File name:

SpotX-main.zip

Full analysis: https://app.any.run/tasks/c0931515-4ce0-4194-96a8-cc7459d992f4
Verdict: Malicious activity
Analysis date: October 24, 2024, 22:47:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-scr
arch-html
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

B5105CC1EFAACAD90008092B6B4EFD21

SHA1:

9B57B699205DE48E180554210959586CAA89DD23

SHA256:

9FF74BBBAE0A5DECCB839B7493D509D0A00ADC36BF01B3C0260842236CFBFD8C

SSDEEP:

49152:S5qsrw635RmGzyzM49YiG03NyBoqTlRzFvg5JzROFZqxG515OdPF/amOvM45dCqu:S5frw63ZywcYix3NU/FvOJz8bAGYdPFB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 300)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SpotifySetup.exe (PID: 7320)

    • Process drops legitimate windows executable

      • SpWebInst0.exe (PID: 2796)

    • Executable content was dropped or overwritten

      • SpWebInst0.exe (PID: 2796)

    • Application launched itself

      • Spotify.exe (PID: 7936)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 3004)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3004)

    • Checks Windows Trust Settings

      • SpotifySetup.exe (PID: 7320)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 4616)

    • Executing commands from a ".bat" file

      • explorer.exe (PID: 4616)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 3532)

    • The process executes Powershell scripts

      • cmd.exe (PID: 3004)

  • INFO

    • Manual execution by a user

      • msedge.exe (PID: 4808)

    • Reads the computer name

      • identity_helper.exe (PID: 7648)
      • SpotifySetup.exe (PID: 7320)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 1732)
      • msedge.exe (PID: 4808)
      • msedge.exe (PID: 4516)

    • The process uses the downloaded file

      • msedge.exe (PID: 6736)
      • WinRAR.exe (PID: 300)
      • explorer.exe (PID: 4616)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4616)

    • Reads the software policy settings

      • explorer.exe (PID: 4616)
      • SpotifySetup.exe (PID: 7320)

    • Checks supported languages

      • identity_helper.exe (PID: 7648)
      • SpotifySetup.exe (PID: 7320)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 4616)
      • SpotifySetup.exe (PID: 7320)

    • Reads Environment values

      • identity_helper.exe (PID: 7648)

    • Checks proxy server information

      • explorer.exe (PID: 4616)
      • SpotifySetup.exe (PID: 7320)

    • Application launched itself

      • msedge.exe (PID: 4808)

    • Reads the machine GUID from the registry

      • SpotifySetup.exe (PID: 7320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:10:21 13:52:32
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: SpotX-main/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
219
Monitored processes
77
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs explorer.exe spotifysetup.exe msedge.exe no specs msedge.exe no specs spwebinst0.exe msedge.exe no specs msedge.exe no specs spotify.exe spotify.exe no specs spotify.exe no specs spotify.exe spotify.exe no specs spotify.exe no specs spotify.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe spotify.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\SpotX-main.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6036 --field-trial-handle=2516,i,2286599001670312489,716335480522363708,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1068"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=2516,i,2286599001670312489,716335480522363708,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1248"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6204 --field-trial-handle=2516,i,2286599001670312489,716335480522363708,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1336"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8188 --field-trial-handle=2516,i,2286599001670312489,716335480522363708,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1576"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3636 --field-trial-handle=2516,i,2286599001670312489,716335480522363708,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1732"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2608 --field-trial-handle=2516,i,2286599001670312489,716335480522363708,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2364"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6216 --field-trial-handle=2516,i,2286599001670312489,716335480522363708,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2364"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6612 --field-trial-handle=2516,i,2286599001670312489,716335480522363708,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2692"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=7540 --field-trial-handle=2516,i,2286599001670312489,716335480522363708,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
38 490
Read events
38 258
Write events
207
Delete events
25

Modification events

(PID) Process:(4616) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000040244
Operation:writeName:VirtualDesktop
Value:
100000003030445671D90A7D3588864C9F3CEA9EBAB7B4A7
(PID) Process:(300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SpotX-main.zip
(PID) Process:(300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
(PID) Process:(300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:13
Value:
Executable files
41
Suspicious files
852
Text files
203
Unknown types
108

Dropped files

PID
Process
Filename
Type
300WinRAR.exeC:\Users\admin\Desktop\SpotX-main\.github\ISSUE_TEMPLATE\bug_report.ymlhtml
MD5:A9AFEA166C4167BD507004FB083E9775
SHA256:F64AAD9A9AFB3FF4088E7315948290A469D65C51F37CBB4132B0531ADD8952B9
4616explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
300WinRAR.exeC:\Users\admin\Desktop\SpotX-main\.github\ISSUE_TEMPLATE\itranslation-fix.ymltext
MD5:19C8639964E1AD0A4CF7663348392055
SHA256:537E744999316EDDE993CBC1497A346038AC79F43D6FEA1E81F2320B17F964ED
300WinRAR.exeC:\Users\admin\Desktop\SpotX-main\.github\ISSUE_TEMPLATE\config.ymltext
MD5:A95BFBBB52A33307DC7608550790DD43
SHA256:3E543C1D280A7A459AD54E27C153641AC31ED41AABFE4DC9ABEBE27AE9A92DE6
300WinRAR.exeC:\Users\admin\Desktop\SpotX-main\.github\Pic\Shields\SpotX_Community.svgimage
MD5:018C9B2454D194418260C5654DFDBB24
SHA256:51C014095797F962ABE81304BCB6A645F64FA394A6B17DA94728A3697B9D12D2
300WinRAR.exeC:\Users\admin\Desktop\SpotX-main\.github\Pic\Shields\SpotX_Channel.svgimage
MD5:D165957C98E25D944C144491C5F7C2A4
SHA256:A1F7C5DF280814721DCE27A68D8C3D9B032E109A0CED0365655D58717167A482
300WinRAR.exeC:\Users\admin\Desktop\SpotX-main\Install_Old_theme.battext
MD5:0B77A7604290D02B4AD8CA31D024F791
SHA256:F645C0E9C9DD665BCA8B85A1AB509AE436E539BBB0904246F25E8CB672BF2194
300WinRAR.exeC:\Users\admin\Desktop\SpotX-main\Uninstall.battext
MD5:B74FC1987D231FF335F8A82DAB4C040F
SHA256:98FE8B9857375588722D2D2A325AF6C998E8AD93F87EC84C2A409C21979D0210
300WinRAR.exeC:\Users\admin\Desktop\SpotX-main\.github\ISSUE_TEMPLATE\installer-new-translation.ymlhtml
MD5:5D5449DCCDC51350197D2892FDA7151F
SHA256:9364CB4A6C2E7F151CAA5CE615B0270E082ED591E1F76FF807350CDE7FC0A3D7
300WinRAR.exeC:\Users\admin\Desktop\SpotX-main\css-helper\lyrics-color\colors.csstext
MD5:681FF32340D38E28C7341686E0348BDB
SHA256:324399787DCA4333961691539C88DC821A8F4ECFE0974D901B2845084FED297B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
68
TCP/UDP connections
222
DNS requests
207
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4616
explorer.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
7320
SpotifySetup.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEH%2B2oOpV4owETJUuldY0n1w%3D
unknown
—
—
whitelisted
6384
svchost.exe
HEAD
200
23.218.239.154:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ac8d4a99-4067-46d7-b9be-0967a17f0d8d?P1=1730363162&P2=404&P3=2&P4=koVXPwmZVTXA9xmSufrFBpIi2k81%2bA%2fKC6edkC7kdoRu4fPnp3WB3UmZFRwq0KY2W4Z5XbUK35qV7ZOBk5a11w%3d%3d
unknown
—
—
whitelisted
6384
svchost.exe
GET
206
23.218.239.154:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ac8d4a99-4067-46d7-b9be-0967a17f0d8d?P1=1730363162&P2=404&P3=2&P4=koVXPwmZVTXA9xmSufrFBpIi2k81%2bA%2fKC6edkC7kdoRu4fPnp3WB3UmZFRwq0KY2W4Z5XbUK35qV7ZOBk5a11w%3d%3d
unknown
—
—
whitelisted
6384
svchost.exe
GET
206
23.218.239.154:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ac8d4a99-4067-46d7-b9be-0967a17f0d8d?P1=1730363162&P2=404&P3=2&P4=koVXPwmZVTXA9xmSufrFBpIi2k81%2bA%2fKC6edkC7kdoRu4fPnp3WB3UmZFRwq0KY2W4Z5XbUK35qV7ZOBk5a11w%3d%3d
unknown
—
—
whitelisted
6384
svchost.exe
GET
206
23.218.239.154:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ac8d4a99-4067-46d7-b9be-0967a17f0d8d?P1=1730363162&P2=404&P3=2&P4=koVXPwmZVTXA9xmSufrFBpIi2k81%2bA%2fKC6edkC7kdoRu4fPnp3WB3UmZFRwq0KY2W4Z5XbUK35qV7ZOBk5a11w%3d%3d
unknown
—
—
whitelisted
6384
svchost.exe
GET
206
23.218.239.154:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ac8d4a99-4067-46d7-b9be-0967a17f0d8d?P1=1730363162&P2=404&P3=2&P4=koVXPwmZVTXA9xmSufrFBpIi2k81%2bA%2fKC6edkC7kdoRu4fPnp3WB3UmZFRwq0KY2W4Z5XbUK35qV7ZOBk5a11w%3d%3d
unknown
—
—
whitelisted
6384
svchost.exe
GET
206
23.218.239.154:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ac8d4a99-4067-46d7-b9be-0967a17f0d8d?P1=1730363162&P2=404&P3=2&P4=koVXPwmZVTXA9xmSufrFBpIi2k81%2bA%2fKC6edkC7kdoRu4fPnp3WB3UmZFRwq0KY2W4Z5XbUK35qV7ZOBk5a11w%3d%3d
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.213.230.73:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.213.230.73:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
864
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
184.30.150.119:443
www.bing.com
Akamai International B.V.
CA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
23.213.230.73:80
crl.microsoft.com
Akamai International B.V.
CA
whitelisted
864
RUXIMICS.exe
23.213.230.73:80
crl.microsoft.com
Akamai International B.V.
CA
whitelisted
6944
svchost.exe
23.213.230.73:80
crl.microsoft.com
Akamai International B.V.
CA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
www.bing.com
  • 184.30.150.119
whitelisted
google.com
  • 142.251.39.110
whitelisted
crl.microsoft.com
  • 23.213.230.73
whitelisted
www.microsoft.com
  • 23.217.131.226
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
ntp.msn.com
  • 204.79.197.203
whitelisted
edge.microsoft.com
  • 13.107.21.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.67
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
Process
Message
Spotify.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SpotX-main.zip