File name:

Productlist2025.com.exe

Full analysis: https://app.any.run/tasks/5440316d-acba-49ac-9792-39ecffdf2002
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 12:32:15
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
amsi-bypass
rat
quasar
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

69F3BC0083E17E7C28D06140308B12D8

SHA1:

3D637938626DBB7E63BE9DA10B83A94997F87F5C

SHA256:

95586FA277668206C164BCC7AF2D92602BF6A993B9F7FDA951BBD9FD3342E3EB

SSDEEP:

98304:B3njJWR9I4ETDMRiOiFUJvl0jYelrhro3144e7GS5j1jyDkA0DM8iw3uKwLycqr6:JNmFuM64

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • Productlist2025.com.exe (PID: 4488)
      • MSworkbooks.exe (PID: 5384)

    • Changes the autorun value in the registry

      • MSworkbooks.exe (PID: 3100)

    • QUASAR has been detected (SURICATA)

      • MSworkbooks.exe (PID: 3100)

    • QUASAR has been detected (YARA)

      • MSworkbooks.exe (PID: 3100)

    • Connects to the CnC server

      • MSworkbooks.exe (PID: 3100)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Productlist2025.com.exe (PID: 4488)
      • Productlist2025.com.exe (PID: 6344)

    • Application launched itself

      • Productlist2025.com.exe (PID: 4488)
      • MSworkbooks.exe (PID: 5384)

    • Reads security settings of Internet Explorer

      • Productlist2025.com.exe (PID: 4488)

    • Possibly patching Antimalware Scan Interface function (YARA)

      • Productlist2025.com.exe (PID: 4488)

    • Starts itself from another location

      • Productlist2025.com.exe (PID: 6344)

    • Contacting a server suspected of hosting an CnC

      • MSworkbooks.exe (PID: 3100)

    • There is functionality for taking screenshot (YARA)

      • MSworkbooks.exe (PID: 3100)

    • Connects to unusual port

      • MSworkbooks.exe (PID: 3100)

  • INFO

    • Creates files or folders in the user directory

      • Productlist2025.com.exe (PID: 4488)
      • Productlist2025.com.exe (PID: 6344)

    • Reads the computer name

      • Productlist2025.com.exe (PID: 4488)
      • Productlist2025.com.exe (PID: 6344)
      • MSworkbooks.exe (PID: 5384)

    • Checks supported languages

      • Productlist2025.com.exe (PID: 4488)
      • Productlist2025.com.exe (PID: 6344)
      • MSworkbooks.exe (PID: 5384)

    • Create files in a temporary directory

      • Productlist2025.com.exe (PID: 4488)
      • MSworkbooks.exe (PID: 5384)

    • Reads the machine GUID from the registry

      • Productlist2025.com.exe (PID: 4488)
      • Productlist2025.com.exe (PID: 6344)
      • MSworkbooks.exe (PID: 5384)
      • MSworkbooks.exe (PID: 3100)

    • Reads the software policy settings

      • SIHClient.exe (PID: 1512)

    • Process checks computer location settings

      • MSworkbooks.exe (PID: 5384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(3100) MSworkbooks.exe
Version1.4.1
C2 (3)bz-fnd3.ydns.eu:9841
wqo9.firewall-gateway.de:9792
Sub_DirSubDir
Install_NameMSworkbooks.exe
Mutexd9ad6O0279-3e005-4045-b50a-d6b5ff71d693
StartupMSworkbook
TagBZ EMY
LogDirLogs
SignatureXBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1...
CertificateMIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3Vsd...
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2065:03:26 15:05:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 3734016
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x3918ce
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft
FileDescription: Restau Manager
FileVersion: 1.0.0.0
InternalName: mvqx.exe
LegalCopyright: Copyright © Microsoft 2023
LegalTrademarks: -
OriginalFileName: mvqx.exe
ProductName: Restau Manager
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
12
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start productlist2025.com.exe schtasks.exe no specs conhost.exe no specs productlist2025.com.exe no specs productlist2025.com.exe no specs productlist2025.com.exe msworkbooks.exe no specs sihclient.exe schtasks.exe no specs conhost.exe no specs #QUASAR msworkbooks.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
672C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512C:\WINDOWS\System32\sihclient.exe /cv APHgI0RBv0iBCvy6DmSelg.0.2C:\Windows\System32\SIHClient.exe
upfc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
SIH Client
Exit code:
2149863430
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sihclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
c:\windows\system32\advapi32.dll
2152"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AFENhLHxFPepR" /XML "C:\Users\admin\AppData\Local\Temp\tmp80B.tmp"C:\Windows\SysWOW64\schtasks.exe—Productlist2025.com.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2384"C:\Users\admin\Desktop\Productlist2025.com.exe"C:\Users\admin\Desktop\Productlist2025.com.exe—Productlist2025.com.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Restau Manager
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\productlist2025.com.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3100"C:\Users\admin\AppData\Roaming\SubDir\MSworkbooks.exe"C:\Users\admin\AppData\Roaming\SubDir\MSworkbooks.exe
MSworkbooks.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Restau Manager
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\subdir\msworkbooks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Quasar
(PID) Process(3100) MSworkbooks.exe
Version1.4.1
C2 (3)bz-fnd3.ydns.eu:9841
wqo9.firewall-gateway.de:9792
Sub_DirSubDir
Install_NameMSworkbooks.exe
Mutexd9ad6O0279-3e005-4045-b50a-d6b5ff71d693
StartupMSworkbook
TagBZ EMY
LogDirLogs
SignatureXBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1...
CertificateMIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3Vsd...
4408\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4488"C:\Users\admin\Desktop\Productlist2025.com.exe" C:\Users\admin\Desktop\Productlist2025.com.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Restau Manager
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\productlist2025.com.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4944"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AFENhLHxFPepR" /XML "C:\Users\admin\AppData\Local\Temp\tmp4D81.tmp"C:\Windows\SysWOW64\schtasks.exe—MSworkbooks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5064"C:\Users\admin\Desktop\Productlist2025.com.exe"C:\Users\admin\Desktop\Productlist2025.com.exe—Productlist2025.com.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Restau Manager
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\productlist2025.com.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
11 929
Read events
11 927
Write events
2
Delete events
0

Modification events

(PID) Process:(6344) Productlist2025.com.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MSworkbook
Value:
"C:\Users\admin\AppData\Roaming\SubDir\MSworkbooks.exe"
(PID) Process:(3100) MSworkbooks.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MSworkbook
Value:
"C:\Users\admin\AppData\Roaming\SubDir\MSworkbooks.exe"
Executable files
2
Suspicious files
20
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1512SIHClient.exeC:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cabcompressed
MD5:ACD24F781C0C8F48A0BD86A0E9F2A154
SHA256:5C0A296B3574D170D69C90B092611646FE8991B8D103D412499DBE7BFDCCCC49
1512SIHClient.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E94643DE99F5621BC288D045BEA85DDbinary
MD5:B69C738C71C947FD12B66D6319DF84A5
SHA256:5582F1CB870F1C1801E659399C2295CB131E180893A6E54FC992B0DCD2FB88A2
1512SIHClient.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C7F163ED126D5C3CB9457F68EC64E9Ebinary
MD5:0C1C4AC9177078DBF59AA8E18D4436BB
SHA256:35ADD4C4718BB396147B338B0D8040556118A5814C0C734E432D102A3300B8C2
1512SIHClient.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8308086E5659ACD8D33846B02D52E737binary
MD5:6DE9B47E9795037E31E3175BD50E212E
SHA256:A5429A778EBD8267EC2B5F674B6927B5F6798151BA67BDC0808C217DE1DDF745
1512SIHClient.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C7F163ED126D5C3CB9457F68EC64E9Ebinary
MD5:B6969A16722D7DA4C71172B2BD9E06AC
SHA256:326229C1E5548A42D0EEFA5BB04714080220897B9AF2C2F52A27F8A7D12283EF
1512SIHClient.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ADAFB71803410A26B9B51A6EDB19CE71binary
MD5:0E3B9A4BBF9C81D2184524402E87F017
SHA256:80E0EC81F1815837DA735A614DC5400048955AC90CB1A34522B7D617A9EEF6DA
1512SIHClient.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\434E65B61F9D3E2BD9941E4DFA4ED4BBbinary
MD5:C56B95C040595AEC884DACD9EEBB3252
SHA256:E173A0E3395060338A550B8D5E01E99E1D5B3E83CDB7471CFDC9D2237AD54015
6344Productlist2025.com.exeC:\Users\admin\AppData\Roaming\SubDir\MSworkbooks.exeexecutable
MD5:69F3BC0083E17E7C28D06140308B12D8
SHA256:95586FA277668206C164BCC7AF2D92602BF6A993B9F7FDA951BBD9FD3342E3EB
1512SIHClient.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ADAFB71803410A26B9B51A6EDB19CE71binary
MD5:CE00AB22C984F2CC698BBFB41267AA2F
SHA256:93957FD913D2F2205B95F8378A05DECCC5435299695046A8E7F82B905DF7A7C1
1512SIHClient.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:86BEC7A51419CF6F8277608E79B2B807
SHA256:1AE99C253A484A9CB6814FB52AFD40E347DFE2CD6273E50B245695B87C1BC6E5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
61
DNS requests
19
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
POST
400
40.126.31.131:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
GET
200
20.103.156.88:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250324T123239Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=43fd2c6058134c8b8109eacaa6b4c027&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&currsel=137271744000000000&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3967471&metered=false&nettype=ethernet&npid=sc-280815&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1358001&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
2.97 Kb
whitelisted
—
—
POST
400
20.190.159.0:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
GET
200
20.223.36.55:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250324T123228Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f31d62a7a19b4008a2dad2d2cc3d5faf&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&currsel=137271744000000000&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3967471&metered=false&nettype=ethernet&npid=sc-280815&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1358001&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
2.95 Kb
whitelisted
—
—
GET
200
20.223.36.55:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250324T123239Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=fe5e9123e28e432f9d600673c97eb642&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&currsel=137271744000000000&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3967471&metered=false&nettype=ethernet&npid=sc-88000045&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1358001&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
2.97 Kb
whitelisted
1512
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
POST
400
40.126.31.131:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.75:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
2104
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6544
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5416
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1512
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 20.197.71.89
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.65
  • 20.190.160.3
  • 20.190.160.128
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.130
  • 20.190.160.20
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
bz-fnd3.ydns.eu
  • 213.209.150.170
unknown

Threats

PID
Process
Class
Message
3100
MSworkbooks.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 55
2196
svchost.exe
Misc activity
INFO [ANY.RUN] Dynamic DNS Service (ydns .eu)
3100
MSworkbooks.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Productlist2025.com.exe