File name:

4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe

Full analysis: https://app.any.run/tasks/161872dd-5ece-4093-8374-4a587a323b50
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 18:03:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

FC20C19D61E465E7B307A8E498DCF540

SHA1:

72A9C5E4FAEA78F4506EFE162804AD7ED53D2D89

SHA256:

6E116EF59D775F252828C0B58DCACF7F8D3500D19A35224E9EF4DC7FABAF9A89

SSDEEP:

98304:uMyzAbyJuYEyD/WbPrpkkpaOhrnRCWfmvE2mVG4FuZSCRNWWB0U:ux

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)

    • Actions looks like stealing of personal data

      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)

    • Steals credentials from Web Browsers

      • 1cst.exe (PID: 7832)

    • Changes the autorun value in the registry

      • 1cext.exe (PID: 7700)

  • SUSPICIOUS

    • Uses ATTRIB.EXE to modify file attributes

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)

    • Uses WMIC.EXE to obtain Windows Installer data

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)

    • Read disk information to detect sandboxing environments

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)

    • Uses WMIC.EXE to obtain a list of video controllers

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 7300)
      • WMIC.exe (PID: 7816)
      • WMIC.exe (PID: 8136)
      • WMIC.exe (PID: 3272)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 7588)
      • WMIC.exe (PID: 1660)
      • WMIC.exe (PID: 8060)
      • WMIC.exe (PID: 8176)

    • Executable content was dropped or overwritten

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)

    • Uses TASKKILL.EXE to kill Browsers

      • 1cext.exe (PID: 7700)

    • Uses WMIC.EXE to obtain operating system information

      • 1cst.exe (PID: 7832)

    • Uses TASKKILL.EXE to kill process

      • 1cext.exe (PID: 7700)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 5528)

    • Uses WMIC.EXE to obtain CPU information

      • 1cst.exe (PID: 7832)

  • INFO

    • Checks supported languages

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)
      • identity_helper.exe (PID: 8492)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)

    • Reads the computer name

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)
      • identity_helper.exe (PID: 8492)

    • Reads the machine GUID from the registry

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 7300)
      • WMIC.exe (PID: 7588)
      • WMIC.exe (PID: 7816)
      • WMIC.exe (PID: 8060)
      • WMIC.exe (PID: 1660)
      • WMIC.exe (PID: 5528)
      • WMIC.exe (PID: 8136)
      • WMIC.exe (PID: 7504)
      • WMIC.exe (PID: 8176)
      • WMIC.exe (PID: 3272)

    • Reads the software policy settings

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)
      • 1cext.exe (PID: 7700)
      • 1cst.exe (PID: 7832)

    • Create files in a temporary directory

      • 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe (PID: 4024)

    • Application launched itself

      • chrome.exe (PID: 1164)
      • msedge.exe (PID: 1616)

    • Creates files or folders in the user directory

      • 1cext.exe (PID: 7700)

    • Reads Environment values

      • identity_helper.exe (PID: 8492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 2866688
InitializedDataSize: 269824
UninitializedDataSize: -
EntryPoint: 0x74300
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
204
Monitored processes
77
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe attrib.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs wmic.exe no specs conhost.exe no specs svchost.exe 1cext.exe attrib.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs 1cst.exe attrib.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs attrib.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs wmic.exe no specs chrome.exe conhost.exe no specs taskkill.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe no specs msedge.exe chrome.exe no specs chrome.exe wmic.exe no specs conhost.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs wmic.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmic.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\Users\admin\AppData\Local\OEMextensions\chrome16411C:\Program Files\Google\Chrome\Application\chrome.exe
1cext.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1300"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4368 --field-trial-handle=2576,i,2511808031223631464,495728148628525226,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension=C:\Users\admin\AppData\Local\OEMextensions\edge11551C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
1cext.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1660wmic path win32_VideoController get nameC:\Windows\System32\wbem\WMIC.exe—1cst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
2088taskkill /IM brave.exe /FC:\Windows\System32\taskkill.exe—1cext.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2320"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5088 --field-trial-handle=1924,i,4863623591427512355,15981178711435997579,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3096"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5312 --field-trial-handle=2576,i,2511808031223631464,495728148628525226,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
20 603
Read events
20 569
Write events
33
Delete events
1

Modification events

(PID) Process:(7700) 1cext.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Explorer Helper Server
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Protect\ExplorerServ.exe 4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1164) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
Executable files
38
Suspicious files
630
Text files
143
Unknown types
0

Dropped files

PID
Process
Filename
Type
77001cext.exeC:\Users\admin\AppData\Local\OEMextensions\chrome16411\content.jsbinary
MD5:53688E78F54E55D20819B004425DB264
SHA256:D903E4C2D36F0C614396570F432167355930AC5C54A8EC445D86EAED9BFE8173
40244c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exeC:\Users\admin\AppData\Local\Temp\1cext.exeexecutable
MD5:6F0CEEC9C5A5992FD919C7746948C2B6
SHA256:338FF9FEB6C25BADD364A33FFACAB8760468FE494F2AA074BA768C02CB4AF4AC
77001cext.exeC:\Users\admin\AppData\Roaming\Microsoft\Protect\ExplorerServ.exeexecutable
MD5:6F0CEEC9C5A5992FD919C7746948C2B6
SHA256:338FF9FEB6C25BADD364A33FFACAB8760468FE494F2AA074BA768C02CB4AF4AC
77001cext.exeC:\Users\admin\AppData\Local\OEMextensions\brave65523\rulesets\default.jsontext
MD5:F2065E6D7F9F65731AAC97EB71B5A1F7
SHA256:B04C583CC9AC79A42891451141307C399DB92284244F39B06413EB4F11516F2D
77001cext.exeC:\Users\admin\AppData\Local\OEMextensions\chrome16411\images\16.pngimage
MD5:04E602DDB847DA03F7CD59598CA5BED2
SHA256:02B7A381E54362D485BD20ACC595222E64D989B02EEFA4370283BE7B175F2A61
77001cext.exeC:\Users\admin\AppData\Local\OEMextensions\chrome16411\_metadata\generated_indexed_rulesets\_ruleset1binary
MD5:A05A1B55CABAC311C7EBA139D482D96A
SHA256:32C89472505B05D528206654B1BAA9CE2608B7794DAEB77E560423FC4C89DF21
77001cext.exeC:\Users\admin\AppData\Local\OEMextensions\chrome16411\images\32.pngimage
MD5:39B2B26730B93D723A15F35B41A84028
SHA256:4ED12C4758865892FBADFEFD553DBB44B813B676BC1F149381CE821D59FBF805
77001cext.exeC:\Users\admin\AppData\Local\OEMextensions\chrome16411\images\64.pngimage
MD5:9F691848E0D013EAC8ABB82C179887A5
SHA256:41C4A25AE8433A2281D0127E264DAAD4BD0825C2076CF4C53E41F4003888442E
77001cext.exeC:\Users\admin\AppData\Local\OEMextensions\chrome16411\script.jstext
MD5:E50EC9CC2A871CCC72707A3DF9BAD15B
SHA256:53000C6AF29E94AF330C7360D683B0A8DC2EE63DF954F1FCEDE63FA8BCBE88A0
77001cext.exeC:\Users\admin\AppData\Local\OEMextensions\chrome16411\images\128.pngimage
MD5:97E5A249D1C702F504072CC3D66A4DF7
SHA256:FB5DF7AB5E7450AB03312B504C1CF152BCB64350EC8BF8089CD7A6B4BC419B27
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
99
DNS requests
102
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.25.54.100:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4024
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7700
1cext.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7832
1cst.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7832
1cst.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
8716
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8716
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.25.54.100:80
www.microsoft.com
Telgua
SV
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4024
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe
188.114.97.3:443
sellyourniggersfor.me
CLOUDFLARENET
NL
unknown
4024
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe
172.67.74.152:443
api.ipify.org
CLOUDFLARENET
US
shared
4024
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
4024
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe
188.114.96.3:443
sellyourniggersfor.me
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 184.25.54.100
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.110
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
sellyourniggersfor.me
  • 188.114.97.3
  • 188.114.96.3
unknown
api.ipify.org
  • 172.67.74.152
  • 104.26.13.205
  • 104.26.12.205
shared
ip-api.com
  • 208.95.112.1
whitelisted
plus-pavel.com
  • 188.114.96.3
  • 188.114.97.3
unknown
clientservices.googleapis.com
  • 142.250.185.195
whitelisted

Threats

PID
Process
Class
Message
4024
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
4024
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
4024
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
4024
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
7700
1cext.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
7700
1cext.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
7700
1cext.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4c6a1a7f-73bb-45f2-87f4-57b1cec6f5b2.exe