File name:

850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e

Full analysis: https://app.any.run/tasks/a85f4bbd-e304-4edd-a125-d5e536a9aab6
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: January 11, 2025, 00:03:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
evasion
telegram
exfiltration
pastebin
asyncrat
rat
arch-doc
stormkitty
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

A7649256FCE8B15959EDD1004DF7781B

SHA1:

314294D940B110265283531E9E62B3DEA6FB4506

SHA256:

850FA36792359354C8B5CF86EBB2D6923AA64DECE7FC5D555D90D156EAA0409E

SSDEEP:

49152:bPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtCO/k:7P/mp7t3T4+B/btosJwIA4hHmZlKH2Tp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 6432)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 6432)

    • ASYNCRAT has been detected (MUTEX)

      • RegSvcs.exe (PID: 6432)

    • STORMKITTY has been detected (YARA)

      • RegSvcs.exe (PID: 6432)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • cmd.exe (PID: 7096)
      • cmd.exe (PID: 6208)

    • Write to the desktop.ini file (may be used to cloak folders)

      • RegSvcs.exe (PID: 6432)

    • Starts CMD.EXE for commands execution

      • RegSvcs.exe (PID: 6432)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 7096)
      • cmd.exe (PID: 6208)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7096)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • RegSvcs.exe (PID: 6432)

    • Potential Corporate Privacy Violation

      • RegSvcs.exe (PID: 6432)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • RegSvcs.exe (PID: 6432)

    • The process connected to a server suspected of theft

      • RegSvcs.exe (PID: 6432)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • RegSvcs.exe (PID: 6432)

  • INFO

    • Reads mouse settings

      • 850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe (PID: 6272)

    • Creates files or folders in the user directory

      • RegSvcs.exe (PID: 6432)

    • The sample compiled with english language support

      • 850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe (PID: 6272)

    • Checks supported languages

      • RegSvcs.exe (PID: 6432)
      • 850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe (PID: 6272)
      • chcp.com (PID: 7144)
      • chcp.com (PID: 4056)

    • Changes the display of characters in the console

      • cmd.exe (PID: 7096)
      • cmd.exe (PID: 6208)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • RegSvcs.exe (PID: 6432)
      • WINWORD.EXE (PID: 6684)

    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 6432)

    • Create files in a temporary directory

      • 850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe (PID: 6272)
      • RegSvcs.exe (PID: 6432)

    • Reads CPU info

      • RegSvcs.exe (PID: 6432)

    • Checks proxy server information

      • RegSvcs.exe (PID: 6432)

    • Reads the software policy settings

      • RegSvcs.exe (PID: 6432)

    • Disables trace logs

      • RegSvcs.exe (PID: 6432)

    • Manual execution by a user

      • notepad.exe (PID: 3876)
      • notepad.exe (PID: 7128)
      • notepad.exe (PID: 1944)
      • WINWORD.EXE (PID: 7080)
      • notepad.exe (PID: 4548)
      • notepad.exe (PID: 6848)
      • WINWORD.EXE (PID: 6684)
      • notepad.exe (PID: 3524)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6848)
      • notepad.exe (PID: 3876)
      • notepad.exe (PID: 7128)
      • notepad.exe (PID: 4548)
      • notepad.exe (PID: 1944)

    • Sends debugging messages

      • WINWORD.EXE (PID: 6684)

    • The process uses the downloaded file

      • WINWORD.EXE (PID: 6684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:18 10:47:24+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 633856
InitializedDataSize: 481792
UninitializedDataSize: -
EntryPoint: 0x20577
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
21
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe no specs THREAT regsvcs.exe cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs findstr.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs svchost.exe notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs winword.exe notepad.exe no specs ai.exe no specs winword.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6272"C:\Users\admin\AppData\Local\Temp\850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe" C:\Users\admin\AppData\Local\Temp\850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6432"C:\Users\admin\AppData\Local\Temp\850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\syswow64\sspicli.dll
c:\windows\syswow64\crypt32.dll
c:\windows\syswow64\msasn1.dll
c:\windows\microsoft.net\assembly\gac_msil\system.management\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.management.dll
c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll
c:\windows\syswow64\clbcatq.dll
c:\windows\syswow64\wbem\wmiutils.dll
c:\windows\syswow64\wbemcomn.dll
c:\windows\syswow64\wbem\wbemprox.dll
c:\windows\syswow64\ws2_32.dll
7096"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr AllC:\Windows\SysWOW64\cmd.exe—RegSvcs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7104\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7144chcp 65001 C:\Windows\SysWOW64\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7164netsh wlan show profile C:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1556findstr AllC:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6208"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssidC:\Windows\SysWOW64\cmd.exe—RegSvcs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6196\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4056chcp 65001 C:\Windows\SysWOW64\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
20 914
Read events
20 453
Write events
432
Delete events
29

Modification events

(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6432) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
17
Suspicious files
150
Text files
72
Unknown types
1

Dropped files

PID
Process
Filename
Type
6272850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exeC:\Users\admin\AppData\Local\Temp\aut55B5.tmpbinary
MD5:B02C4BBEF41D57DCF18E74EC3118F908
SHA256:13C19DC9064FD845F3BAE9E6628607567F5DCCB136A87472F696B5A70FD230F2
6272850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e.exeC:\Users\admin\AppData\Local\Temp\corynteriabinary
MD5:E7F040AECE4EAFBD290B73E61EA01AD2
SHA256:8449A5E04C8082ED45E6EDED4374A13128FA65029950C6C1971A75F8042537B1
6432RegSvcs.exeC:\Users\admin\AppData\Local\701f094dfaca3c51f9ac0a54f43e3856\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\desktop.initext
MD5:29EAE335B77F438E05594D86A6CA22FF
SHA256:88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
6432RegSvcs.exeC:\Users\admin\AppData\Local\701f094dfaca3c51f9ac0a54f43e3856\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Documents\accepttarget.rtftext
MD5:B59A4D3BFD3C3DD311975CC632AC089B
SHA256:7E85A033208CB074FA6DE48BC0F8744E9547E57CCC90035221E003A0B6A57C65
6432RegSvcs.exeC:\Users\admin\AppData\Local\701f094dfaca3c51f9ac0a54f43e3856\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\andregarding.pngimage
MD5:8CD1AC8D693A0DB94EE041C3487266DE
SHA256:C5A73127C59892CC49C13D54C3A2DA234978749F6B30B7776E728A39FD2726FC
6432RegSvcs.exeC:\Users\admin\AppData\Local\701f094dfaca3c51f9ac0a54f43e3856\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\comethese.pngimage
MD5:9AF670DBC69313C6F80563A733E04931
SHA256:4548D0355870F58541A3ED29138CEC02B2A90BB9BEA660C3B8968E51FE3255CB
6432RegSvcs.exeC:\Users\admin\AppData\Local\701f094dfaca3c51f9ac0a54f43e3856\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\addalready.rtftext
MD5:9E9C6BD67FCE21AE32C42758775BCDED
SHA256:3E6770EC0F5759B2F7E873ABDFD8D8EC323C026C3A980F77DC290F18619E9F36
6432RegSvcs.exeC:\Users\admin\AppData\Local\701f094dfaca3c51f9ac0a54f43e3856\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Documents\steelevaluation.rtftext
MD5:AB4673C1ECE914AAA1657FC002BE2909
SHA256:CB1F3FD38BAA7ABCB1AA722BEA8319A77C1A81AE2075892222F6552EB1C6577B
6432RegSvcs.exeC:\Users\admin\AppData\Local\701f094dfaca3c51f9ac0a54f43e3856\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Downloads\professionaltechnologies.pngimage
MD5:D03BAFC0A806A1735387C401597D5B07
SHA256:76C04B4A083C44A3A4C8E69F83679D8BDC63A7DBB19A6EBFFBC582F4C502C9CD
6432RegSvcs.exeC:\Users\admin\AppData\Local\701f094dfaca3c51f9ac0a54f43e3856\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\specificled.pngimage
MD5:D50D1B0B6BCF889B3D7D130707C5A37A
SHA256:12C05392A7EAA8F4DF01D54C1DD6C1380E6AE43EFAF55BE2A6CE9D2876ABE97F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
82
DNS requests
37
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6684
WINWORD.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6684
WINWORD.EXE
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6684
WINWORD.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6432
RegSvcs.exe
GET
200
104.16.185.241:80
http://icanhazip.com/
unknown
—
—
shared
4164
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4164
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6684
WINWORD.EXE
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
2.23.242.9:443
go.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.74
  • 20.190.160.17
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
icanhazip.com
  • 104.16.185.241
  • 104.16.184.241
shared
api.mylnikov.org
  • 104.21.44.66
  • 172.67.196.114
unknown

Threats

PID
Process
Class
Message
—
—
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com)
—
—
Potential Corporate Privacy Violation
ET POLICY Observed Wifi Geolocation Domain (api .mylnikov .org in TLS SNI)
—
—
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
—
—
Misc activity
ET HUNTING Telegram API Certificate Observed
—
—
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
—
—
Misc activity
ET HUNTING Telegram API Certificate Observed
—
—
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
—
—
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Telegram
—
—
Misc activity
ET HUNTING Telegram API Certificate Observed
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
850fa36792359354c8b5cf86ebb2d6923aa64dece7fc5d555d90d156eaa0409e