File name:

naticord-setup.exe

Full analysis: https://app.any.run/tasks/81ffb9f8-da50-4ee7-b2e0-aea2af38650b
Verdict: Malicious activity
Analysis date: July 06, 2024, 21:43:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
discord
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4AFD0C1533AF1C3F58E6B5CF8ECEB94E

SHA1:

4A779723835764E41B33E95AB334D76514EE14BF

SHA256:

70357205D104BD0D9BEDF2BE1FAAC3AF6A6445DF17DD4E93B62BE61675A04C20

SSDEEP:

98304:7rq3Bdw6ypdYmGngWRXDPeDLql4sRbz8b+4Q0Zw4Tbn2wChcSUHSGoMiICqdst2s:PG89G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • naticord-setup.exe (PID: 4320)
      • naticord-setup.exe (PID: 2972)
      • naticord-setup.tmp (PID: 5792)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • naticord-setup.exe (PID: 2972)
      • naticord-setup.tmp (PID: 5792)
      • naticord-setup.exe (PID: 4320)

    • Reads the Windows owner or organization settings

      • naticord-setup.tmp (PID: 5792)

    • Reads security settings of Internet Explorer

      • Naticord.exe (PID: 6200)
      • naticord-setup.tmp (PID: 1828)

    • Changes Internet Explorer settings (feature browser emulation)

      • Naticord.exe (PID: 6200)

    • Reads the date of Windows installation

      • naticord-setup.tmp (PID: 1828)

  • INFO

    • Reads the computer name

      • naticord-setup.exe (PID: 2972)
      • naticord-setup.tmp (PID: 5792)
      • Naticord.exe (PID: 6200)
      • naticord-setup.tmp (PID: 1828)

    • Process checks computer location settings

      • naticord-setup.tmp (PID: 1828)

    • Checks supported languages

      • naticord-setup.exe (PID: 2972)
      • naticord-setup.tmp (PID: 5792)
      • naticord-setup.exe (PID: 4320)
      • naticord-setup.tmp (PID: 1828)
      • Naticord.exe (PID: 6200)

    • Reads Environment values

      • naticord-setup.exe (PID: 2972)
      • naticord-setup.tmp (PID: 5792)
      • naticord-setup.exe (PID: 4320)
      • Naticord.exe (PID: 6200)
      • naticord-setup.tmp (PID: 1828)

    • Create files in a temporary directory

      • naticord-setup.exe (PID: 2972)
      • naticord-setup.exe (PID: 4320)
      • naticord-setup.tmp (PID: 5792)

    • Creates files in the program directory

      • naticord-setup.tmp (PID: 5792)

    • Creates files or folders in the user directory

      • naticord-setup.tmp (PID: 5792)
      • Naticord.exe (PID: 6200)

    • Creates a software uninstall entry

      • naticord-setup.tmp (PID: 5792)

    • Manual execution by a user

      • Naticord.exe (PID: 6200)

    • Reads the machine GUID from the registry

      • Naticord.exe (PID: 6200)

    • Disables trace logs

      • Naticord.exe (PID: 6200)

    • Reads the software policy settings

      • Naticord.exe (PID: 6200)
      • slui.exe (PID: 7160)

    • Checks proxy server information

      • Naticord.exe (PID: 6200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:09 05:41:36+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 90112
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: naticord Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: naticord
ProductVersion: 0.2 Beta 2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start naticord-setup.exe naticord-setup.tmp no specs naticord-setup.exe naticord-setup.tmp naticord.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1112C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1768C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1828"C:\Users\admin\AppData\Local\Temp\is-TSRBV.tmp\naticord-setup.tmp" /SL5="$401F6,2315803,776192,C:\Users\admin\Desktop\naticord-setup.exe" C:\Users\admin\AppData\Local\Temp\is-TSRBV.tmp\naticord-setup.tmp—naticord-setup.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-tsrbv.tmp\naticord-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
2972"C:\Users\admin\Desktop\naticord-setup.exe" /SPAWNWND=$3026E /NOTIFYWND=$401F6 C:\Users\admin\Desktop\naticord-setup.exe
naticord-setup.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
naticord Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\naticord-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
4320"C:\Users\admin\Desktop\naticord-setup.exe" C:\Users\admin\Desktop\naticord-setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
naticord Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\naticord-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
5792"C:\Users\admin\AppData\Local\Temp\is-R0V99.tmp\naticord-setup.tmp" /SL5="$1102C4,2315803,776192,C:\Users\admin\Desktop\naticord-setup.exe" /SPAWNWND=$3026E /NOTIFYWND=$401F6 C:\Users\admin\AppData\Local\Temp\is-R0V99.tmp\naticord-setup.tmp
naticord-setup.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-r0v99.tmp\naticord-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
6200"C:\Users\admin\AppData\Roaming\naticord\Naticord.exe" C:\Users\admin\AppData\Roaming\naticord\Naticord.exe
explorer.exe
User:
admin
Company:
Naticord
Integrity Level:
MEDIUM
Description:
Naticord
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\naticord\naticord.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7128C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7160"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 833
Read events
5 783
Write events
44
Delete events
6

Modification events

(PID) Process:(5792) naticord-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
A01600003EA94A89EDCFDA01
(PID) Process:(5792) naticord-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
047BFADE15482B8E441E7EF3F03EE0E2B7BEC7A887DB7E55A70FB273C66EB474
(PID) Process:(5792) naticord-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5792) naticord-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Users\admin\AppData\Roaming\naticord\Naticord.exe
(PID) Process:(5792) naticord-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
401D0B45616C479FB7D654E18DE313E0463172175D5A7013087B76C9266A731F
(PID) Process:(5792) naticord-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\naticord_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.3.0
(PID) Process:(5792) naticord-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\naticord_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Roaming\naticord
(PID) Process:(5792) naticord-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\naticord_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Roaming\naticord\
(PID) Process:(5792) naticord-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\naticord_is1
Operation:writeName:Inno Setup: Icon Group
Value:
naticord
(PID) Process:(5792) naticord-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\naticord_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
13
Suspicious files
7
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
5792naticord-setup.tmpC:\Users\admin\AppData\Roaming\naticord\is-H74PE.tmpexecutable
MD5:195FFB7167DB3219B217C4FD439EEDD6
SHA256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
5792naticord-setup.tmpC:\Users\admin\AppData\Local\Temp\is-VI5Q6.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
2972naticord-setup.exeC:\Users\admin\AppData\Local\Temp\is-R0V99.tmp\naticord-setup.tmpexecutable
MD5:92F91908AB536E68AE70B97881E49A80
SHA256:5C47EC7C908DBF8B8F1AEBE42D7E9D7D474A1C32A8A23D5EE7A6F78BAAEF2581
5792naticord-setup.tmpC:\Users\admin\AppData\Roaming\naticord\unins000.exeexecutable
MD5:7D516CA7D53949D7DF344C40A9F61076
SHA256:E4EB97F4A780BF597A029EAE73712FC920AF166155E9BBE4EA7165661F0A9BEC
5792naticord-setup.tmpC:\Users\admin\AppData\Roaming\naticord\is-TLUER.tmpxml
MD5:113B8712853AE4E13899C8C6C2792EC4
SHA256:AB761168BCECBE46156E9F9AEE98AA791ABAE0D3B2E7586973579CE8F368088E
5792naticord-setup.tmpC:\Users\admin\AppData\Roaming\naticord\is-7U50D.tmppdb
MD5:0AE20663F4D2B1AF86A88A47D70037DC
SHA256:0E8562E6400E09D6F66E11F85E8A081B0432414D8F0907AA6BC1E81536BC0D6C
5792naticord-setup.tmpC:\Users\admin\AppData\Roaming\naticord\Naticord.exeexecutable
MD5:4FC903954E8754C41021BFA152A18538
SHA256:EB9976FB272D9DDDC43E168FAA216630D517507FC801452270D74664E21FC84D
5792naticord-setup.tmpC:\Users\admin\AppData\Roaming\naticord\is-E79D2.tmpexecutable
MD5:7379936CAC71973885587A3BC6FBB70B
SHA256:FB06FFCEB4F8789C893D2F292E5810927DD7266D3BAD68DF2CEDB8775500E8BE
5792naticord-setup.tmpC:\Users\admin\AppData\Roaming\naticord\is-1T6SQ.tmpxml
MD5:D398FFE9FDAC6A53A8D8BB26F29BBB3C
SHA256:79EE87D4EDE8783461DE05B93379D576F6E8575D4AB49359F15897A854B643C4
5792naticord-setup.tmpC:\Users\admin\AppData\Roaming\naticord\Newtonsoft.Json.dllexecutable
MD5:195FFB7167DB3219B217C4FD439EEDD6
SHA256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
77
DNS requests
27
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
3540
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
5940
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
3228
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6944
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5680
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1972
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4392
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1972
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1972
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1972
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4656
SearchApp.exe
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.153
  • 104.126.37.128
  • 104.126.37.137
  • 104.126.37.129
  • 104.126.37.161
  • 104.126.37.177
  • 104.126.37.139
  • 104.126.37.162
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.71
  • 40.126.31.73
  • 40.126.31.67
  • 20.190.159.68
  • 40.126.31.71
  • 20.190.159.0
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
fp-vs.azureedge.net
  • 152.199.19.161
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.45
unknown

Threats

PID
Process
Class
Message
2168
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6200
Naticord.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
naticord-setup.exe