File name:

0xGhost-BlackLine-main.zip

Full analysis: https://app.any.run/tasks/5bb6a008-95f9-4a19-9164-7e51ed007c39
Verdict: Malicious activity
Analysis date: April 29, 2025, 14:01:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

58023062E46BC3B0F83B755078CB79F5

SHA1:

E3EEC7F4AFD38B330C643289DB2A21E375415882

SHA256:

9DF5F8EEAECD8B4F166DD9AE4170103293A7DF71DC48A18321259E514898A44A

SSDEEP:

98304:14NW8HrUe6p1SdZUuareGVzMHr2Kp5y05bcyVrKGA2Egoe3ZXi7gvxax1oPBQfQM:Ele9BRmjaqoFfNx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 0xGhost BlackLine.exe (PID: 5376)

    • Process drops legitimate windows executable

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 2340)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 3968)
      • msiexec.exe (PID: 8148)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 536)

    • Executable content was dropped or overwritten

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 2340)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 536)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 3968)

    • Starts a Microsoft application from unusual location

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 536)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 3968)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 7936)

    • Starts itself from another location

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 536)

    • Starts CMD.EXE for commands execution

      • 0xGhost BlackLine.exe (PID: 444)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 8148)

    • The system shut down or reboot

      • 0xGhost BlackLine.exe (PID: 4932)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 5776)
      • notepad.exe (PID: 3140)
      • 0xGhost BlackLine.exe (PID: 1088)
      • 0xGhost BlackLine.exe (PID: 5376)
      • 0xGhost BlackLine.exe (PID: 444)
      • 0xGhost BlackLine.exe (PID: 4932)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5776)
      • msedge.exe (PID: 5972)
      • msiexec.exe (PID: 8148)

    • Checks supported languages

      • 0xGhost BlackLine.exe (PID: 1088)
      • 0xGhost BlackLine.exe (PID: 5376)

    • Reads the computer name

      • 0xGhost BlackLine.exe (PID: 1088)
      • 0xGhost BlackLine.exe (PID: 5376)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 3140)

    • Application launched itself

      • msedge.exe (PID: 5972)

    • Reads the software policy settings

      • slui.exe (PID: 7660)

    • The sample compiled with english language support

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 2340)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 536)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 3968)
      • msiexec.exe (PID: 8148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:04:29 05:07:32
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: 0xGhost-BlackLine-main/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
67
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe rundll32.exe no specs winrar.exe 0xghost blackline.exe no specs notepad.exe no specs 0xghost blackline.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs windowsdesktop-runtime-8.0.15-win-x64.exe windowsdesktop-runtime-8.0.15-win-x64.exe windowsdesktop-runtime-8.0.15-win-x64.exe msiexec.exe msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs 0xghost blackline.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs msedge.exe no specs 0xghost blackline.exe no specs msedge.exe no specs shutdown.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=7012 --field-trial-handle=2332,i,11075583813565184434,13788322051305910703,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
444"C:\Users\admin\Desktop\0xGhost BlackLine\0xGhost BlackLine.exe" C:\Users\admin\Desktop\0xGhost BlackLine\0xGhost BlackLine.exe—explorer.exe
User:
admin
Company:
0xGhost BlackLine
Integrity Level:
MEDIUM
Description:
0xGhost BlackLine
Exit code:
3489660927
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\0xghost blackline\0xghost blackline.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
536"C:\Users\admin\AppData\Local\Temp\{7DDFC231-735F-43EE-B1CC-1C12D64F159A}\.cr\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\Users\admin\Downloads\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=704 -burn.filehandle.self=544 C:\Users\admin\AppData\Local\Temp\{7DDFC231-735F-43EE-B1CC-1C12D64F159A}\.cr\windowsdesktop-runtime-8.0.15-win-x64.exe
windowsdesktop-runtime-8.0.15-win-x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Desktop Runtime - 8.0.15 (x64)
Exit code:
0
Version:
8.0.15.34718
Modules
Images
c:\users\admin\appdata\local\temp\{7ddfc231-735f-43ee-b1cc-1c12d64f159a}\.cr\windowsdesktop-runtime-8.0.15-win-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=2332,i,11075583813565184434,13788322051305910703,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2384 --field-trial-handle=2332,i,11075583813565184434,13788322051305910703,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
976C:\Windows\syswow64\MsiExec.exe -Embedding 2967720D5E5EC0B89CDC7A45AD553AF0C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1088"C:\Users\admin\Desktop\0xGhost BlackLine\0xGhost BlackLine.exe" C:\Users\admin\Desktop\0xGhost BlackLine\0xGhost BlackLine.exe—explorer.exe
User:
admin
Company:
0xGhost BlackLine
Integrity Level:
MEDIUM
Description:
0xGhost BlackLine
Exit code:
2147516547
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\0xghost blackline\0xghost blackline.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1116"shutdown" /s /f /t 0C:\Windows\System32\shutdown.exe—0xGhost BlackLine.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shutdownext.dll
1324"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5652 --field-trial-handle=2332,i,11075583813565184434,13788322051305910703,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—shutdown.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
23 894
Read events
22 939
Write events
911
Delete events
44

Modification events

(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\0xGhost-BlackLine-main.zip
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
489
Suspicious files
344
Text files
82
Unknown types
2

Dropped files

PID
Process
Filename
Type
5776WinRAR.exeC:\Users\admin\Desktop\0xGhost BlackLine\0xGhost BlackLine\0xGhost BlackLine.dll —
MD5:—
SHA256:—
5972msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF11a1ac.TMP —
MD5:—
SHA256:—
5972msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF11a1ac.TMP —
MD5:—
SHA256:—
5972msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
5972msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
5972msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF11a342.TMP —
MD5:—
SHA256:—
5972msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF11a19c.TMP —
MD5:—
SHA256:—
5972msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7500.13685\0xGhost-BlackLine-main\0xGhost BlackLine.zipcompressed
MD5:36498C59AEF419DC6632CB02A844D65A
SHA256:540EC8CCD31E162A7D9172D2269C5B741CFED3D2C5DF781869DBF9FBC82233F3
5972msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
72
DNS requests
80
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7304
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7304
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5972
msedge.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
6676
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/241074c3-f448-482a-8c90-855c388ea76a?P1=1746052103&P2=404&P3=2&P4=KOCfKDlV4f953GRRMDGNuMD2Tr79z6MW83xRXBDFgitsjVYmyJO2MGTWmaJOgffTT4Lvhs%2fnwzr%2bKklaNolGvQ%3d%3d
unknown
—
—
whitelisted
5972
msedge.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6676
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/241074c3-f448-482a-8c90-855c388ea76a?P1=1746052103&P2=404&P3=2&P4=KOCfKDlV4f953GRRMDGNuMD2Tr79z6MW83xRXBDFgitsjVYmyJO2MGTWmaJOgffTT4Lvhs%2fnwzr%2bKklaNolGvQ%3d%3d
unknown
—
—
whitelisted
6676
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/241074c3-f448-482a-8c90-855c388ea76a?P1=1746052103&P2=404&P3=2&P4=KOCfKDlV4f953GRRMDGNuMD2Tr79z6MW83xRXBDFgitsjVYmyJO2MGTWmaJOgffTT4Lvhs%2fnwzr%2bKklaNolGvQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4108
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.131
  • 20.190.160.132
  • 20.190.160.128
  • 20.190.160.4
  • 20.190.160.65
  • 40.126.32.72
  • 20.190.160.2
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
config.edge.skype.com
  • 13.107.43.16
whitelisted
aka.ms
  • 104.119.110.121
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
  • 150.171.29.11
  • 150.171.30.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0xGhost-BlackLine-main.zip