File name:

kdmapper.exe

Full analysis: https://app.any.run/tasks/7bea0602-8b36-499a-8f2b-c15e960dca60
Verdict: Malicious activity
Analysis date: April 08, 2025, 14:45:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
iqvw64e-sys
vuln-driver
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 3 sections
MD5:

93A7747619EE49CC0B5E2A579B848C4A

SHA1:

177B2DB993F14F6B060E6F81AA4BD8A9EEA74A1B

SHA256:

7DB63095705FEA4FF459CD6318193FD685853DBA994A0FC839A9010688B50786

SSDEEP:

1536:m+FWt+Ps8Ka4LtfaE5R1NPHZsJwN5k6lzz1YC+pTqjWe:mB8Ka4Lpx5RD5cwDk6l3yLx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • kdmapper.exe (PID: 5588)
      • kdmapper.exe (PID: 856)
      • kdmapper 2.exe (PID: 7956)
      • kdmapper.exe (PID: 7264)
      • kdmapper.exe (PID: 7392)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • kdmapper.exe (PID: 5588)
      • kdmapper.exe (PID: 856)
      • kdmapper.exe (PID: 7264)
      • kdmapper 2.exe (PID: 7956)
      • kdmapper.exe (PID: 7392)

    • Creates or modifies Windows services

      • kdmapper.exe (PID: 5588)
      • kdmapper 2.exe (PID: 7956)
      • kdmapper.exe (PID: 7264)
      • kdmapper.exe (PID: 856)
      • kdmapper.exe (PID: 7392)

    • There is functionality for taking screenshot (YARA)

      • Vision.Crack.exe (PID: 5404)

  • INFO

    • Checks supported languages

      • kdmapper.exe (PID: 7404)
      • kdmapper.exe (PID: 5588)
      • Vision.Crack.exe (PID: 5404)
      • identity_helper.exe (PID: 5740)
      • identity_helper.exe (PID: 1852)
      • kdmapper.exe (PID: 856)
      • kdmapper 2.exe (PID: 7956)
      • kdmapper.exe (PID: 7264)
      • kdmapper.exe (PID: 7392)

    • Manual execution by a user

      • kdmapper.exe (PID: 6808)
      • kdmapper.exe (PID: 5588)
      • Vision.Crack.exe (PID: 7236)
      • Vision.Crack.exe (PID: 5404)
      • msedge.exe (PID: 1052)
      • kdmapper.exe (PID: 1128)
      • kdmapper.exe (PID: 856)
      • kdmapper.exe (PID: 208)
      • kdmapper.exe (PID: 7264)
      • kdmapper 2.exe (PID: 672)
      • kdmapper 2.exe (PID: 7956)
      • kdmapper.exe (PID: 7392)
      • kdmapper.exe (PID: 1324)

    • The sample compiled with english language support

      • kdmapper.exe (PID: 5588)
      • kdmapper.exe (PID: 856)
      • kdmapper 2.exe (PID: 7956)
      • kdmapper.exe (PID: 7264)
      • kdmapper.exe (PID: 7392)

    • Reads the software policy settings

      • slui.exe (PID: 7528)
      • slui.exe (PID: 6044)

    • Create files in a temporary directory

      • kdmapper.exe (PID: 5588)
      • kdmapper 2.exe (PID: 7956)
      • kdmapper.exe (PID: 7264)
      • kdmapper.exe (PID: 856)
      • kdmapper.exe (PID: 7392)

    • Reads the machine GUID from the registry

      • Vision.Crack.exe (PID: 5404)

    • Reads the computer name

      • Vision.Crack.exe (PID: 5404)
      • identity_helper.exe (PID: 5740)
      • identity_helper.exe (PID: 1852)

    • Reads CPU info

      • Vision.Crack.exe (PID: 5404)

    • Application launched itself

      • msedge.exe (PID: 1052)
      • msedge.exe (PID: 8108)

    • Reads Environment values

      • identity_helper.exe (PID: 1852)
      • identity_helper.exe (PID: 5740)

    • Checks proxy server information

      • slui.exe (PID: 6044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:08 14:25:21+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.39
CodeSize: 61440
InitializedDataSize: 4096
UninitializedDataSize: 106496
EntryPoint: 0x28fe0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
233
Monitored processes
90
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start kdmapper.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe slui.exe kdmapper.exe no specs THREAT kdmapper.exe conhost.exe no specs vision.crack.exe no specs vision.crack.exe conhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs kdmapper.exe no specs THREAT kdmapper.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs kdmapper 2.exe no specs THREAT kdmapper 2.exe conhost.exe no specs kdmapper.exe no specs THREAT kdmapper.exe conhost.exe no specs kdmapper.exe no specs THREAT kdmapper.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs kdmapper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Users\admin\Desktop\kdmapper.exe" C:\Users\admin\Desktop\VCKD.sysC:\Users\admin\Desktop\kdmapper.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\kdmapper.exe
c:\windows\system32\ntdll.dll
444"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3032 --field-trial-handle=2052,i,11394334096277748841,11493311363681661914,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—kdmapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
664"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3496 --field-trial-handle=1908,i,15358659901268332554,7274911603449299248,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
672"C:\Users\admin\Desktop\kdmapper 2.exe" C:\Users\admin\Desktop\VCKD.sysC:\Users\admin\Desktop\kdmapper 2.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\kdmapper 2.exe
c:\windows\system32\ntdll.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5472 --field-trial-handle=2052,i,11394334096277748841,11493311363681661914,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
812"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4988 --field-trial-handle=1908,i,15358659901268332554,7274911603449299248,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856"C:\Users\admin\Desktop\kdmapper.exe" C:\Users\admin\Desktop\VCKD.sysC:\Users\admin\Desktop\kdmapper.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\kdmapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
968"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5020 --field-trial-handle=2052,i,11394334096277748841,11493311363681661914,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=DefaultC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 212
Read events
10 158
Write events
49
Delete events
5

Modification events

(PID) Process:(5588) kdmapper.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sjwdMgbfgEpmyY
Operation:writeName:ImagePath
Value:
\??\C:\Users\admin\AppData\Local\Temp\sjwdMgbfgEpmyY
(PID) Process:(5588) kdmapper.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sjwdMgbfgEpmyY
Operation:writeName:Type
Value:
1
(PID) Process:(5588) kdmapper.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sjwdMgbfgEpmyY
Operation:delete keyName:(default)
Value:
(PID) Process:(1052) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1052) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1052) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1052) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
491CE5B7DB902F00
(PID) Process:(1052) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1052) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
8909F0B7DB902F00
(PID) Process:(1052) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\721588
Operation:writeName:WindowTabManagerFileMappingId
Value:
{0BAA7649-DB5F-4483-9B55-E99B9991D146}
Executable files
44
Suspicious files
759
Text files
143
Unknown types
0

Dropped files

PID
Process
Filename
Type
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF12451f.TMP —
MD5:—
SHA256:—
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF12451f.TMP —
MD5:—
SHA256:—
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF12452f.TMP —
MD5:—
SHA256:—
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF12454e.TMP —
MD5:—
SHA256:—
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF12454e.TMP —
MD5:—
SHA256:—
1052msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
105
DNS requests
115
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8072
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8072
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7792
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1744652594&P2=404&P3=2&P4=ng7jUAnAVasdb3IElJPosymiFO3ZiV313S7DZv2agIdLKMvFq3JRKbJTm%2fpqgBXuUFsQyR%2fuZMFIWW4%2bY4mnvA%3d%3d
unknown
—
—
whitelisted
7792
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1744652594&P2=404&P3=2&P4=ng7jUAnAVasdb3IElJPosymiFO3ZiV313S7DZv2agIdLKMvFq3JRKbJTm%2fpqgBXuUFsQyR%2fuZMFIWW4%2bY4mnvA%3d%3d
unknown
—
—
whitelisted
7792
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1744652596&P2=404&P3=2&P4=CC9tGx5FgRCbyi3KkGMwWngfhVk4u989T4A5j7YTdpEUvDdQ3mrAFx%2fdsnuFucbS%2fsns63Q8FZpzyLSmBX8t4g%3d%3d
unknown
—
—
whitelisted
7792
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1744652594&P2=404&P3=2&P4=ng7jUAnAVasdb3IElJPosymiFO3ZiV313S7DZv2agIdLKMvFq3JRKbJTm%2fpqgBXuUFsQyR%2fuZMFIWW4%2bY4mnvA%3d%3d
unknown
—
—
whitelisted
7792
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5cbc98ff-b69b-4fda-ad94-17ec2f9cf48b?P1=1744652596&P2=404&P3=2&P4=CC9tGx5FgRCbyi3KkGMwWngfhVk4u989T4A5j7YTdpEUvDdQ3mrAFx%2fdsnuFucbS%2fsns63Q8FZpzyLSmBX8t4g%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.37
  • 23.216.77.18
  • 23.216.77.32
  • 23.216.77.29
  • 23.216.77.19
  • 23.216.77.25
  • 23.216.77.13
  • 23.216.77.28
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.64
  • 20.190.160.3
  • 40.126.32.136
  • 20.190.160.131
  • 20.190.160.22
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kdmapper.exe