URL:

https://github.com/Kvan7/Exiled-Exchange-2/releases/download/v0.1.4/exiled-exchange-2-Setup-0.1.4.exe

Full analysis: https://app.any.run/tasks/f7d2a8a3-1525-4381-ba22-5c921d7ce023
Verdict: Malicious activity
Analysis date: December 29, 2024, 17:11:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
nodejs
Indicators:
MD5:

8E146E7654717FA3BAE3F269CFF5433D

SHA1:

F7F56F2BF5883184C929F50CE92F263B7C586C40

SHA256:

72BE4EF84F8956EC41097469430FE21056CE7EEC6D5BD79F31787EF364D98C86

SSDEEP:

3:N8tEdTgdIeqBOrkCeLv/uAq02BtAC:2uaIHIrQz/ul0ctAC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)

    • Get information on the list of running processes

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)
      • cmd.exe (PID: 5240)

    • The process creates files with name similar to system file names

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)

    • Executable content was dropped or overwritten

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)

    • Starts CMD.EXE for commands execution

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)

    • Drops 7-zip archiver for unpacking

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)

    • Reads security settings of Internet Explorer

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)

    • Process drops legitimate windows executable

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)

    • Creates a software uninstall entry

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)

    • Application launched itself

      • Exiled Exchange 2.exe (PID: 5208)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 1792)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 1792)
      • chrome.exe (PID: 7084)

    • Manual execution by a user

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)
      • Exiled Exchange 2.exe (PID: 5208)

    • Checks supported languages

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)
      • Exiled Exchange 2.exe (PID: 5208)
      • Exiled Exchange 2.exe (PID: 1704)
      • Exiled Exchange 2.exe (PID: 5576)
      • Exiled Exchange 2.exe (PID: 5880)

    • The sample compiled with english language support

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)
      • chrome.exe (PID: 7084)

    • The process uses the downloaded file

      • chrome.exe (PID: 6960)
      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)

    • Create files in a temporary directory

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)
      • Exiled Exchange 2.exe (PID: 5208)

    • Reads the computer name

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)
      • Exiled Exchange 2.exe (PID: 5880)
      • Exiled Exchange 2.exe (PID: 5208)
      • Exiled Exchange 2.exe (PID: 1704)

    • Creates files or folders in the user directory

      • Exiled-Exchange-2-Setup-0.1.4.exe (PID: 5000)
      • Exiled Exchange 2.exe (PID: 5208)
      • Exiled Exchange 2.exe (PID: 5880)

    • Reads product name

      • Exiled Exchange 2.exe (PID: 5208)

    • Reads Environment values

      • Exiled Exchange 2.exe (PID: 5208)

    • Checks proxy server information

      • Exiled Exchange 2.exe (PID: 5208)

    • Process checks computer location settings

      • Exiled Exchange 2.exe (PID: 5208)
      • Exiled Exchange 2.exe (PID: 5576)

    • Reads the machine GUID from the registry

      • Exiled Exchange 2.exe (PID: 5208)

    • Node.js compiler has been detected

      • Exiled Exchange 2.exe (PID: 1704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
34
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs rundll32.exe no specs chrome.exe no specs chrome.exe no specs exiled-exchange-2-setup-0.1.4.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs exiled exchange 2.exe no specs exiled exchange 2.exe no specs exiled exchange 2.exe exiled exchange 2.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5328 --field-trial-handle=1888,i,16682392015465536799,7938287299110750219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1704"C:\Users\admin\AppData\Local\Programs\Exiled Exchange 2\Exiled Exchange 2.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\exiled-exchange-2" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1852,i,2917626624201376328,6612203877128541435,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2C:\Users\admin\AppData\Local\Programs\Exiled Exchange 2\Exiled Exchange 2.exe—Exiled Exchange 2.exe
User:
admin
Company:
Garrett Parker
Integrity Level:
LOW
Description:
Exiled Exchange 2
Version:
0.1.4
Modules
Images
c:\users\admin\appdata\local\programs\exiled exchange 2\exiled exchange 2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1740"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=1888,i,16682392015465536799,7938287299110750219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1792"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints "https://github.com/Kvan7/Exiled-Exchange-2/releases/download/v0.1.4/exiled-exchange-2-Setup-0.1.4.exe"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5844 --field-trial-handle=1888,i,16682392015465536799,7938287299110750219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2600"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=1888,i,16682392015465536799,7938287299110750219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2796"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3876 --field-trial-handle=1888,i,16682392015465536799,7938287299110750219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3224"C:\WINDOWS\system32\find.exe" "Exiled Exchange 2.exe"C:\Windows\SysWOW64\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\find.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3832\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3864"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5476 --field-trial-handle=1888,i,16682392015465536799,7938287299110750219,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
10 181
Read events
10 125
Write events
32
Delete events
24

Modification events

(PID) Process:(1792) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1792) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1792) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1792) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1792) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6960) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000EB7F41B4145ADB01
(PID) Process:(5000) Exiled-Exchange-2-Setup-0.1.4.exeKey:HKEY_CURRENT_USER\SOFTWARE\0e74d6e2-bc15-5c92-8532-3be4316378fe
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Programs\Exiled Exchange 2
(PID) Process:(5000) Exiled-Exchange-2-Setup-0.1.4.exeKey:HKEY_CURRENT_USER\SOFTWARE\0e74d6e2-bc15-5c92-8532-3be4316378fe
Operation:writeName:KeepShortcuts
Value:
true
(PID) Process:(5000) Exiled-Exchange-2-Setup-0.1.4.exeKey:HKEY_CURRENT_USER\SOFTWARE\0e74d6e2-bc15-5c92-8532-3be4316378fe
Operation:writeName:ShortcutName
Value:
Exiled Exchange 2
(PID) Process:(5000) Exiled-Exchange-2-Setup-0.1.4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\0e74d6e2-bc15-5c92-8532-3be4316378fe
Operation:writeName:DisplayName
Value:
Exiled Exchange 2 0.1.4
Executable files
39
Suspicious files
451
Text files
139
Unknown types
199

Dropped files

PID
Process
Filename
Type
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF13610f.TMP —
MD5:—
SHA256:—
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF13610f.TMP —
MD5:—
SHA256:—
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF13610f.TMP —
MD5:—
SHA256:—
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF13610f.TMP —
MD5:—
SHA256:—
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF13611e.TMP —
MD5:—
SHA256:—
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
1792chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
49
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
6884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
6884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
6884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
6884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
6884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
6884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
6884
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
6884
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/fw4ggtylvtq6i65ti33m4vqijm_2024.12.14.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.12.14.01_all_e3s3pxuydvrca43mi6hdgphvru.crx3
unknown
—
—
whitelisted
6884
svchost.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/fw4ggtylvtq6i65ti33m4vqijm_2024.12.14.1/kiabhabjdbkjdpjbpigfodbdjmbglcoo_2024.12.14.01_all_e3s3pxuydvrca43mi6hdgphvru.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1596
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.123:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1792
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
1076
svchost.exe
23.218.210.69:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.167
  • 23.48.23.147
  • 23.48.23.177
  • 23.48.23.156
  • 23.48.23.173
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.123
  • 104.126.37.170
  • 104.126.37.179
  • 104.126.37.184
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.171
  • 104.126.37.168
  • 104.126.37.186
unknown
go.microsoft.com
  • 23.218.210.69
unknown
github.com
  • 140.82.121.3
shared
accounts.google.com
  • 64.233.166.84
whitelisted
objects.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.111.133
shared
login.live.com
  • 40.126.32.134
  • 40.126.32.133
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.138
  • 20.190.160.20
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/Kvan7/Exiled-Exchange-2/releases/download/v0.1.4/exiled-exchange-2-Setup-0.1.4.exe