File name:

5c322c.msi

Full analysis: https://app.any.run/tasks/850cbf91-a4e8-4b8b-ae21-94a16281f65c
Verdict: Malicious activity
Threats:

MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations.

Malware Trends Tracker     >>>
Analysis date: December 12, 2024, 11:19:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
uac
stealer
metastealer
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Google Chrome 125.0.6422.113, Subject: Google Chrome, Author: Google LLC, Keywords: Installer, Template: Intel;1033, Revision Number: {CC659C51-85CC-445F-B840-187BCCCBE876}, Create Time/Date: Thu Jan 11 14:59:44 2024, Last Saved Time/Date: Thu Jan 11 14:59:44 2024, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (11.0.53.0), Security: 2
MD5:

EBF9AEC610FFB1A4CF2BC72722D2B7AA

SHA1:

C59E7409EBA5429321B9F1741DB9336DCDF6897D

SHA256:

66D7083B0C8F714AAA89BF29EAF6B26F8FBDE249948401D777F75C99865A9AE3

SSDEEP:

49152:eUEEDU0piMGINrKoeqCT7ZhHV9lpIlVBiwYJ8u+7gMDs6nR4B9V3NcAQKWDQuuI/:eU3Z91eBbzScJ8/gMDsW4Jtl9yJn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass User Account Control (ComputerDefaults)

      • ComputerDefaults.exe (PID: 3040)

    • Adds path to the Windows Defender exclusion list

      • systemtask.exe (PID: 4932)

    • METASTEALER has been detected (SURICATA)

      • systemtask.exe (PID: 4932)

    • Actions looks like stealing of personal data

      • systemtask.exe (PID: 4932)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6280)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6196)

    • Unpacks CAB file

      • expand.exe (PID: 3540)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3032)

    • Script adds exclusion path to Windows Defender

      • systemtask.exe (PID: 4932)

    • Starts POWERSHELL.EXE for commands execution

      • systemtask.exe (PID: 4932)

    • Uses SYSTEMINFO.EXE to read the environment

      • systemtask.exe (PID: 4932)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 6004)

    • Checks supported languages

      • msiexec.exe (PID: 6196)
      • setup.exe (PID: 4640)
      • msiexec.exe (PID: 3032)

    • Reads the computer name

      • msiexec.exe (PID: 6196)
      • msiexec.exe (PID: 3032)
      • systemtask.exe (PID: 4932)
      • setup.exe (PID: 4640)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6196)

    • Manages system restore points

      • SrTasks.exe (PID: 6252)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3032)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3032)

    • Process checks computer location settings

      • msiexec.exe (PID: 3032)

    • The process uses the downloaded file

      • msiexec.exe (PID: 3032)
      • powershell.exe (PID: 7024)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7024)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Installer (100)

EXIF

FlashPix

Title: Google Chrome 125.0.6422.113
Subject: Google Chrome
Author: Google LLC
Keywords: Installer
Template: Intel;1033
RevisionNumber: {CC659C51-85CC-445F-B840-187BCCCBE876}
CreateDate: 2024:01:11 14:59:44
ModifyDate: 2024:01:11 14:59:44
Pages: 200
Words: 12
Software: MSI Wrapper (11.0.53.0)
Security: Read-only recommended
CodePage: Windows Cyrillic
LocaleIndicator: 1033
Company: Google LLC
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
18
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs expand.exe no specs conhost.exe no specs setup.exe winver.exe no specs computerdefaults.exe #METASTEALER systemtask.exe powershell.exe no specs conhost.exe no specs systeminfo.exe no specs conhost.exe no specs tiworker.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3032C:\Windows\syswow64\MsiExec.exe -Embedding 147974643A02EF2543D3926F82C981A2C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3040"C:\WINDOWS\system32\computerdefaults.exe"C:\Windows\System32\ComputerDefaults.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Set Program Access and Computer Defaults Control Panel
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\computerdefaults.exe
c:\windows\system32\ntdll.dll
3540"C:\WINDOWS\system32\EXPAND.EXE" -R files.cab -F:* filesC:\Windows\SysWOW64\expand.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
LZ Expansion Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
4556\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—expand.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4640"C:\Users\admin\AppData\Local\Temp\MW-2bd2962c-91b0-4eae-9ba2-b23e8754c29f\files\setup.exe" /VERYSILENT /VERYSILENT C:\Users\admin\AppData\Local\Temp\MW-2bd2962c-91b0-4eae-9ba2-b23e8754c29f\files\setup.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\mw-2bd2962c-91b0-4eae-9ba2-b23e8754c29f\files\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4824C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
4932C:\Users\admin\AppData\Local\Microsoft\Windows\systemtask.exeC:\Users\admin\AppData\Local\Microsoft\Windows\systemtask.exe
ComputerDefaults.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\systemtask.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5892\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6004"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\5c322c.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
1603
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
14 807
Read events
14 622
Write events
172
Delete events
13

Modification events

(PID) Process:(6196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000073D3CCC4874CDB013418000078180000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000004936CFC4874CDB013418000078180000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000017C629C5874CDB013418000078180000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000017C629C5874CDB013418000078180000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000005A8E2EC5874CDB013418000078180000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000026F430C5874CDB013418000078180000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000FDAFB1C5874CDB013418000078180000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6196) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000D314B4C5874CDB0134180000FC180000E8030000010000000000000000000000A200C9A1153C4249B8AE52DF578EEF5500000000000000000000000000000000
(PID) Process:(6280) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000A5F7BFC5874CDB0188180000A4180000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
3
Suspicious files
19
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6196msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3540expand.exeC:\Users\admin\AppData\Local\Temp\MW-2bd2962c-91b0-4eae-9ba2-b23e8754c29f\files\setup.exe —
MD5:—
SHA256:—
4640setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\systemtask.exe —
MD5:—
SHA256:—
6196msiexec.exeC:\Windows\Temp\~DF36813DE4E7EF63A1.TMPbinary
MD5:671B813BE0EBDE53D56E439D703E4F43
SHA256:BB91B3203491E1B2CF60D71E3FC8DDDBA4F67402D58346357C976C3C3FB7C504
6196msiexec.exeC:\Windows\Installer\MSIA7A9.tmpbinary
MD5:47066AAEE53F8E10E79FD2A676AD115D
SHA256:5BD4F11305A3CDBE7809883B21D11AABB26F64779359890B86B95F955FD6323B
6196msiexec.exeC:\Windows\Temp\~DFBC0B32881F66D55A.TMPbinary
MD5:E38DB566EA4411D8584F3877C710C5A1
SHA256:AC11C4C79EAE788416255EBB143F4E5CEF587F0F86C0C0548531BEDFBA73BBA9
6196msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{a1c900a2-3c15-4942-b8ae-52df578eef55}_OnDiskSnapshotPropbinary
MD5:E71B542853282511F1D491B0D9CFAEA7
SHA256:9F60B0BF18BD6732727AEE06961E47FA26F4E101458BFF582EBD16F9AE42E1CB
6196msiexec.exeC:\Windows\Installer\MSIB97F.tmpexecutable
MD5:0C8921BBCC37C6EFD34FAF44CF3B0CB5
SHA256:FD622CF73EA951A6DE631063ABA856487D77745DD1500ADCA61902B8DDE56FE1
3032msiexec.exeC:\Users\admin\AppData\Local\Temp\MW-2bd2962c-91b0-4eae-9ba2-b23e8754c29f\files.cabcompressed
MD5:FA946FBC8ADB45FF63876866DFC4BAF4
SHA256:17E2B8DE9EF45AD708ADEEEE5A98CA753751E2E7ECFE83C53DDA44D6E04E354A
3032msiexec.exeC:\Users\admin\AppData\Local\Temp\MW-2bd2962c-91b0-4eae-9ba2-b23e8754c29f\msiwrapper.inibinary
MD5:69B03E8B16861B807C048BD4C39E36BF
SHA256:459235DE151DE2960ECFF0F569D706D567C700529C658B43ED68ADCC798159C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
42
DNS requests
564
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
716
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3208
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3208
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6672
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4932
systemtask.exe
GET
200
166.1.160.237:443
http://aikmouciiqgecoqi.xyz:443/api/client_hello
unknown
—
—
unknown
4932
systemtask.exe
GET
—
166.1.160.237:443
http://aikmouciiqgecoqi.xyz:443/avast_update
unknown
—
—
unknown
4932
systemtask.exe
POST
200
166.1.160.237:443
http://aikmouciiqgecoqi.xyz:443/api/client/new
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
440
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
716
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
716
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
716
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.132
  • 2.23.209.186
  • 2.23.209.189
  • 2.23.209.131
  • 2.23.209.185
  • 2.23.209.133
  • 2.23.209.135
  • 2.23.209.137
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.2
  • 20.190.159.73
  • 20.190.159.75
  • 40.126.31.73
whitelisted
go.microsoft.com
  • 23.43.62.58
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
4932
systemtask.exe
Misc activity
ET HUNTING EXE Base64 Encoded potential malware
4932
systemtask.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
4932
systemtask.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
4932
systemtask.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
4932
systemtask.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
4932
systemtask.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
7 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
5c322c.msi