File name:

collabvm installer 2022.exe

Full analysis: https://app.any.run/tasks/60871775-4414-46d5-b2dc-eb6a1925e349
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: April 23, 2025, 18:01:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xred
backdoor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

F36AF1FB666C1FFB8250CCE8AF6EF8B4

SHA1:

51BFB14F005ACECBD86E69446BF48AA0C0A0E157

SHA256:

6FE746E0D4B59A5EB103FCCB5BC673A0F8CDD939FC3E647CE2D3D76F1547215E

SSDEEP:

49152:y+bwsA0EvN2Cy5w2dTs+e8JBNV+VO2ohG8o4iRmy56fAlXLTfiaGwbjlW48WYNx1:y+U11Njy5ZiCz3nMmejbVlpeP0vC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XRED mutex has been found

      • collabvm.exe (PID: 4696)
      • Synaptics.exe (PID: 1188)
      • musicplayer.exe (PID: 1512)

    • Changes the autorun value in the registry

      • collabvm.exe (PID: 4696)
      • my music.exe (PID: 6148)

  • SUSPICIOUS

    • The executable file from the user directory is run by the CMD process

      • collabvm.exe (PID: 4696)
      • musicplayer.exe (PID: 1512)

    • Reads security settings of Internet Explorer

      • musicplayer.exe (PID: 1512)
      • collabvm.exe (PID: 4696)
      • collabvm installer 2022.exe (PID: 7036)
      • ._cache_musicplayer.exe (PID: 6724)
      • Synaptics.exe (PID: 1188)

    • Executable content was dropped or overwritten

      • collabvm installer 2022.exe (PID: 7036)
      • collabvm.exe (PID: 4696)
      • musicplayer.exe (PID: 1512)
      • Synaptics.exe (PID: 1188)
      • ._cache_musicplayer.exe (PID: 6724)

    • Executing commands from a ".bat" file

      • collabvm installer 2022.exe (PID: 7036)

    • Starts CMD.EXE for commands execution

      • collabvm installer 2022.exe (PID: 7036)

    • There is functionality for taking screenshot (YARA)

      • collabvm installer 2022.exe (PID: 7036)

    • Starts itself from another location

      • ._cache_musicplayer.exe (PID: 6724)

    • Reads the date of Windows installation

      • ._cache_musicplayer.exe (PID: 6724)

  • INFO

    • Create files in a temporary directory

      • collabvm installer 2022.exe (PID: 7036)
      • musicplayer.exe (PID: 1512)
      • collabvm.exe (PID: 4696)
      • Synaptics.exe (PID: 1188)

    • Checks supported languages

      • collabvm installer 2022.exe (PID: 7036)
      • musicplayer.exe (PID: 1512)
      • Synaptics.exe (PID: 1188)
      • collabvm.exe (PID: 4696)
      • ._cache_collabvm.exe (PID: 6712)
      • ._cache_musicplayer.exe (PID: 6724)
      • my music.exe (PID: 6148)

    • The sample compiled with turkish language support

      • collabvm installer 2022.exe (PID: 7036)
      • collabvm.exe (PID: 4696)
      • Synaptics.exe (PID: 1188)

    • Reads the computer name

      • collabvm.exe (PID: 4696)
      • musicplayer.exe (PID: 1512)
      • collabvm installer 2022.exe (PID: 7036)
      • Synaptics.exe (PID: 1188)
      • ._cache_collabvm.exe (PID: 6712)
      • my music.exe (PID: 6148)
      • ._cache_musicplayer.exe (PID: 6724)

    • Process checks computer location settings

      • collabvm.exe (PID: 4696)
      • collabvm installer 2022.exe (PID: 7036)
      • musicplayer.exe (PID: 1512)
      • ._cache_musicplayer.exe (PID: 6724)

    • Creates files in the program directory

      • collabvm.exe (PID: 4696)
      • Synaptics.exe (PID: 1188)

    • Reads the machine GUID from the registry

      • ._cache_collabvm.exe (PID: 6712)
      • my music.exe (PID: 6148)

    • Checks proxy server information

      • Synaptics.exe (PID: 1188)

    • Application launched itself

      • msedge.exe (PID: 5756)

    • Creates files or folders in the user directory

      • my music.exe (PID: 6148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:01:24 07:31:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 201216
InitializedDataSize: 215040
UninitializedDataSize: -
EntryPoint: 0x1f110
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
16
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start collabvm installer 2022.exe cmd.exe no specs conhost.exe no specs #XRED musicplayer.exe #XRED collabvm.exe sppextcomobj.exe no specs slui.exe no specs ._cache_musicplayer.exe ._cache_collabvm.exe no specs #XRED synaptics.exe my music.exe svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1188"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateC:\ProgramData\Synaptics\Synaptics.exe
collabvm.exe
User:
admin
Company:
Synaptics
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Driver
Version:
1.0.0.4
Modules
Images
c:\programdata\synaptics\synaptics.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1512musicplayer.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\musicplayer.exe
cmd.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\musicplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2088"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x314,0x320,0x324,0x31c,0x32c,0x7ffc84505fd8,0x7ffc84505fe4,0x7ffc84505ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2384C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3020"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4228"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2248 --field-trial-handle=2252,i,15690497561463878454,14602540921684491866,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
4696collabvm.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\collabvm.exe
cmd.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\collabvm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5216C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\RarSFX0\asdf.bat" "C:\Windows\SysWOW64\cmd.exe—collabvm installer 2022.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5756"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.computernewb.com/collab-vm/C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—._cache_collabvm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
4 394
Read events
4 325
Write events
69
Delete events
0

Modification events

(PID) Process:(1512) musicplayer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4696) collabvm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4696) collabvm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Synaptics Pointing Device Driver
Value:
C:\ProgramData\Synaptics\Synaptics.exe
(PID) Process:(4696) collabvm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CA7D000000
(PID) Process:(6724) ._cache_musicplayer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CA7D000000
(PID) Process:(6148) my music.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:my music
Value:
C:\Users\admin\Music\my music.exe
(PID) Process:(6712) ._cache_collabvm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6712) ._cache_collabvm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6712) ._cache_collabvm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6712) ._cache_collabvm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CA7D000000
Executable files
13
Suspicious files
5
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
4696collabvm.exeC:\ProgramData\Synaptics\RCXD6CA.tmpexecutable
MD5:646A5E43C6542FE6A0C379232243AE34
SHA256:63989CEB1352EC042DEAB1D240DD6FD5A01677C349CEEFA68BD44B9FFFD3F840
1512musicplayer.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\._cache_musicplayer.exeexecutable
MD5:748AD86C38F2D84F4A9521487D78E08B
SHA256:6CF1542D7BB4C49DB236E181FDF98E5AE37C7B215E2A1FC782EA49D77402C882
7036collabvm installer 2022.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\asdf.battext
MD5:B1CB5E01087DE9D76F9E865836C39001
SHA256:F049B5CC3B58D9E0CDFA516250C2E94318B9D41911E2BA07DD4DE66EC8770495
5756msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variationsbinary
MD5:6971E42ED64D2BE125547F021EB852B1
SHA256:B46CFDC4106DF566F71AA34D6F10B53767C561DFD17DD07A5930A18E67BB344B
1188Synaptics.exeC:\Users\admin\AppData\Local\Temp\9lueC5BK.icoimage
MD5:81BE105A1628AD7D349EC113444D4FEE
SHA256:76FDD993064DFDF07B0A115EBCC9C5A4E523FDD4F8E1780E045AAD1627DFDAA6
1188Synaptics.exeC:\Users\admin\AppData\Local\Temp\9lueC5BK.exeexecutable
MD5:646A5E43C6542FE6A0C379232243AE34
SHA256:63989CEB1352EC042DEAB1D240DD6FD5A01677C349CEEFA68BD44B9FFFD3F840
1188Synaptics.exeC:\Users\admin\AppData\Local\Temp\RCXDE4D.tmpexecutable
MD5:7AE9B2386435ABE007D2ED98C80A28A6
SHA256:833FA2BF83BE500F43D77BED98D2D16E125CA1A93B83A64F37397DD36FECE221
1188Synaptics.exeC:\Users\admin\AppData\Local\Temp\RCXDDBF.tmpexecutable
MD5:BBE3E84DAB02F77E88D64333ADA9BE27
SHA256:97943D1BFD7F0748881C389AD736D76B0D9771E1C349FF3CA29DB206D1F7FD20
6724._cache_musicplayer.exeC:\Users\admin\Music\my music.exeexecutable
MD5:748AD86C38F2D84F4A9521487D78E08B
SHA256:6CF1542D7BB4C49DB236E181FDF98E5AE37C7B215E2A1FC782EA49D77402C882
5756msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State~RF11b41a.TMPbinary
MD5:1051384B8864AC718AE413E9B1D309A5
SHA256:3FC536607727B6030F7B4714D6E03B4CA040B2EBDBE81B74538F345432207360
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
24
DNS requests
15
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1300
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1300
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1188
Synaptics.exe
GET
200
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1188
Synaptics.exe
69.42.215.252:80
freedns.afraid.org
AWKNET
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 23.59.18.102
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.130
  • 40.126.31.71
  • 40.126.31.1
  • 20.190.159.68
  • 40.126.31.130
  • 40.126.31.129
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
xred.mooo.com
  • —
whitelisted
freedns.afraid.org
  • 69.42.215.252
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to Abused Domain *.mooo.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
collabvm installer 2022.exe