File name:

Kiwi X Executor.exe

Full analysis: https://app.any.run/tasks/51f1e7b8-59e0-49b9-9bd8-d13715ee473b
Verdict: Malicious activity
Analysis date: July 31, 2024, 19:24:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D7DCFAC49DDCD30CB197F3C1F55B7D84

SHA1:

C1E980A0C9E52E0C35FC4EE6BF0EF2286F724C77

SHA256:

97A6719F9391D1C148DB687583F50490DECC908101FC1856EF15AFBFD648CA72

SSDEEP:

49152:hdixrq3Bdw/SYUJ/yVzPFrSnIhVha3DzNvSmG5PmaHX5Y7+rAM5QFLY7YphlwNWl:Wrq3BdwDwEFroI8fZG5j35s+rTQFnLjl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Kiwi X Executor.exe (PID: 6420)
      • Kiwi X Executor.exe (PID: 6512)
      • Kiwi X Executor.tmp (PID: 6544)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Kiwi X Executor.exe (PID: 6420)
      • Kiwi X Executor.exe (PID: 6512)
      • Kiwi X Executor.tmp (PID: 6544)

    • Reads security settings of Internet Explorer

      • Kiwi X Executor.tmp (PID: 6440)
      • Kiwi X Executor.tmp (PID: 6544)

    • Reads the date of Windows installation

      • Kiwi X Executor.tmp (PID: 6440)

    • Reads the Windows owner or organization settings

      • Kiwi X Executor.tmp (PID: 6544)

    • Checks Windows Trust Settings

      • Kiwi X Executor.tmp (PID: 6544)

  • INFO

    • Checks supported languages

      • Kiwi X Executor.exe (PID: 6420)
      • Kiwi X Executor.tmp (PID: 6440)
      • Kiwi X Executor.exe (PID: 6512)
      • Kiwi X Executor.tmp (PID: 6544)
      • identity_helper.exe (PID: 8084)
      • identity_helper.exe (PID: 6728)
      • TextInputHost.exe (PID: 6280)

    • Reads Environment values

      • Kiwi X Executor.exe (PID: 6420)
      • Kiwi X Executor.tmp (PID: 6440)
      • Kiwi X Executor.exe (PID: 6512)
      • Kiwi X Executor.tmp (PID: 6544)
      • identity_helper.exe (PID: 8084)
      • identity_helper.exe (PID: 6728)

    • Create files in a temporary directory

      • Kiwi X Executor.exe (PID: 6420)
      • Kiwi X Executor.exe (PID: 6512)
      • Kiwi X Executor.tmp (PID: 6544)

    • Reads the computer name

      • Kiwi X Executor.tmp (PID: 6440)
      • Kiwi X Executor.exe (PID: 6512)
      • Kiwi X Executor.tmp (PID: 6544)
      • identity_helper.exe (PID: 6728)
      • TextInputHost.exe (PID: 6280)
      • identity_helper.exe (PID: 8084)

    • Process checks computer location settings

      • Kiwi X Executor.tmp (PID: 6440)

    • Checks proxy server information

      • Kiwi X Executor.tmp (PID: 6544)

    • Reads Microsoft Office registry keys

      • Kiwi X Executor.tmp (PID: 6544)
      • msedge.exe (PID: 2336)
      • msedge.exe (PID: 5920)
      • msedge.exe (PID: 8080)

    • Reads the machine GUID from the registry

      • Kiwi X Executor.tmp (PID: 6544)

    • Reads the software policy settings

      • Kiwi X Executor.tmp (PID: 6544)

    • Manual execution by a user

      • msedge.exe (PID: 2336)
      • msedge.exe (PID: 8088)

    • Creates files or folders in the user directory

      • Kiwi X Executor.tmp (PID: 6544)

    • Creates files in the program directory

      • Kiwi X Executor.tmp (PID: 6544)

    • Creates a software uninstall entry

      • Kiwi X Executor.tmp (PID: 6544)

    • Application launched itself

      • msedge.exe (PID: 5920)
      • msedge.exe (PID: 8080)
      • msedge.exe (PID: 2336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:06:10 14:47:11+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 90112
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 6.5.0.0
ProductVersionNumber: 6.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Kiwi X Executor.exe Setup
FileVersion: 6.5.0.0
LegalCopyright: Kiwi X Executor.exe
OriginalFileName:
ProductName: Kiwi X Executor.exe
ProductVersion: 6.5.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
192
Monitored processes
59
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start kiwi x executor.exe kiwi x executor.tmp no specs kiwi x executor.exe kiwi x executor.tmp svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs textinputhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2448 --field-trial-handle=2312,i,689571366044842391,10648294671180110589,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1452"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3680 --field-trial-handle=2300,i,13929378513504977511,12770560440310212150,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2336"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument https://cupindustry.icu/tracker/thank_you.php?trk=2772C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3488 --field-trial-handle=2300,i,13929378513504977511,12770560440310212150,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2852"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2308 --field-trial-handle=2312,i,689571366044842391,10648294671180110589,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3520"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x294,0x298,0x29c,0x1e8,0x1e0,0x7fffd3fe5fd8,0x7fffd3fe5fe4,0x7fffd3fe5ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4160"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4924 --field-trial-handle=2228,i,6623236186040053326,17549531873673044809,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4276"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3948 --field-trial-handle=2228,i,6623236186040053326,17549531873673044809,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5500"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4992 --field-trial-handle=2228,i,6623236186040053326,17549531873673044809,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
22 024
Read events
21 903
Write events
115
Delete events
6

Modification events

(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
901900003BC639557FE3DA01
(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
A6C41164D4DCD3AB1C9FDA2D9F57972DB4B157B0B7532EF8586DC27F7D8C34C6
(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Kiwi X Executor.exe_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.3.1
(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Kiwi X Executor.exe_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\Setup
(PID) Process:(6544) Kiwi X Executor.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Kiwi X Executor.exe_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Setup\
Executable files
9
Suspicious files
201
Text files
144
Unknown types
1

Dropped files

PID
Process
Filename
Type
6544Kiwi X Executor.tmpC:\Program Files (x86)\Setup\unins000.exeexecutable
MD5:3630131F8A4F8FCA0633912CE5E4AAB0
SHA256:D0E640A8F09391CF7E93D1638021A4A025171992204C2FD2BE53683097BBF6E0
6544Kiwi X Executor.tmpC:\Users\admin\AppData\Local\Temp\is-EVP6I.tmp\idp.dllexecutable
MD5:55C310C0319260D798757557AB3BF636
SHA256:54E7E0AD32A22B775131A6288F083ED3286A9A436941377FC20F85DD9AD983ED
6544Kiwi X Executor.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:1F5DBB46775C75CA76A1D289FF434CF0
SHA256:25844A2DF60CE8B57F955EB7CF5691FFD44D168B014130784EBBA43859535D9A
6544Kiwi X Executor.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:0E7F2F46ED4D34B8881DA159CA60B272
SHA256:E8EBD2847D9A58278AC0BBF2F463FD86799BC093C3D0256CFDB0559C630086F0
5920msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Last Versiontext
MD5:C7E2197BAE099B13BBB3ADEB1433487D
SHA256:3460EEAF45D581DD43A6E4E17AF8102DDAFF5AEAA88B10099527CF85211629E9
6544Kiwi X Executor.tmpC:\Program Files (x86)\Setup\unins000.datbinary
MD5:F2797752A885E9FD10B2B0191C4ABCB6
SHA256:16933C58A42E95409AE550A574D54E48E50AC3E5333C74C4F17BBBAA836F731A
5920msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State~RFe9229.TMPbinary
MD5:2F3AC00332828151FF39C7C43D4FD770
SHA256:2BD7B8BF10F2E900E76944C92BD18ED695BD956859F15503B050F734CFE70BB3
2336msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe9314.TMP —
MD5:—
SHA256:—
2336msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFe9314.TMP —
MD5:—
SHA256:—
2336msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
113
DNS requests
143
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
Kiwi X Executor.tmp
GET
200
216.58.206.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6544
Kiwi X Executor.tmp
GET
200
216.58.206.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1344
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6944
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6268
msedge.exe
GET
304
2.16.241.15:80
http://apps.identrust.com/roots/dstrootcax3.p7c
unknown
—
—
whitelisted
6892
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6268
msedge.exe
GET
304
69.192.161.44:80
http://x1.i.lencr.org/
unknown
—
—
whitelisted
6268
msedge.exe
GET
304
69.192.161.44:80
http://r3.i.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3508
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5240
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3508
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
Kiwi X Executor.tmp
104.21.13.30:443
cupindustry.icu
CLOUDFLARENET
—
unknown
6544
Kiwi X Executor.tmp
216.58.206.67:80
c.pki.goog
GOOGLE
US
whitelisted
5336
SearchApp.exe
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 216.58.212.174
whitelisted
cupindustry.icu
  • 104.21.13.30
  • 172.67.132.123
unknown
c.pki.goog
  • 216.58.206.67
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.155
  • 104.126.37.131
  • 104.126.37.123
  • 104.126.37.137
  • 104.126.37.186
  • 104.126.37.153
  • 104.126.37.160
  • 104.126.37.185
  • 104.126.37.144
  • 104.126.37.145
  • 104.126.37.171
  • 104.126.37.170
  • 104.126.37.139
  • 104.126.37.146
  • 104.126.37.161
  • 104.126.37.179
  • 104.126.37.128
  • 104.126.37.178
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.72
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.136
  • 20.190.160.20
  • 40.126.32.76
whitelisted
th.bing.com
  • 104.126.37.160
  • 104.126.37.144
  • 104.126.37.137
  • 104.126.37.153
  • 104.126.37.185
  • 104.126.37.145
  • 104.126.37.186
  • 104.126.37.163
  • 104.126.37.155
  • 104.126.37.171
  • 104.126.37.131
  • 104.126.37.170
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.161
  • 104.126.37.130
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
6544
Kiwi X Executor.tmp
Potentially Bad Traffic
ET INFO Suspicious Domain (*.icu) in TLS SNI
6268
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6268
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Kiwi X Executor.exe