File name:

6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe

Full analysis: https://app.any.run/tasks/acf1318c-584e-4754-8eff-3c738d77168e
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: September 14, 2024, 18:43:30
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ransomware
sodinokibi
revil
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

44C753ED1FAEC948B0D98BC9BA047469

SHA1:

1AA2D575752DCFA73EA8BD2FA666E18588BE353C

SHA256:

6628DE7FFBBE168A4FA9FF0A1A29B54E88A32E5963DB0DD1AEA4B80102C8CE01

SSDEEP:

6144:zona6Yqyo8L8aGub62Vi4fd2mgwSQMtI:ziYqD840fdL6tt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SODINOKIBI has been detected (YARA)

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)

    • Renames files like ransomware

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)

  • SUSPICIOUS

    • Base64-obfuscated command line is found

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5116)

    • Creates file in the systems drive root

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)

    • Reads security settings of Internet Explorer

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 4668)

    • Application launched itself

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 4668)

    • Starts POWERSHELL.EXE for commands execution

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)

    • BASE64 encoded PowerShell command has been detected

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)

  • INFO

    • Checks supported languages

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 4668)
      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)

    • The process uses the downloaded file

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 4668)

    • Creates files in the program directory

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)

    • Create files in a temporary directory

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)

    • Reads the computer name

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 6696)
      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 4668)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3304)

    • Process checks computer location settings

      • 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe (PID: 4668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:02:11 20:03:39+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 97280
InitializedDataSize: 72704
UninitializedDataSize: -
EntryPoint: 0x10ae9
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
217
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe no specs #SODINOKIBI 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe powershell.exe no specs conhost.exe no specs unsecapp.exe no specs vssvc.exe no specs COpenControlPanel no specs

Process information

PID
CMD
Path
Indicators
Parent process
2268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3304powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4668"C:\Users\admin\AppData\Local\Temp\6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe" C:\Users\admin\AppData\Local\Temp\6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5116C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6696"C:\Users\admin\AppData\Local\Temp\6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe" C:\Users\admin\AppData\Local\Temp\6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6924C:\WINDOWS\system32\wbem\unsecapp.exe -EmbeddingC:\Windows\System32\wbem\unsecapp.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Sink to receive asynchronous callbacks for WMI client application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
7700C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
Total events
5 116
Read events
5 110
Write events
6
Delete events
0

Modification events

(PID) Process:(6696) 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GitForWindows
Operation:writeName:aaH
Value:
31610082D3961B047CF53D07CE4D4F43EAE8AA37DB3BD9688094656A40FA0826
(PID) Process:(6696) 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GitForWindows
Operation:writeName:fdle
Value:
E9FB0F0F2A4BC1035B5AD8B3E5C8C9C3F2BDA46FD43CA496ACAE251B90E8EE17
(PID) Process:(6696) 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GitForWindows
Operation:writeName:1TfXk
Value:
6E9906AEA678F14A514399A9B94C867693C228083E6FD519E19A1AA26B17C583D05149CACD7C5EC5A270D18158A47E967D3D293B91CF340465128610B583847FDB3823348D3C67E89C45E70234FCF7760CC4BC8682C82E87
(PID) Process:(6696) 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GitForWindows
Operation:writeName:2YEdLY
Value:
FFA9CA1B7AA9F9B7798B6B0BEFC90A25F8F7F81A8C5B5F21C753F7085D18AB38A5B125B0CD0E444297B582E55FB410C9BEBDE44611EC4AE6A3D7E7208D843C381EE946444BA37EDBD3423FF5541535C47F7878C136207261
(PID) Process:(6696) 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GitForWindows
Operation:writeName:AaZW1s3
Value:
.q4ov8094
(PID) Process:(6696) 6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GitForWindows
Operation:writeName:QaUXNv2P
Value:
BE8193EF2EDF64CFBA62E995427D93A0F5FA04AB148488EE499B565E74672472D7EFC56087AF323F07EFA89FE55457EF21DBEB8ED69587FFFDB33D419CADD8C35731ACE6E90A31CD160DB104C8A3BFD62436BD8F859E5B071E8AF129C112A8BFB9CCFF83B80017197C4DD037C59DD419F891F0263D72CB589E80B6984445B5716AC09116CFC26DD43590D8F41CED8BE378731E6CADB47214987CC36706AB22F8E5DA95796D88C7F135D1078EC282A586A15DF17B02559C8511623C978035F18B89D6B1777626371FAE34149568229E81A6FB6C8C2A5CF65E1E437341ACFA91DDE6B795EAB4ECC33EBF00889914700E8D0D97626181ED1D695B5995DB519EFF242006ECB4FE6C541A7095FDA0A020B1A5246A8D3E988C0FF17AF4994A5566CD43D2D6235B7779BAEE21327BD4ECA99F8F76EB8D86116B0115C31D3B7F73F58AA98E0D81D53C74E5ED6216F616D81341CE3C465F9D9E2D5E95CA852726DBF3424008C76C0D3AA29F069533A1A5A784AF65942FDF89381C2AE8A868277F0B6E42859663ADB75A5A256AE63372B7A22F310CE8265A7B204081836675087FECE03D3F03352265D892094AF71EE514AA6145B430D0F44CDC689C92C5BD8D0E95AC604616C406D7B9C71859CA53A210341F7ED3028D354368A99ACDDDF48606C88A6DF80A408D2E8A4B583997D0DA13563D4CA5D8C0A9FC7704106B37E637DD40097602309ACD57477C2F82ADB3E7C7EFF4B4465F1EFA935D19B72EE55FBCB929C2978ABE311F5CBCC20EABB51F3522A180017635350B62C502E1BF400EAE62F083A9B027AC4889C03B72FC638046B29587D07444A487229F1915EBC5B124D6B59E1D67C8F6D2651B4A4E898EF4C729EAB3EC7B1533838F1B889AA5EAEF32251B21FA93A8165BF4660AFF27824D819B431B11A4E094E09B800F869C8441D3A2C8AF5243FCFE2FFA5E3F219D5C4E8EA90E321EBC1526AAF0911B5892A41D8CA0176188C45013C33EC1973C8C8B75C654260EBEE2279D6B1F9AB900393DA5A98388F66598761BC6FD88F30DAF0B6C14E641BCDE0D9D521E683955BB72D4D313B800DDAD800B2EF101380A80716E4AEA20000148F9888A0679D207DA874B282C3B3661D4CE346AFBAEB7033505738D95BCC8790A0CA4FD3E7A8141CA4760B00B3E55A4486E91B0B6816077FA6BDDAE63B9D2079E363D5F3239CE3DCBDDC0C5304EF12F2F713E0F9FCDA40689ECDB17DC27BEC55696D81635A89865639A576D6B35B5142816AC95B9AD0569D383BCF3668C9299884E3866222348235D8BAAAEB9C02A3535B729F503E64878A018211FADA1C0587EE33543BE37CCCE00904654759AAB4558F7CCF803C4992FFE162EEB3FAD69D24E227922E81EADC15FFB381B316CB4A5977F342919EB14D64B10273CBFCEC165
Executable files
0
Suspicious files
235
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
66966628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeC:\Program Files\q4ov8094-readme.txtbinary
MD5:C877EA84D2A243F98C637D6398CAC26C
SHA256:835F7121CBCDBC97FF6248A8B7FEEBDEAC6158AD2B7B1CEA22E95AB23CB4B690
66966628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeC:\BOOTNXTbinary
MD5:F74B55AC49B9F6590CD1C89DA48425D9
SHA256:92AFF922018CFFEE4596CF9B5113CD641776E909E2E0CC4A552F56FE0F9AEEDE
3304powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:B56343F61395809CD442B5294E02D927
SHA256:C46BDE5C90D113F47B1E1C51DDD06E11A6DADBDA2753A2470D311F2EF2E8481D
66966628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeC:\BOOTNXT.q4ov8094binary
MD5:F74B55AC49B9F6590CD1C89DA48425D9
SHA256:92AFF922018CFFEE4596CF9B5113CD641776E909E2E0CC4A552F56FE0F9AEEDE
66966628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeC:\$WinREAgent\q4ov8094-readme.txtbinary
MD5:C877EA84D2A243F98C637D6398CAC26C
SHA256:835F7121CBCDBC97FF6248A8B7FEEBDEAC6158AD2B7B1CEA22E95AB23CB4B690
66966628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeC:\bootTel.datbinary
MD5:CBD4BDC3A85A23E5D6DA7C5EF6B03B19
SHA256:ACF094D5A1D5F455843B728C4BB1BF8E0CB77198D7F2D25D807CEF5A12743FB0
66966628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeC:\Program Files (x86)\q4ov8094-readme.txtbinary
MD5:C877EA84D2A243F98C637D6398CAC26C
SHA256:835F7121CBCDBC97FF6248A8B7FEEBDEAC6158AD2B7B1CEA22E95AB23CB4B690
66966628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeC:\bootTel.dat.q4ov8094binary
MD5:CBD4BDC3A85A23E5D6DA7C5EF6B03B19
SHA256:ACF094D5A1D5F455843B728C4BB1BF8E0CB77198D7F2D25D807CEF5A12743FB0
66966628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeC:\q4ov8094-readme.txtbinary
MD5:C877EA84D2A243F98C637D6398CAC26C
SHA256:835F7121CBCDBC97FF6248A8B7FEEBDEAC6158AD2B7B1CEA22E95AB23CB4B690
66966628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exeC:\found.000\q4ov8094-readme.txtbinary
MD5:C877EA84D2A243F98C637D6398CAC26C
SHA256:835F7121CBCDBC97FF6248A8B7FEEBDEAC6158AD2B7B1CEA22E95AB23CB4B690
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
120
DNS requests
107
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1752
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
2.16.97.136:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7664
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7664
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7880
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d027e63e-31f9-4887-9ef0-9bc042390907?P1=1726923107&P2=404&P3=2&P4=WB249YsFuXVoU3qmRcY3Bqw7raNu8YiCif3aaqJinUN54tsm1PHdizNa2PWQRFglWLx%2fZb6HyB2BUTQN7NUDqQ%3d%3d
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
7880
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d027e63e-31f9-4887-9ef0-9bc042390907?P1=1726923107&P2=404&P3=2&P4=WB249YsFuXVoU3qmRcY3Bqw7raNu8YiCif3aaqJinUN54tsm1PHdizNa2PWQRFglWLx%2fZb6HyB2BUTQN7NUDqQ%3d%3d
unknown
—
—
whitelisted
7880
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d027e63e-31f9-4887-9ef0-9bc042390907?P1=1726923107&P2=404&P3=2&P4=WB249YsFuXVoU3qmRcY3Bqw7raNu8YiCif3aaqJinUN54tsm1PHdizNa2PWQRFglWLx%2fZb6HyB2BUTQN7NUDqQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
608
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6264
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
2.16.97.136:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
104.126.37.35:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5336
SearchApp.exe
104.126.37.42:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1752
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 2.16.97.136
  • 23.218.209.163
whitelisted
google.com
  • 142.250.186.142
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
www.bing.com
  • 104.126.37.35
  • 104.126.37.42
  • 104.126.37.34
  • 104.126.37.43
  • 104.126.37.51
  • 104.126.37.41
whitelisted
r.bing.com
  • 104.126.37.42
  • 104.126.37.35
  • 104.126.37.43
  • 104.126.37.34
  • 104.126.37.41
  • 104.126.37.51
whitelisted
th.bing.com
  • 104.126.37.42
  • 104.126.37.35
  • 104.126.37.43
  • 104.126.37.34
  • 104.126.37.51
  • 104.126.37.41
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.71
  • 40.126.31.69
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
browser.pipe.aria.microsoft.com
  • 104.208.16.89
  • 52.168.117.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe