File name:

7z2408-x64.exe

Full analysis: https://app.any.run/tasks/8ac83d5b-bd95-45e1-8e59-4bd54e44d8ca
Verdict: Malicious activity
Analysis date: August 17, 2024, 11:11:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
xor-url
generic
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0330D0BD7341A9AFE5B6D161B1FF4AA1

SHA1:

86918E72F2E43C9C664C246E62B41452D662FBF3

SHA256:

67CB9D3452C9DD974B04F4A5FD842DBCBA8184F2344FF72E3662D7CDB68B099B

SSDEEP:

49152:UPLMk+KWip9P7ljC3PFfdnIQByyrc+/MgxxFC7yMiGocn3Hidzg8EKhZ3szoWaq/:Cp5x7l4fBII3JhkiE7GZ3szo01Rz7MxU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XORed URL has been found (YARA)

      • Spyroid VIP.exe (PID: 5084)
      • Spyroid VIP.exe (PID: 6284)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Spyroid VIP.exe (PID: 5084)
      • Spyroid VIP.exe (PID: 6284)

    • Process drops legitimate windows executable

      • 7zG.exe (PID: 3520)

    • Drops the executable file immediately after the start

      • 7zG.exe (PID: 3520)
      • 7z2408-x64.exe (PID: 6428)

    • Executable content was dropped or overwritten

      • 7zG.exe (PID: 3520)
      • 7z2408-x64.exe (PID: 6428)

    • Creates a software uninstall entry

      • 7z2408-x64.exe (PID: 6428)

    • Creates/Modifies COM task schedule object

      • 7z2408-x64.exe (PID: 6428)

    • Drops 7-zip archiver for unpacking

      • 7z2408-x64.exe (PID: 6428)

    • Reads the date of Windows installation

      • Spyroid VIP.exe (PID: 5084)

    • Application launched itself

      • Spyroid VIP.exe (PID: 5084)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 6944)

    • The process checks if it is being run in the virtual environment

      • Spyroid VIP.exe (PID: 6284)

  • INFO

    • Creates files in the program directory

      • Spyroid VIP.exe (PID: 5084)
      • 7z2408-x64.exe (PID: 6428)
      • Spyroid VIP.exe (PID: 6284)

    • Checks supported languages

      • Spyroid VIP.exe (PID: 5084)
      • 7zG.exe (PID: 3520)
      • 7z2408-x64.exe (PID: 6428)
      • Spyroid VIP.exe (PID: 6284)
      • TextInputHost.exe (PID: 6264)

    • Reads the machine GUID from the registry

      • Spyroid VIP.exe (PID: 5084)
      • Spyroid VIP.exe (PID: 6284)

    • Reads the computer name

      • Spyroid VIP.exe (PID: 5084)
      • 7zG.exe (PID: 3520)
      • 7z2408-x64.exe (PID: 6428)
      • Spyroid VIP.exe (PID: 6284)
      • TextInputHost.exe (PID: 6264)

    • Manual execution by a user

      • Spyroid VIP.exe (PID: 5084)
      • 7zG.exe (PID: 3520)
      • Taskmgr.exe (PID: 1920)
      • Taskmgr.exe (PID: 6436)

    • Process checks computer location settings

      • Spyroid VIP.exe (PID: 5084)

    • Reads Environment values

      • Spyroid VIP.exe (PID: 6284)

    • Disables trace logs

      • Spyroid VIP.exe (PID: 6284)

    • Checks proxy server information

      • Spyroid VIP.exe (PID: 6284)

    • Reads the software policy settings

      • Spyroid VIP.exe (PID: 6284)

    • Reads CPU info

      • Spyroid VIP.exe (PID: 6284)

    • Reads the time zone

      • Spyroid VIP.exe (PID: 6284)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 1920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(5084) Spyroid VIP.exe
Decrypted-URLs (2)https://eagleauthservice.000webhostapp.com/KeyAuth.txt
https://www.github.com/
(PID) Process(6284) Spyroid VIP.exe
Decrypted-URLs (2)https://eagleauthservice.000webhostapp.com/KeyAuth.txt
https://www.github.com/
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:11 13:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 24064
UninitializedDataSize: -
EntryPoint: 0x7294
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 24.8.0.0
ProductVersionNumber: 24.8.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Igor Pavlov
FileDescription: 7-Zip Installer
FileVersion: 24.08
InternalName: 7zipInstall
LegalCopyright: Copyright (c) 1999-2024 Igor Pavlov
OriginalFileName: 7zipInstall.exe
ProductName: 7-Zip
ProductVersion: 24.08
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
11
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
1920"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3520"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\admin\Desktop\*\" -spe -an -ai#7zMap27125:506:7zEvent201C:\Program Files\7-Zip\7zG.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip GUI
Exit code:
0
Version:
24.08
Modules
Images
c:\program files\7-zip\7zg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
3972C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5084"C:\Users\admin\Desktop\Spyroid Vip [EagleSpy V4] - Copy\Spyroid VIP.exe" C:\Users\admin\Desktop\Spyroid Vip [EagleSpy V4] - Copy\Spyroid VIP.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
4.0.0.0
Modules
Images
c:\users\admin\desktop\spyroid vip [eaglespy v4] - copy\spyroid vip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
xor-url
(PID) Process(5084) Spyroid VIP.exe
Decrypted-URLs (2)https://eagleauthservice.000webhostapp.com/KeyAuth.txt
https://www.github.com/
6264"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
6284"C:\Users\admin\Desktop\Spyroid Vip [EagleSpy V4] - Copy\Spyroid VIP.exe" C:\Users\admin\Desktop\Spyroid Vip [EagleSpy V4] - Copy\Spyroid VIP.exe
Spyroid VIP.exe
User:
admin
Integrity Level:
HIGH
Version:
4.0.0.0
Modules
Images
c:\users\admin\desktop\spyroid vip [eaglespy v4] - copy\spyroid vip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
xor-url
(PID) Process(6284) Spyroid VIP.exe
Decrypted-URLs (2)https://eagleauthservice.000webhostapp.com/KeyAuth.txt
https://www.github.com/
6380"C:\Users\admin\Desktop\7z2408-x64.exe" C:\Users\admin\Desktop\7z2408-x64.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Installer
Exit code:
3221226540
Version:
24.08
Modules
Images
c:\users\admin\desktop\7z2408-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6428"C:\Users\admin\Desktop\7z2408-x64.exe" C:\Users\admin\Desktop\7z2408-x64.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Installer
Exit code:
0
Version:
24.08
Modules
Images
c:\users\admin\desktop\7z2408-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6436"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
Total events
13 800
Read events
13 726
Write events
73
Delete events
1

Modification events

(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\7-Zip
Operation:writeName:Path64
Value:
C:\Program Files\7-Zip\
(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\7-Zip
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\7-Zip
Operation:writeName:Path64
Value:
C:\Program Files\7-Zip\
(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\7-Zip
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{23170F69-40C1-278A-1000-000100020000}
Value:
7-Zip Shell Extension
(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{23170F69-40C1-278A-1000-000100020000}
Value:
7-Zip Shell Extension
(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
(PID) Process:(6428) 7z2408-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
Operation:writeName:DisplayName
Value:
7-Zip 24.08 (x64)
Executable files
25
Suspicious files
28
Text files
556
Unknown types
1

Dropped files

PID
Process
Filename
Type
64287z2408-x64.exeC:\Program Files\7-Zip\descript.iontext
MD5:EB7E322BDC62614E49DED60E0FB23845
SHA256:1DA513F5A4E8018B9AE143884EB3EAF72454B606FD51F2401B7CFD9BE4DBBF4F
64287z2408-x64.exeC:\Program Files\7-Zip\Lang\ar.txttext
MD5:5747381DC970306051432B18FB2236F2
SHA256:85A26C7B59D6D9932F71518CCD03ECEEBA42043CB1707719B72BFC348C1C1D72
64287z2408-x64.exeC:\Program Files\7-Zip\History.txttext
MD5:86D07103FB8D487D17D33974C0BDC0C2
SHA256:EE3D0EB585DA90D0BB36A2F3D2A7FB5FDCE5336141EA8F779D7450D8A4B16C42
64287z2408-x64.exeC:\Program Files\7-Zip\Lang\ast.txttext
MD5:1CF6411FF9154A34AFB512901BA3EE02
SHA256:F5F2174DAF36E65790C7F0E9A4496B12E14816DAD2EE5B1D48A52307076BE35F
64287z2408-x64.exeC:\Program Files\7-Zip\Lang\af.txttext
MD5:DF216FAE5B13D3C3AFE87E405FD34B97
SHA256:9CF684EA88EA5A479F510750E4089AEE60BBB2452AA85285312BAFCC02C10A34
64287z2408-x64.exeC:\Program Files\7-Zip\Lang\an.txttext
MD5:F16218139E027338A16C3199091D0600
SHA256:3AB9F7AACD38C4CDE814F86BC37EEC2B9DF8D0DDDB95FC1D09A5F5BCB11F0EEB
64287z2408-x64.exeC:\Program Files\7-Zip\Lang\cs.txttext
MD5:DBDCFC996677513EA17C583511A5323B
SHA256:A6E329F37ACA346EF64F2C08CC36568D5383D5B325C0CAF758857ED3FF3953F2
64287z2408-x64.exeC:\Program Files\7-Zip\Lang\cy.txttext
MD5:6BDF25354B531370754506223B146600
SHA256:470EAF5E67F5EAD5B8C3ECC1B5B21B29D16C73591EB0047B681660346E25B3FB
64287z2408-x64.exeC:\Program Files\7-Zip\7-zip.chmchm
MD5:99B88F4D6D13713053DB06B449ED6A9F
SHA256:F830DDC5280D00E1CB160F9E5DD114292D5EFEF66C23C3C03C224894250BAC2F
64287z2408-x64.exeC:\Program Files\7-Zip\Lang\az.txttext
MD5:9CD3A23CA6F66F570607F63BE6AA0001
SHA256:1DA941116E20E69F61A4A68481797E302C11FCF462CA7203A565588B26011615
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
55
DNS requests
26
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
314 b
whitelisted
1028
SystemSettings.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
2636
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
2636
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
6876
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
6948
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
2180
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
1028
SystemSettings.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
314 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5388
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2424
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5336
SearchApp.exe
104.126.37.161:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2636
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2636
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 104.126.37.161
  • 104.126.37.171
  • 104.126.37.131
  • 104.126.37.146
  • 104.126.37.160
  • 104.126.37.153
  • 104.126.37.152
  • 104.126.37.163
  • 104.126.37.137
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.181
  • 2.23.209.133
  • 2.23.209.189
  • 2.23.209.187
  • 2.23.209.185
  • 2.23.209.141
  • 2.23.209.130
  • 2.23.209.131
  • 2.23.209.177
  • 2.23.209.179
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.23
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
th.bing.com
  • 104.126.37.177
  • 104.126.37.146
  • 104.126.37.152
  • 104.126.37.153
  • 104.126.37.161
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.163
  • 104.126.37.176
whitelisted
arc.msn.com
  • 20.223.36.55
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.86.201.138
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain in DNS Lookup (keyauth .win)
6284
Spyroid VIP.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain (keyauth .win) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7z2408-x64.exe