File name:

myBase Desktop 7.3.4 [FileCR].zip

Full analysis: https://app.any.run/tasks/d9075668-104d-4c26-89ae-3949d51a5461
Verdict: Malicious activity
Analysis date: April 19, 2025, 06:27:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
inno
installer
delphi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

FCC99B64A550542BA3EF1F603925FA93

SHA1:

171BF85BD0B795912AA91350F7547D5471EE93CE

SHA256:

8F520AE7779417509EB85B546FD9604CD9D6465E18737EED8619AA40167EDCA7

SSDEEP:

196608:UzN7go385VFIlfa8sM1jHv0FA5hIQGAPIk:8gos53IlS8sM115hfHPIk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 896)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • myBase-Desktop-Ver734-Setup.exe (PID: 6272)
      • myBase-Desktop-Ver734-Setup.exe (PID: 1184)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 896)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 4172)
      • ShellExperienceHost.exe (PID: 5084)

    • Reads the Windows owner or organization settings

      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)

    • Process drops legitimate windows executable

      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)

    • There is functionality for taking screenshot (YARA)

      • myBase.exe (PID: 6852)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 896)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)

    • Checks supported languages

      • myBase-Desktop-Ver734-Setup.exe (PID: 6272)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 4172)
      • myBase-Desktop-Ver734-Setup.exe (PID: 1184)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)
      • myBase.exe (PID: 6388)
      • myBase.exe (PID: 1568)
      • ShellExperienceHost.exe (PID: 5084)
      • myBase.exe (PID: 4108)
      • myBase.exe (PID: 6852)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 896)

    • Create files in a temporary directory

      • myBase-Desktop-Ver734-Setup.exe (PID: 6272)
      • myBase-Desktop-Ver734-Setup.exe (PID: 1184)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)
      • myBase.exe (PID: 6388)
      • myBase.exe (PID: 6852)
      • myBase.exe (PID: 1568)
      • myBase.exe (PID: 4108)

    • Process checks computer location settings

      • myBase-Desktop-Ver734-Setup.tmp (PID: 4172)

    • Reads the computer name

      • myBase-Desktop-Ver734-Setup.tmp (PID: 4172)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)
      • myBase.exe (PID: 6388)
      • myBase.exe (PID: 6852)
      • myBase.exe (PID: 1568)
      • ShellExperienceHost.exe (PID: 5084)
      • myBase.exe (PID: 4108)

    • Detects InnoSetup installer (YARA)

      • myBase-Desktop-Ver734-Setup.exe (PID: 6272)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 4172)
      • myBase-Desktop-Ver734-Setup.exe (PID: 1184)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)

    • Creates a software uninstall entry

      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)

    • Compiled with Borland Delphi (YARA)

      • myBase-Desktop-Ver734-Setup.tmp (PID: 4172)
      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)

    • Creates files or folders in the user directory

      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)
      • myBase.exe (PID: 6388)

    • Manual execution by a user

      • myBase.exe (PID: 6388)
      • myBase.exe (PID: 1568)
      • myBase.exe (PID: 4108)
      • myBase.exe (PID: 6852)

    • Creates files in the program directory

      • myBase-Desktop-Ver734-Setup.tmp (PID: 6644)

    • Checks proxy server information

      • slui.exe (PID: 4380)

    • Reads the software policy settings

      • slui.exe (PID: 4380)

    • Reads the machine GUID from the registry

      • myBase.exe (PID: 6388)
      • myBase.exe (PID: 6852)
      • myBase.exe (PID: 1568)
      • myBase.exe (PID: 4108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:08:21 17:57:56
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: myBase Desktop 7.3.4 [FileCR]/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
12
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe mybase-desktop-ver734-setup.exe mybase-desktop-ver734-setup.tmp no specs mybase-desktop-ver734-setup.exe mybase-desktop-ver734-setup.tmp rundll32.exe no specs slui.exe mybase.exe no specs mybase.exe mybase.exe no specs shellexperiencehost.exe no specs mybase.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
896"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\myBase Desktop 7.3.4 [FileCR].zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1012C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1184"C:\Users\admin\AppData\Local\Temp\Rar$EXa896.39371\myBase Desktop 7.3.4 [FileCR]\myBase-Desktop-Ver734-Setup.exe" /SPAWNWND=$3026A /NOTIFYWND=$3025A C:\Users\admin\AppData\Local\Temp\Rar$EXa896.39371\myBase Desktop 7.3.4 [FileCR]\myBase-Desktop-Ver734-Setup.exe
myBase-Desktop-Ver734-Setup.tmp
User:
admin
Company:
Wjj Software
Integrity Level:
HIGH
Description:
myBase Desktop 7 Setup
Exit code:
0
Version:
7.3.4
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa896.39371\mybase desktop 7.3.4 [filecr]\mybase-desktop-ver734-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1568"C:\Users\admin\AppData\Local\wjjsoft\nyfedit7\myBase.exe" C:\Users\admin\AppData\Local\wjjsoft\nyfedit7\myBase.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\wjjsoft\nyfedit7\mybase.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4108"C:\Users\admin\AppData\Local\wjjsoft\nyfedit7\myBase.exe" C:\Users\admin\AppData\Local\wjjsoft\nyfedit7\myBase.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\wjjsoft\nyfedit7\mybase.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4172"C:\Users\admin\AppData\Local\Temp\is-NLQ0S.tmp\myBase-Desktop-Ver734-Setup.tmp" /SL5="$3025A,14232458,56832,C:\Users\admin\AppData\Local\Temp\Rar$EXa896.39371\myBase Desktop 7.3.4 [FileCR]\myBase-Desktop-Ver734-Setup.exe" C:\Users\admin\AppData\Local\Temp\is-NLQ0S.tmp\myBase-Desktop-Ver734-Setup.tmp—myBase-Desktop-Ver734-Setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-nlq0s.tmp\mybase-desktop-ver734-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4380C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5084"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
6272"C:\Users\admin\AppData\Local\Temp\Rar$EXa896.39371\myBase Desktop 7.3.4 [FileCR]\myBase-Desktop-Ver734-Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa896.39371\myBase Desktop 7.3.4 [FileCR]\myBase-Desktop-Ver734-Setup.exe
WinRAR.exe
User:
admin
Company:
Wjj Software
Integrity Level:
MEDIUM
Description:
myBase Desktop 7 Setup
Exit code:
0
Version:
7.3.4
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa896.39371\mybase desktop 7.3.4 [filecr]\mybase-desktop-ver734-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6388"C:\Users\admin\AppData\Local\wjjsoft\nyfedit7\myBase.exe" C:\Users\admin\AppData\Local\wjjsoft\nyfedit7\myBase.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\wjjsoft\nyfedit7\mybase.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
7 121
Read events
7 067
Write events
54
Delete events
0

Modification events

(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\myBase Desktop 7.3.4 [FileCR].zip
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6644) myBase-Desktop-Ver734-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\WJJSOFT\NYFEDIT7
Operation:writeName:AppSetupPath
Value:
C:\Users\admin\AppData\Local\wjjsoft\nyfedit7
(PID) Process:(6644) myBase-Desktop-Ver734-Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\WJJSOFT\NYFEDIT7
Operation:writeName:SetupSrcExe
Value:
C:\Users\admin\AppData\Local\Temp\Rar$EXa896.39371\myBase Desktop 7.3.4 [FileCR]\myBase-Desktop-Ver734-Setup.exe
Executable files
57
Suspicious files
36
Text files
1 239
Unknown types
0

Dropped files

PID
Process
Filename
Type
1184myBase-Desktop-Ver734-Setup.exeC:\Users\admin\AppData\Local\Temp\is-763KT.tmp\myBase-Desktop-Ver734-Setup.tmpexecutable
MD5:A2C4D52C66B4B399FACADB8CC8386745
SHA256:6C0465CE64C07E729C399A338705941D77727C7D089430957DF3E91A416E9D2A
896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa896.39371\myBase Desktop 7.3.4 [FileCR]\crack\myBase.exeexecutable
MD5:96936B899B7B52BA04D3039B1CFA3661
SHA256:BE2288C645232837EC0F6A90767CA14A4741536B27AE61FFECB59875094FFE38
896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa896.39371\myBase Desktop 7.3.4 [FileCR]\myBase-Desktop-Ver734-Setup.exeexecutable
MD5:32CA1A46724BF77235C39C53015F9626
SHA256:DC7D5EDF5B7919D18EF4D8C8F05B00D8AB49E71B96917FAE296BF34D4A459072
6644myBase-Desktop-Ver734-Setup.tmpC:\Users\admin\AppData\Local\Temp\is-3383U.tmp\_isetup\_setup64.tmpexecutable
MD5:C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA256:E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
6644myBase-Desktop-Ver734-Setup.tmpC:\Users\admin\AppData\Local\wjjsoft\nyfedit7\is-I8K1K.tmpexecutable
MD5:376F56C9755F31E9B2B6A2615D3C2342
SHA256:273BBBEDB9EEA3D9DB6D43B6701FEA4FC5B0FCD21116DEEA85958580AB645FE0
6644myBase-Desktop-Ver734-Setup.tmpC:\Users\admin\AppData\Local\wjjsoft\nyfedit7\QtCore4.dllexecutable
MD5:4E2FECB70364515BD577BE14871DC577
SHA256:A87119900D46CC87B9AC54BC331F509A8BA7FDBDBF57377F537E31F8431DAD24
6644myBase-Desktop-Ver734-Setup.tmpC:\Users\admin\AppData\Local\wjjsoft\nyfedit7\is-DOFTG.tmpexecutable
MD5:66093AE641C0DD5C0606F475A2430219
SHA256:16F43318D968247879D66A4077A6E370C73D9685122AB43E710F1BFBB4B11EFB
6644myBase-Desktop-Ver734-Setup.tmpC:\Users\admin\AppData\Local\wjjsoft\nyfedit7\is-3J1M8.tmpexecutable
MD5:DBCCA506208053F33D5539808A1BC833
SHA256:E8E2E085E615DA88D7A803218BB1E95ADE10566CE25A30BCDE2A41BB0E27D26A
6644myBase-Desktop-Ver734-Setup.tmpC:\Users\admin\AppData\Local\wjjsoft\nyfedit7\is-BT7UO.tmpexecutable
MD5:4E2FECB70364515BD577BE14871DC577
SHA256:A87119900D46CC87B9AC54BC331F509A8BA7FDBDBF57377F537E31F8431DAD24
6644myBase-Desktop-Ver734-Setup.tmpC:\Users\admin\AppData\Local\wjjsoft\nyfedit7\is-3ULHU.tmpexecutable
MD5:7FA9879F607860EFB23FC83C09CE102F
SHA256:91226F82085447E50DCA41BAD06D4DA88BB16E59981B1C7F482B58E7C7B92AFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
29
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7152
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7152
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6852
myBase.exe
GET
200
104.238.158.201:80
http://www.wjjsoft.com/cgi-bin/app_nyf7_renew_zrb.cgi?q=daily&d1=0_1d&d2=0_7&ver=7.3.4&os=Win32&uses=2&nags=0&lang=en-US&uid=&skey=&pass=0&mid=26b799fa&exe=60d2-5e0b_20200126&max5=885.3KiB&open5=2&res=1280x720&fmts=0_0_0_0&fmt0=
unknown
—
—
unknown
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7152
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7152
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.64
  • 20.190.159.130
  • 40.126.31.1
  • 20.190.159.73
  • 40.126.31.128
  • 40.126.31.130
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
myBase Desktop 7.3.4 [FileCR].zip