File name:

[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3.rar

Full analysis: https://app.any.run/tasks/673723d6-cdf2-4117-9d33-96499fead9b6
Verdict: Malicious activity
Analysis date: October 30, 2024, 06:18:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-scr
arch-doc
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

DF6EB4A243821A2A662D30E033F5C95D

SHA1:

8B31398273FFF8E8F6C62615BC68E3D144644EC1

SHA256:

9BBEACA16D04FB6B4488AAE472E77BE10F32E089D08EE48FBAA091A344A67D57

SSDEEP:

98304:q1M6lEEOxpUKr+Pt0/OeFFGkShrPc752m+Gdog9fQc661a13hfo8CD7knZKXc7ba:icOERzb2Il82IT90tx1PNIQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5612)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3008)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5948)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 5948)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5948)
      • cmd.exe (PID: 1572)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5948)
      • cmd.exe (PID: 1572)

    • The process executes VB scripts

      • cmd.exe (PID: 5948)
      • cmd.exe (PID: 1572)
      • cmd.exe (PID: 6760)

    • Executing commands from ".cmd" file

      • cmd.exe (PID: 5948)

    • Application launched itself

      • cmd.exe (PID: 5948)
      • cmd.exe (PID: 1572)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 5652)
      • cmd.exe (PID: 1880)
      • cmd.exe (PID: 7136)
      • cmd.exe (PID: 5372)
      • cmd.exe (PID: 7056)
      • cmd.exe (PID: 6588)

    • Hides command output

      • cmd.exe (PID: 3904)
      • cmd.exe (PID: 6100)
      • cmd.exe (PID: 5616)
      • cmd.exe (PID: 700)
      • cmd.exe (PID: 3024)
      • cmd.exe (PID: 6736)
      • cmd.exe (PID: 712)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 1572)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1572)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 6936)
      • cmd.exe (PID: 1572)
      • cmd.exe (PID: 1732)
      • cmd.exe (PID: 204)
      • cmd.exe (PID: 6440)
      • cmd.exe (PID: 6764)

    • Uses WMIC.EXE to obtain service application data

      • cmd.exe (PID: 1880)
      • cmd.exe (PID: 1572)

    • Connects to unusual port

      • SppExtComObj.Exe (PID: 696)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 3008)
      • cmd.exe (PID: 5948)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3008)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 2796)
      • mode.com (PID: 6484)
      • mode.com (PID: 2196)
      • mode.com (PID: 6836)
      • mode.com (PID: 4088)

    • Changes the display of characters in the console

      • cmd.exe (PID: 5948)

    • Checks operating system version

      • cmd.exe (PID: 1572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
298
Monitored processes
167
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe slui.exe no specs rundll32.exe no specs winrar.exe cmd.exe conhost.exe no specs chcp.com no specs fsutil.exe no specs mode.com no specs chcp.com no specs cacls.exe no specs cscript.exe no specs slui.exe no specs cscript.exe no specs findstr.exe no specs choice.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs fsutil.exe no specs mode.com no specs mode.com no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs choice.exe no specs mode.com no specs choice.exe no specs cmd.exe no specs wscript.exe no specs fsutil.exe no specs ping.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs wmic.exe no specs find.exe no specs find.exe no specs find.exe no specs find.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs cscript.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs wmic.exe no specs slui.exe no specs cmd.exe no specs wmic.exe no specs wmic.exe no specs find.exe no specs find.exe no specs find.exe no specs find.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs find.exe no specs find.exe no specs find.exe no specs find.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs find.exe no specs find.exe no specs find.exe no specs find.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs slui.exe no specs find.exe no specs find.exe no specs find.exe no specs find.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs find.exe no specs find.exe no specs find.exe no specs find.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs find.exe no specs find.exe no specs find.exe no specs find.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs mode.com no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs choice.exe no specs cscript.exe no specs findstr.exe no specs choice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204choice /C:12345678 /N /M ". Nhap lua chon cua ban [1,2,3,4,5,6,7,8] : "C:\Windows\System32\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
204C:\WINDOWS\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get ID /VALUE"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
300cscript //nologo C:\WINDOWS\system32\slmgr.vbs /xpr C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
624findstr "1" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
696C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe
svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
700C:\WINDOWS\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nulC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
712C:\WINDOWS\system32\cmd.exe /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nulC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
784wmic path SoftwareLicensingProduct where ID='3f1afc82-f8ac-4f6c-8005-1d233e606eee' get Name C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
784findstr "1" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
848wmic Path Win32_OperatingSystem Get CSDVersion /format:LISTC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
13 515
Read events
13 490
Write events
25
Delete events
0

Modification events

(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3.rar
(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
Executable files
23
Suspicious files
3
Text files
285
Unknown types
0

Dropped files

PID
Process
Filename
Type
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSB2016Digital\BIN\gatherosstate.exeexecutable
MD5:E2C16921EE7D949DBB70234FC235F726
SHA256:BDFE57913C83BC1E5647EF0B75C647FF3B36673790D2ABB3593DCF9F1B426AD6
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSC2019years38\bin\ARM64_slc.dllexecutable
MD5:21101B68F168BA3BAC0FB3733267DFEF
SHA256:8B01AAB03C529433FE39C83D9B70C52654B83970F9C92FCD5E3DA2A5598BF89F
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSB2016Digital\BIN\slc.dllexecutable
MD5:E2840606372AB67B7107CE757D506C28
SHA256:37E20A504ADE965184D92ED5CA415CDE899090A6A20EA3ABF8C85FF9648B66F4
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSB2015Digital\BIN\gatherosstate.exeexecutable
MD5:239EBED4DB9FDB3AE93D1592EA2F8132
SHA256:971A591B9C2F4D06D77268787D54220A48BAC7B17B000B13777FF89F2D11C15C
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSC2019years38\ActLTSC2019years38.cmdbinary
MD5:930810E3EFC34E2309EE73AF36E213B8
SHA256:0CAFE34619D191DB57309EE9CAA6D53DDD87C546DBABAF3DE0A09628553D858C
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSC2019years38\bin\slc.dllexecutable
MD5:B21C40AAF16BA46B2732618D089DB3A4
SHA256:9395A37C42E83568DC5ECB25D9E9FCA4C6C1C4F47E336FB6CCAE62DF5C696B4D
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSC2019years38\bin\ARM64_gatherosstate.exeexecutable
MD5:CD65269EE38B3E89E9F1F95C422EAE2E
SHA256:44244E541B6A5BE14E6C2053B752F06E1AF0415B2252CED2BED0A562B3ED6462
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSC2019years38\bin\ClipUp.exeexecutable
MD5:BD1908AB0887873FCE6B059822599E4E
SHA256:0D6E9F6BBD0321EDA149658D96040CB4F79E0BD93BA60061F25B28FECBF4D4EF
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSB2015Digital\ActLTSB2015Digital.cmdtext
MD5:7197630F8784496254B5707D05187265
SHA256:4BE2650D035B4570EFA5F08C10F14B048203426FBCC6E84C6FC6C7E09BBE52AA
3008WinRAR.exeC:\Users\admin\AppData\Local\Temp\[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3\BIN\ActWin10Digital\ActLTSBLTSC\ActLTSC2019years38\temp.cmdtext
MD5:DE1564FF9840899AF1E5632EF0316913
SHA256:C85718BEC05197412FF11635449785466FF940B81D9EDD1E8A48073C1C8C0342
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
48
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4004
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6364
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3740
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3740
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5488
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3396
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6944
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4004
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4004
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4360
SearchApp.exe
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.152
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.137
  • 104.126.37.153
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.68
  • 40.126.31.71
  • 20.190.159.2
  • 40.126.31.73
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.64
whitelisted
th.bing.com
  • 104.126.37.128
  • 104.126.37.186
  • 104.126.37.152
  • 104.126.37.130
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.153
  • 104.126.37.137
  • 104.126.37.139
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
[HaDoanTV.Com]Activate-AIO-Tools-v3.1.3.rar