UpMFXwBpyoCizLTZR4RunzMe0IQ21yJw4:af/FXEpyfK/ZOsnzMcVyJw4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Listary.tmp (PID: 4284)
      • reg.exe (PID: 2088)

    • Actions looks like stealing of personal data

      • Listary.exe (PID: 5504)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • Listary.exe (PID: 964)
      • Listary.exe (PID: 4980)
      • Listary.tmp (PID: 4284)

    • Reads security settings of Internet Explorer

      • Listary.tmp (PID: 6900)
      • Listary.Service.exe (PID: 6164)
      • Listary.exe (PID: 5504)
      • Skype.exe (PID: 6412)

    • Executable content was dropped or overwritten

      • Listary.exe (PID: 964)
      • Listary.exe (PID: 4980)
      • Listary.tmp (PID: 4284)

    • Reads the date of Windows installation

      • Listary.tmp (PID: 6900)
      • Listary.exe (PID: 5504)

    • Reads the Windows owner or organization settings

      • Listary.tmp (PID: 4284)

    • Starts SC.EXE for service management

      • Listary.tmp (PID: 4284)

    • Process drops legitimate windows executable

      • Listary.tmp (PID: 4284)

    • Executes as Windows Service

      • Listary.Service.exe (PID: 6164)

    • Checks Windows Trust Settings

      • Listary.Service.exe (PID: 6164)

    • Adds/modifies Windows certificates

      • Listary.Service.exe (PID: 6164)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 4344)

    • There is functionality for taking screenshot (YARA)

      • Listary.exe (PID: 5504)

    • Changes Internet Explorer settings (feature browser emulation)

      • Listary.exe (PID: 5504)

    • Application launched itself

      • Skype.exe (PID: 6412)

    • Uses REG/REGEDIT.EXE to modify registry

      • Skype.exe (PID: 6412)

    • Detected use of alternative data streams (AltDS)

      • Skype.exe (PID: 6412)

  • INFO

    • Checks supported languages

      • Listary.exe (PID: 964)
      • Listary.tmp (PID: 6900)
      • Listary.exe (PID: 4980)
      • Listary.tmp (PID: 4284)
      • Listary.Service.exe (PID: 6164)
      • Listary.exe (PID: 5504)
      • listary-core.exe (PID: 5104)
      • ListaryHookHost32.exe (PID: 2868)
      • Skype.exe (PID: 3660)
      • Skype.exe (PID: 6544)
      • Skype.exe (PID: 6852)
      • Skype.exe (PID: 7116)
      • ListaryHookHost64.exe (PID: 6152)
      • Skype.exe (PID: 6412)
      • Skype.exe (PID: 6120)

    • Reads the computer name

      • Listary.tmp (PID: 6900)
      • Listary.tmp (PID: 4284)
      • Listary.Service.exe (PID: 6164)
      • Listary.exe (PID: 5504)
      • Skype.exe (PID: 6544)
      • Skype.exe (PID: 6852)
      • listary-core.exe (PID: 5104)
      • Skype.exe (PID: 6412)
      • Skype.exe (PID: 7116)

    • Create files in a temporary directory

      • Listary.exe (PID: 964)
      • Listary.exe (PID: 4980)
      • Listary.tmp (PID: 4284)
      • Skype.exe (PID: 6412)

    • Process checks computer location settings

      • Listary.tmp (PID: 6900)
      • Listary.exe (PID: 5504)
      • Skype.exe (PID: 6412)
      • Skype.exe (PID: 6120)
      • Skype.exe (PID: 7116)

    • Creates files in the program directory

      • Listary.tmp (PID: 4284)
      • Listary.exe (PID: 5504)

    • Creates a software uninstall entry

      • Listary.tmp (PID: 4284)

    • Reads the machine GUID from the registry

      • Listary.Service.exe (PID: 6164)
      • Listary.exe (PID: 5504)
      • Skype.exe (PID: 6412)

    • Reads the software policy settings

      • Listary.Service.exe (PID: 6164)
      • Skype.exe (PID: 6412)

    • Reads Environment values

      • Listary.exe (PID: 5504)
      • Skype.exe (PID: 6412)
      • Skype.exe (PID: 7116)

    • Creates files or folders in the user directory

      • listary-core.exe (PID: 5104)
      • Skype.exe (PID: 6412)
      • Listary.exe (PID: 5504)
      • Skype.exe (PID: 6852)
      • Skype.exe (PID: 7116)

    • Disables trace logs

      • Listary.exe (PID: 5504)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 6756)

    • Application launched itself

      • chrome.exe (PID: 6756)

    • Checks proxy server information

      • listary-core.exe (PID: 5104)
      • Skype.exe (PID: 6412)
      • Listary.exe (PID: 5504)

    • Reads CPU info

      • Skype.exe (PID: 6412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 16:10:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Listary Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: Listary
ProductVersion: 6.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
52
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start listary.exe listary.tmp no specs listary.exe listary.tmp sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs listary.service.exe schtasks.exe no specs conhost.exe no specs THREAT listary.exe listary-core.exe no specs conhost.exe no specs listaryhookhost32.exe no specs listaryhookhost64.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs skype.exe skype.exe no specs skype.exe no specs skype.exe reg.exe conhost.exe no specs skype.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs skype.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
360\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
964"C:\Users\admin\AppData\Local\Temp\Listary.exe" C:\Users\admin\AppData\Local\Temp\Listary.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Listary Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\listary.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—listary-core.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1656"C:\WINDOWS\system32\sc.exe" stop ListaryServiceC:\Windows\System32\sc.exe—Listary.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2036C:\WINDOWS\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe" /veC:\Windows\SysWOW64\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2088C:\WINDOWS\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Skype for Desktop" /t REG_SZ /d "C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe" /fC:\Windows\SysWOW64\reg.exe
Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2384"C:\WINDOWS\system32\sc.exe" delete ListaryServiceV2C:\Windows\System32\sc.exe—Listary.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2384"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4416 --field-trial-handle=1884,i,18408858178351787876,9795903545512295805,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
33 942
Read events
33 748
Write events
170
Delete events
24

Modification events

(PID) Process:(4284) Listary.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Listary
Value:
"C:\Program Files\Listary\Listary.exe" --startup
(PID) Process:(4284) Listary.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\listary
Operation:writeName:URL Protocol
Value:
(PID) Process:(4284) Listary.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:delete valueName:C:\Program Files\Listary\Listary.exe
Value:
(PID) Process:(4284) Listary.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.1
(PID) Process:(4284) Listary.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Listary
(PID) Process:(4284) Listary.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Listary\
(PID) Process:(4284) Listary.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Listary
(PID) Process:(4284) Listary.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(4284) Listary.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon
(PID) Process:(4284) Listary.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Listary_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
quicklaunchicon
Executable files
309
Suspicious files
86
Text files
111
Unknown types
4

Dropped files

PID
Process
Filename
Type
4284Listary.tmpC:\Program Files\Listary\unins000.exeexecutable
MD5:A68D75C7B71DEAE8CC2C1F33322A3A8D
SHA256:4A58E8C47CECB6CD086346855415594CCB0A134E5966452E9281965D1D1F611A
964Listary.exeC:\Users\admin\AppData\Local\Temp\is-HBGK9.tmp\Listary.tmpexecutable
MD5:CFF49D095AABF9F032CA8F6712DC2B04
SHA256:CA5EA4A437857650BA3E430ED1CF32FC8736B5539C1FD6CE6EC9BF77F7DB7367
4284Listary.tmpC:\Users\admin\AppData\Local\Temp\is-FEU7O.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4284Listary.tmpC:\Program Files\Listary\is-FEFT2.tmpexecutable
MD5:2F345B6D207489E52DB3F85C2E4E617D
SHA256:2135B40FA819E58CF1942453E4409BFDEA2BE631077A354B878DE8402BE7E026
4284Listary.tmpC:\Program Files\Listary\is-L4V4I.tmpbinary
MD5:3E69BFD5ECDF07FF8084571D5088FC84
SHA256:3AFAB3FBE804F02BEF9BB1D99295447F347D8B5D3E944276B68102CCAAF82997
4284Listary.tmpC:\Program Files\Listary\is-4D5IU.tmpexecutable
MD5:AA60EBB3568E4CFB12B29368F348464B
SHA256:8DB0941D1ECBA3B828FA0FA452EB9C7183BC87F81C1A76AB40D32628D65C3A25
4284Listary.tmpC:\Program Files\Listary\cnmatch.binbinary
MD5:3E69BFD5ECDF07FF8084571D5088FC84
SHA256:3AFAB3FBE804F02BEF9BB1D99295447F347D8B5D3E944276B68102CCAAF82997
4284Listary.tmpC:\Program Files\Listary\is-ABE9K.tmpexecutable
MD5:8F4ADEF5EC8E9EF2B168B6842005E50F
SHA256:0EB76BEC414F5F07615E6BF60A1A02C9207C5CE94F3CBEF9A66C995E80DB652C
4284Listary.tmpC:\Program Files\Listary\is-930OP.tmpexecutable
MD5:8672A8C07C7BC1EC086B2893A4C6E2CD
SHA256:3B22547F8CB828A63D83BFD82FD8FBA42A77AB25455F2BB926F76B8E1AB5C72E
4284Listary.tmpC:\Program Files\Listary\CommandLine.dllexecutable
MD5:2F345B6D207489E52DB3F85C2E4E617D
SHA256:2135B40FA819E58CF1942453E4409BFDEA2BE631077A354B878DE8402BE7E026
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
36
DNS requests
36
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5112
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5112
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6164
Listary.Service.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
6164
Listary.Service.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAjfW2biAeCNICRe9hwtUJc%3D
unknown
—
—
whitelisted
6208
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2248
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6876
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6164
Listary.Service.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6208
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6208
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 172.217.215.113
  • 172.217.215.100
  • 172.217.215.101
  • 172.217.215.102
  • 172.217.215.138
  • 172.217.215.139
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.67
  • 20.190.159.64
  • 20.190.159.73
  • 20.190.159.71
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.2
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
clientservices.googleapis.com
  • 142.250.185.163
whitelisted
accounts.google.com
  • 108.177.127.84
whitelisted

Threats

No threats detected
Process
Message
Listary.Service.exe
2024-08-26 17:21:37.2168|DEBUG|Listary.Service.Program|Listary service start
Listary.Service.exe
2024-08-26 17:21:37.3573|DEBUG|Listary.Service.ListaryWindowsServiceHost|Start windows service
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Listary.exe