File name:

72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab

Full analysis: https://app.any.run/tasks/5a74223a-6a66-40b0-9e13-48c44af85706
Verdict: Malicious activity
Analysis date: December 11, 2024, 00:05:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
basun
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections
MD5:

AC25BFFCF69D1FA28D17CE928BE40139

SHA1:

F172EF6A11484CFCB0D1C76CE6635452BCCA9A57

SHA256:

72163CB3FA9505BE8D0ABD827043B565266A739E5DC68A273D8FAC436B1E08AB

SSDEEP:

768:7m9uq8FIbpcFmySEChm0GjAMs7sBjQtwIq57uoXSjrneTNMcuIv2dG9:74TpcFwjGjPs7sBjQqIpjeTNMcuIv2A9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)

    • Changes the autorun value in the registry

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)
      • admin.exe (PID: 6320)

    • BASUN has been detected

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)
      • admin.exe (PID: 6320)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)

    • Executable content was dropped or overwritten

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)

    • Contacting a server suspected of hosting an CnC

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)

  • INFO

    • Reads the computer name

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)
      • admin.exe (PID: 6320)

    • Checks supported languages

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)
      • admin.exe (PID: 6320)

    • The sample compiled with english language support

      • svchost.exe (PID: 1512)
      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)

    • The process uses the downloaded file

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)

    • Reads the software policy settings

      • WaaSMedicAgent.exe (PID: 1616)
      • SIHClient.exe (PID: 6844)

    • Process checks computer location settings

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)

    • Checks proxy server information

      • 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe (PID: 1512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.6)
.exe | Clipper DOS Executable (19.1)
.exe | Generic Win/DOS Executable (18.9)
.exe | DOS Executable Generic (18.9)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2000:01:01 12:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 30720
InitializedDataSize: 512
UninitializedDataSize: -
EntryPoint: 0x1164
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
51
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start start svchost.exe no specs #BASUN 72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe #BASUN admin.exe sihclient.exe svchost.exe no specs svchost.exe no specs svchost.exe conhost.exe no specs svchost.exe no specs svchost.exe no specs waasmedicagent.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs officeclicktorun.exe no specs svchost.exe no specs uhssvc.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs dashost.exe no specs svchost.exe no specs upfc.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs ctfmon.exe no specs sppsvc.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHostC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
812C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1176C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ondemandconnroutehelper.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\webio.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
1200\??\C:\WINDOWS\system32\conhost.exe 0x4C:\Windows\System32\conhost.exe—WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1340C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\devinv.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\devobj.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\drvstore.dll
c:\windows\system32\fltlib.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
1512C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1512"C:\Users\admin\Desktop\72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe" C:\Users\admin\Desktop\72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1612C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NetmanC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1616C:\WINDOWS\System32\WaaSMedicAgent.exe efeb44e1aa4a4728e51916791acd7113 SjHNZxgtbUqxJKm8876XeA.0.1.0.0.0C:\Windows\System32\WaaSMedicAgent.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WaasMedic Agent Exe
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\profapi.dll
c:\windows\system32\waasmediccapsule.dll
c:\windows\system32\oleaut32.dll
1764C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroupC:\Windows\System32\svchost.exe—services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
13 627
Read events
13 373
Write events
227
Delete events
27

Modification events

(PID) Process:(1340) svchost.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
Operation:writeName:C:\Users\admin\Desktop\72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe
Value:
534143500100000000000000070000002800000005D20000000000000100000000000000000001057100000050BB64EDDDACD5010000000000000000
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{e793ad86-59dd-b4c3-72c6-a71b2a85b91e}\Root\InventoryDevicePnp
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{e793ad86-59dd-b4c3-72c6-a71b2a85b91e}\Root\InventoryDevicePnp\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{e793ad86-59dd-b4c3-72c6-a71b2a85b91e}\Root\InventoryDeviceContainer
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{e793ad86-59dd-b4c3-72c6-a71b2a85b91e}\Root\InventoryDeviceContainer\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{e793ad86-59dd-b4c3-72c6-a71b2a85b91e}\Root\InventoryDriverBinary
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{e793ad86-59dd-b4c3-72c6-a71b2a85b91e}\Root\InventoryDriverBinary\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{e793ad86-59dd-b4c3-72c6-a71b2a85b91e}\Root\InventoryDeviceMediaClass
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{e793ad86-59dd-b4c3-72c6-a71b2a85b91e}\Root\InventoryDeviceMediaClass\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(1340) svchost.exeKey:\REGISTRY\A\{e793ad86-59dd-b4c3-72c6-a71b2a85b91e}\Root\DriverPackageExtended
Operation:writeName:WritePermissionsCheck
Value:
1
Executable files
1
Suspicious files
7
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
151272163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exeC:\Users\admin\FRFLIQPB.exebinary
MD5:A48249517F2F7A1B7E87E31B58D676D2
SHA256:18CF01CDFE2084E965E0358192DE6B8FB2ABDEEE6EC47F00E772642E97BC5326
6844SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E94643DE99F5621BC288D045BEA85DDder
MD5:04D4955134563C4BA05FCAC8B79E6CE7
SHA256:E5B466AFA3A4B3FF93E617AA5763FA45B03F2F90E88B645A0ABB18A18474CC20
2164svchost.exeC:\Windows\Logs\waasmediccapsule\WaasRemediation.003.etletl
MD5:A83C439448C1E67E6FFC948FEF1FCE18
SHA256:9FAA75F166CFDD869D3549B76139DDDDDB6A50790A5C6CC81B2084A432D7D60F
6844SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E94643DE99F5621BC288D045BEA85DDbinary
MD5:4FF930A8EF629B40BAB04D23BA1CF295
SHA256:660E464BBD11A9888D15A9C9E106320AE94C5E3E8E7BE2550D8F04926E5D9EE5
6844SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\51867C3735CFAECCDB556E146BB12C28binary
MD5:84F8B183574118B6978BF113E29E7828
SHA256:93E478D16AAB9AF692901531B7B339E582BEC3EE9379608585638D7E61ABBAEB
6844SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\51867C3735CFAECCDB556E146BB12C28der
MD5:E1E3CC4D691535D73D5E7BA76E9B14B2
SHA256:AB97B5AE07DF03363B9F4A73AD4C1C0C9816DC21D9A4D60FFF32EB8B94AAD4C6
1176svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:87F8376B71B1FD35DA4B511EFF055888
SHA256:A1383ED3B4F8967FB19F5B16BFE41EB3242B296FFC06C1098FBE1D1A04A7003F
1176svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:FC96952E362A36EB71A4220DEA61295C
SHA256:506149BFF817BC18586142566172C8CA87E252D3202A1F2CFDB0AED377F1A749
151272163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exeC:\Users\admin\admin.exeexecutable
MD5:D00D7D4D79E4947F65A3C80253CAF8F2
SHA256:015A9A9081AC01E27EC2B05BA88781DA7898123B5B75D7B98FA31C3C8B48A8D6
2164svchost.exeC:\Windows\Logs\waasmediccapsule\WaasRemediation.002.etletl
MD5:DEDECFD6DDECAA969F2F735761A8363F
SHA256:6D554FD45C5A4651BA508028AF27C5AE6501E3A2E10CFF9A8A925DCB74A68702
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
33
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1512
72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe
GET
200
45.196.163.119:80
http://imagehut4.cn/update/utu.dat
unknown
—
—
malicious
1356
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6844
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6844
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.19.217.218:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
95.100.146.32:443
www.bing.com
Akamai International B.V.
CZ
whitelisted
1176
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 2.19.217.218
  • 95.101.149.131
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 95.100.146.32
  • 95.100.146.34
  • 95.100.146.16
  • 95.100.146.8
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
imagehut4.cn
  • 45.196.163.119
malicious
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

PID
Process
Class
Message
1512
72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab.exe
Malware Command and Control Activity Detected
ET MALWARE Request for utu.dat Likely Ponmocup checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
72163cb3fa9505be8d0abd827043b565266a739e5dc68a273d8fac436b1e08ab