File name:

6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe

Full analysis: https://app.any.run/tasks/c3d1cd1b-c953-42c2-a097-0cf18773caa7
Verdict: Malicious activity
Threats:

Phobos is a ransomware that locks or encrypts files to demand a ransom. It uses AES encryption with different extensions, which leaves no chance to recover the infected files.

Malware Trends Tracker     >>>
Analysis date: June 29, 2024, 22:21:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ransomware
phobos
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2C78F28A0F3DBD0F45F96F4AEE72E8EE

SHA1:

F10803CF1D160020E3F611E9F2DD8BE93CB7D7EF

SHA256:

6597018298AAAC827ABB1C58E4B6D7967993B4012EAA83B5540475E0F4F9D34F

SSDEEP:

1536:KymNrLwC/WPYQ3CUXe3f/fgYoPPK2wxufMIzXofka:Kymdw49Q3teHfgYUK3xAzXe3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cmd.exe (PID: 3840)
      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

    • Create files in the Startup directory

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

    • Changes the autorun value in the registry

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)
      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 2808)

    • PHOBOS has been detected

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

    • Renames files like ransomware

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

    • Deletes shadow copies

      • cmd.exe (PID: 5076)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 5076)

    • Actions looks like stealing of personal data

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 5060)

    • Reads the date of Windows installation

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 5060)

    • Application launched itself

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 2808)
      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 5060)

    • Executable content was dropped or overwritten

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

    • Starts CMD.EXE for commands execution

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

    • Creates file in the systems drive root

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 380)

    • The process creates files with name similar to system file names

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2624)
      • wbengine.exe (PID: 1824)
      • vds.exe (PID: 524)

    • Process drops legitimate windows executable

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

  • INFO

    • Checks supported languages

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 2808)
      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 5060)
      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)
      • TextInputHost.exe (PID: 4208)

    • Reads the computer name

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 5060)
      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)
      • TextInputHost.exe (PID: 4208)
      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 2808)

    • Process checks computer location settings

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 5060)

    • Creates files or folders in the user directory

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)
      • notepad.exe (PID: 6208)

    • Creates files in the program directory

      • 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe (PID: 3756)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 5956)
      • notepad.exe (PID: 6208)
      • notepad.exe (PID: 6964)
      • notepad.exe (PID: 6608)

    • Manual execution by a user

      • notepad.exe (PID: 6208)
      • notepad.exe (PID: 6964)
      • notepad.exe (PID: 6608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:03:31 14:17:25+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 34304
InitializedDataSize: 15872
UninitializedDataSize: -
EntryPoint: 0x2fa7
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
24
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe no specs 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs vssadmin.exe no specs netsh.exe no specs vssvc.exe no specs netsh.exe no specs wmic.exe no specs textinputhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
380"C:\WINDOWS\system32\cmd.exe"C:\Windows\System32\cmd.exe—6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
524C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1668wbadmin delete catalog -quietC:\Windows\System32\wbadmin.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® BLB Backup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1824"C:\WINDOWS\system32\wbengine.exe"C:\Windows\System32\wbengine.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Block Level Backup Engine Service EXE
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2488\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2624C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2808C:\Users\admin\Desktop\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\Users\admin\Desktop\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
2820C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3756"C:\Users\admin\Desktop\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe" C:\Users\admin\Desktop\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
3840"C:\Windows\System32\cmd.exe" /k C:\Users\admin\Desktop\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
13 850
Read events
13 685
Write events
140
Delete events
25

Modification events

(PID) Process:(5060) 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5060) 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5060) 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5060) 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3756) 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f
Value:
C:\Users\admin\AppData\Local\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
(PID) Process:(3756) 6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f
Value:
C:\Users\admin\AppData\Local\6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe
(PID) Process:(4648) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(4648) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Description
Operation:writeName:FirmwareModified
Value:
1
(PID) Process:(4648) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(4648) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
Executable files
37
Suspicious files
1 956
Text files
4
Unknown types
15

Dropped files

PID
Process
Filename
Type
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\$WinREAgent\Backup\Winre.wim.id[26B799FA-3483].[recovery8files@onionmail.org].8base —
MD5:—
SHA256:—
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\$WinREAgent\Scratch\update.wim.id[26B799FA-3483].[recovery8files@onionmail.org].8base —
MD5:—
SHA256:—
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\$WinREAgent\Rollback.xml.id[26B799FA-3483].[recovery8files@onionmail.org].8basebinary
MD5:42E5AD76D7C0C411B116386596BAE6E0
SHA256:A6799FB73B190312CAB3793FC65DFAF8BD5039E034F6DD789B6959F93B06A7CD
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1000\desktop.ini.id[26B799FA-3483].[recovery8files@onionmail.org].8basebinary
MD5:58C17E4CFDA367332E474E9E8D642F9C
SHA256:F48A3C2A1DB7066BC3796E69FD4E3885E8CC412E301D8F93105E556E7A301ECA
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\$WinREAgent\Backup\boot.sdi.id[26B799FA-3483].[recovery8files@onionmail.org].8basesdi
MD5:22D9945B4AAE36DD59620A918F2E65F4
SHA256:CD2C00CE027687CE4A8BDC967F26A8AB82F651C9BECD703658BA282EC49702BD
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.id[26B799FA-3483].[recovery8files@onionmail.org].8basebinary
MD5:9AA715DC61EB6A0735FDD22E4663A491
SHA256:AEFF0D5BDFFD7A75201A4ED2F97645B90243B38B56B29A3F171C434A7CBD4C6A
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\$Recycle.Bin\S-1-5-18\desktop.ini.id[26B799FA-3483].[recovery8files@onionmail.org].8basebinary
MD5:7FAD8192357A677ABF5826DC3DBB872A
SHA256:CF98D1EB9613556E2941FD4A653934389C982EBB6C0EF40A0C8C8BA7EB2B982B
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\found.000\dir0000.chk\UpdateSessionOrchestration.037.etl.id[26B799FA-3483].[recovery8files@onionmail.org].8basebinary
MD5:1AF8F02F1FB5AB3C1951D03ECAABE072
SHA256:DBE3CC8B262B1139F38E87DAC84EF4A0F8ACF29D8A243EE2BE5D93B80DDC5798
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\$WinREAgent\Backup\location.txt.id[26B799FA-3483].[recovery8files@onionmail.org].8basebinary
MD5:FB4F0C17FE35FF05B61F62F8AA87DF06
SHA256:9C6394F5C60DB5E1D51158E943629EBEAFDE7498118F41CE9BB9466044BD159B
37566597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exeC:\$WinREAgent\Backup\ReAgent.xml.id[26B799FA-3483].[recovery8files@onionmail.org].8basebinary
MD5:957C4C40846A03E74FAF2D856FB9D99E
SHA256:A3C6D9AADA5F4DC87870DE50D51A4D519845B7F04C22340DD8B1321F7ACDCC22
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
68
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
1972
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
6636
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
5532
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6232
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6636
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
1972
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4656
SearchApp.exe
104.126.37.184:443
r.bing.com
Akamai International B.V.
DE
unknown
5084
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3596
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1972
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4656
SearchApp.exe
104.126.37.179:443
r.bing.com
Akamai International B.V.
DE
unknown
4656
SearchApp.exe
204.79.197.222:443
fp.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
r.bing.com
  • 104.126.37.184
  • 104.126.37.185
  • 104.126.37.163
  • 104.126.37.176
  • 104.126.37.179
  • 104.126.37.161
  • 104.126.37.153
  • 104.126.37.177
  • 104.126.37.168
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.2
  • 20.190.159.68
  • 20.190.159.64
  • 40.126.31.71
  • 20.190.159.23
  • 20.190.159.75
whitelisted
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
k-ring.msedge.net
  • 13.107.18.254
unknown
fp-vp.azureedge.net
  • 152.199.19.161
unknown
go.microsoft.com
  • 184.30.17.189
whitelisted
self.events.data.microsoft.com
  • 13.89.179.14
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted

Threats

No threats detected
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6597018298aaac827abb1c58e4b6d7967993b4012eaa83b5540475e0f4f9d34f.exe