File name:

8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe

Full analysis: https://app.any.run/tasks/828e0a99-a4c4-41b4-8b77-e28121d8b71a
Verdict: Malicious activity
Threats:

Phobos is a ransomware that locks or encrypts files to demand a ransom. It uses AES encryption with different extensions, which leaves no chance to recover the infected files.

Malware Trends Tracker     >>>
Analysis date: April 26, 2025, 15:34:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
8base
ransomware
phobos
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

7166D39E9C1CB17E1728D316531242B1

SHA1:

D05810943685BCD70999FF0926215F5D6FE2637A

SHA256:

8879A7A950A3916F5438685F994EE829A20E4C60021DB73060CD078E4A72B5A7

SSDEEP:

3072:0OLdjvSZkJXvtv+HQ7kvQ4sn++DXmHz5ALy:RLdTS6Xvd+HQ7kvQ44Ly

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RANSOMWARE has been detected

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • Changes the autorun value in the registry

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • 8Base is detected

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7504)

    • Create files in the Startup directory

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • PHOBOS mutex has been found

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7504)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • PHOBOS has been detected

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)

    • Renames files like ransomware

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)

    • Deletes shadow copies

      • cmd.exe (PID: 8128)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 8128)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • Creates file in the systems drive root

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • Application launched itself

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7504)

    • Executes application which crashes

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7504)

    • Starts CMD.EXE for commands execution

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • Reads security settings of Internet Explorer

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7504)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 8136)

    • The process creates files with name similar to system file names

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • Executes as Windows Service

      • wbengine.exe (PID: 7340)
      • vds.exe (PID: 7180)
      • VSSVC.exe (PID: 5404)

    • Process drops legitimate windows executable

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

  • INFO

    • Creates files or folders in the user directory

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • WerFault.exe (PID: 7940)

    • Reads the computer name

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7504)

    • Checks supported languages

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7504)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 6456)
      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • Process checks computer location settings

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7504)

    • The sample compiled with english language support

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 5720)

    • Creates files in the program directory

      • 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe (PID: 7764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:09:17 22:52:50+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 137728
InitializedDataSize: 781312
UninitializedDataSize: -
EntryPoint: 0x47f7
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 71.0.0.0
ProductVersionNumber: 34.0.0.0
FileFlagsMask: 0x141a
FileFlags: (none)
FileOS: Unknown (0x20761)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Faeroese
CharacterSet: Unknown (31F2)
InternalName: Huckleamber
FileDescription: Underweather
ProductsVersion: 59.46.64.93
ProductName: GoldenSeg
ProductionVersion: 74.58.95.46
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
21
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #8BASE 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe sppextcomobj.exe no specs slui.exe no specs #PHOBOS 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe #PHOBOS 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe werfault.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs netsh.exe no specs vssadmin.exe no specs vssvc.exe no specs netsh.exe no specs wmic.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2284bcdedit /set {default} recoveryenabled noC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
2392vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2852wbadmin delete catalog -quietC:\Windows\System32\wbadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® BLB Backup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3768C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4488netsh advfirewall set currentprofile state offC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5008netsh firewall set opmode mode=disableC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5404C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5720wmic shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
6456"C:\Users\admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe" C:\Users\admin\AppData\Local\Temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7148bcdedit /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
Total events
3 780
Read events
3 742
Write events
20
Delete events
18

Modification events

(PID) Process:(6456) 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7
Value:
C:\Users\admin\AppData\Local\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
(PID) Process:(6456) 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7
Value:
C:\Users\admin\AppData\Local\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
(PID) Process:(7764) 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7
Value:
C:\Users\admin\AppData\Local\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
(PID) Process:(7764) 8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7
Value:
C:\Users\admin\AppData\Local\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe
(PID) Process:(7148) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(7148) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(7148) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(7148) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(7148) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(7148) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Boot\Loader.efi
Executable files
38
Suspicious files
1 656
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.id[26B799FA-3483].[support@rexsdata.pro].8basebinary
MD5:4F3FEA5322B24161C7D2764C45FB3442
SHA256:60D51B4FF4F36335F441DF4D0CD036503AFD80218EB2C1E393A8C38BA3DF2E6F
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.id[26B799FA-3483].[support@rexsdata.pro].8basebinary
MD5:AE6B872AEF76A61F4436CBB75C308906
SHA256:B92A1026F6596062F8BD49B13848BC1673C4D12DAEFEFCF9CFFA8E667DAC8084
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeexecutable
MD5:7166D39E9C1CB17E1728D316531242B1
SHA256:8879A7A950A3916F5438685F994EE829A20E4C60021DB73060CD078E4A72B5A7
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\Users\admin\AppData\Local\8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeexecutable
MD5:7166D39E9C1CB17E1728D316531242B1
SHA256:8879A7A950A3916F5438685F994EE829A20E4C60021DB73060CD078E4A72B5A7
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.id[26B799FA-3483].[support@rexsdata.pro].8basebinary
MD5:EECDCC08E260FDD36DD9FF5B876CEF6E
SHA256:2C30CB606867E569A1CC6E72AF780B3FA6E0BFC9AAFAEC63BA93A72CC66661F3
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png.id[26B799FA-3483].[support@rexsdata.pro].8basebinary
MD5:767CFF0A15BCCB7E916DA26AF24BDDD3
SHA256:754564CD780635E9692685284DC2AEAB1B4C38BE898E30F30B031B06372A5A3B
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.id[26B799FA-3483].[support@rexsdata.pro].8basebinary
MD5:A1586CF484DFD3C8915B2DDD71A72B26
SHA256:E448C864AD56A4DB5D83C37934161A7352FB10899AB1A56ACAFBAFD591DDE9FF
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\chrome_200_percent.pak.id[26B799FA-3483].[support@rexsdata.pro].8basebinary
MD5:F64F02B186D42DEAAF841AB493D20BEA
SHA256:49BF39791E579C312408F252553B7042F4158D3FDBFC4047C9BB3DC37C8CFA99
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\LICENSE.txt.id[26B799FA-3483].[support@rexsdata.pro].8basebinary
MD5:06E20D8805DCBB597E4CE1537A3E93C8
SHA256:76F0A31CACF6A4FA706915D794363DEF80326B64DE4472E0C73D49E2938A3F10
64568879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\chrome_100_percent.pak.id[26B799FA-3483].[support@rexsdata.pro].8basebinary
MD5:048540BFE476F45B58D10F767BBF02BF
SHA256:3386E75AC58A0243C5946770F8F7977769F49937CEF9758465A79BA29AA5BEA1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
92.122.244.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.89.217:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.251.198:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.89.217:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8004
SIHClient.exe
GET
200
95.101.89.217:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8004
SIHClient.exe
GET
200
95.101.89.217:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
92.122.244.32:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
95.101.89.217:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.89.217:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.54.251.198:80
ocsp.digicert.com
AKAMAI-AS
JP
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 92.122.244.32
  • 92.122.244.42
whitelisted
www.microsoft.com
  • 95.101.89.217
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.66
  • 20.190.160.132
  • 20.190.160.22
  • 20.190.160.3
  • 40.126.32.68
  • 40.126.32.72
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 23.54.251.198
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8879a7a950a3916f5438685f994ee829a20e4c60021db73060cd078e4a72b5a7.exe