File name:

sample.exe

Full analysis: https://app.any.run/tasks/6d21dd63-34c4-4731-af4b-842739ff4a16
Verdict: Malicious activity
Analysis date: April 25, 2023, 15:24:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
MD5:

F7B5181A6C1694BBDBC0D8E9A7C678E1

SHA1:

8BA5C7B1BF319C7600816702A29CFA1AB53331A4

SHA256:

A0130E899FA5B5C0A89A724959D2FD8DC8C50AD2A19A23BA24821F8F740293CB

SSDEEP:

1536:1BucKHs7K2HEG7BpoWiZBYHs977q+7INVdU2Aneb61TVcz+3MJb6rc63:PuchogM57bIL+eb61TVa+3MJb6N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • sample.exe (PID: 3548)

    • Runs injected code in another process

      • SystemSettings.exe (PID: 5040)

    • Application was injected by another process

      • msedge.exe (PID: 2616)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sample.exe (PID: 3548)

    • Starts itself from another location

      • sample.exe (PID: 3548)

    • Executing commands from a ".bat" file

      • sample.exe (PID: 3548)

    • Starts CMD.EXE for commands execution

      • sample.exe (PID: 3548)

    • Reads the date of Windows installation

      • sample.exe (PID: 3548)

    • Connects to unusual port

      • huter.exe (PID: 4224)

    • Reads settings of System Certificates

      • SystemSettings.exe (PID: 5040)

  • INFO

    • Checks supported languages

      • sample.exe (PID: 3548)
      • huter.exe (PID: 4224)
      • SystemSettings.exe (PID: 5040)

    • Reads the computer name

      • sample.exe (PID: 3548)
      • huter.exe (PID: 4224)
      • SystemSettings.exe (PID: 5040)

    • The process checks LSA protection

      • sample.exe (PID: 3548)
      • slui.exe (PID: 5912)
      • huter.exe (PID: 4224)
      • SystemSettings.exe (PID: 5040)

    • Process checks computer location settings

      • sample.exe (PID: 3548)
      • SystemSettings.exe (PID: 5040)

    • Checks proxy server information

      • slui.exe (PID: 5912)

    • Reads the software policy settings

      • slui.exe (PID: 5912)

    • Create files in a temporary directory

      • sample.exe (PID: 3548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

ProductVersion: 1.0.0.1
ProductName: TODO: <제품 이름>
OriginalFileName: AppleDown.exe
LegalCopyright: Copyright (C) 2014
InternalName: AppleDown.exe
FileVersion: 1.0.0.1
FileDescription: TODO: <파일 설명>
CompanyName: TODO: <회사 이름>
CharacterSet: Unicode
LanguageCode: Korean
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.1
FileVersionNumber: 1.0.0.1
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x524f
UninitializedDataSize: -
InitializedDataSize: 75264
CodeSize: 63488
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, 32-bit, No debug
TimeStamp: 2014:09:07 11:17:05+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 07-Sep-2014 11:17:05
Detected languages:
  • English - United States
  • Korean - Korea
CompanyName: TODO: <회사 이름>
FileDescription: TODO: <파일 설명>
FileVersion: 1.0.0.1
InternalName: AppleDown.exe
LegalCopyright: Copyright (C) 2014
OriginalFilename: AppleDown.exe
ProductName: TODO: <제품 이름>
ProductVersion: 1.0.0.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0040
Pages in file: 0x0001
Relocations: 0x0000
Size of header: 0x0002
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0xB400
OEM information: 0xCD09
Address of NE header: 0x00000040

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 07-Sep-2014 11:17:05
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.MPRESS1
0x00001000
0x00027000
0x00024400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.0951
.MPRESS2
0x00028000
0x00001000
0x00000E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.74866
.rsrc
0x00029000
0x0000D000
0x0000C200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.31908
.imports
0x00036000
0x00001000
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.42061

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.79597
346
Latin 1 / Western European
English - United States
RT_MANIFEST
2
2.54353
296
Latin 1 / Western European
English - United States
RT_ICON
3
4.35478
3752
Latin 1 / Western European
English - United States
RT_ICON
4
5.17501
2216
Latin 1 / Western European
English - United States
RT_ICON
5
3.47748
1384
Latin 1 / Western European
English - United States
RT_ICON
6
2.83156
9640
Latin 1 / Western European
English - United States
RT_ICON
7
2.20419
78
Latin 1 / Western European
English - United States
RT_STRING
8
4.05874
1128
Latin 1 / Western European
English - United States
RT_ICON
9
2.89005
744
Latin 1 / Western European
English - United States
RT_ICON
10
2.54353
296
Latin 1 / Western European
English - United States
RT_ICON

Imports

ADVAPI32.dll
IPHLPAPI.DLL
KERNEL32.dll
SHELL32.dll
USER32.dll
WS2_32.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject sample.exe huter.exe cmd.exe no specs conhost.exe no specs slui.exe systemsettings.exe no specs filecoauth.exe no specs msedge.exe

Process information

PID
CMD
Path
Indicators
Parent process
2616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9ea392d0h3eb7h4127h80dbhea632c960470C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
sihost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
111.0.1661.62
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\111.0.1661.62\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2736C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3548"C:\Users\admin\AppData\Local\Temp\sample.exe" C:\Users\admin\AppData\Local\Temp\sample.exe
explorer.exe
User:
admin
Company:
TODO: <회사 이름>
Integrity Level:
MEDIUM
Description:
TODO: <파일 설명>
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\sample.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4224"C:\Users\admin\AppData\Local\Temp\huter.exe" C:\Users\admin\AppData\Local\Temp\huter.exe
sample.exe
User:
admin
Company:
TODO: <회사 이름>
Integrity Level:
MEDIUM
Description:
TODO: <파일 설명>
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\huter.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4512\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\conhost.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5040"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanelC:\Windows\ImmersiveControlPanel\SystemSettings.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Settings
Exit code:
0
Version:
10.0.19041.1266 (WinBuild.160101.0800)
Modules
Images
c:\windows\immersivecontrolpanel\systemsettings.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
5912C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
6216C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\sanfdr.bat" "C:\Windows\SysWOW64\cmd.exe—sample.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.746 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
6 284
Read events
6 216
Write events
68
Delete events
0

Modification events

(PID) Process:(3548) sample.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3548) sample.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3548) sample.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3548) sample.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(5040) SystemSettings.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\88000105
Operation:writeName:HasValidContent
Value:
0
(PID) Process:(5040) SystemSettings.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\88000105
Operation:writeName:SubscriptionContext
Value:
sc-allCompleted=0
(PID) Process:(5040) SystemSettings.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ValueBanner\Scoobe
Operation:writeName:ImpressionCount
Value:
19
(PID) Process:(5040) SystemSettings.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(5040) SystemSettings.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5040) SystemSettings.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
2
Suspicious files
14
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3548sample.exeC:\Users\admin\AppData\Local\Temp\golfinfo.initext
MD5:02167B944A214FEE3D34F9A7E356DC6A
SHA256:77FCDADC9BA56DAA81EDB3F0EF876E38A8C7DE56187C28C7D02992CD9E0A243D
3548sample.exeC:\Users\admin\AppData\Local\Temp\huter.exeexecutable
MD5:99441FE7E203845EA50D4137097E131F
SHA256:F65C0B9826288EB914E5682E918842B690C69255A6679F843E504618B46526D6
5040SystemSettings.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-msbinary
MD5:4FCB2A3EE025E4A10D21E1B154873FE2
SHA256:90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228
2616msedge.exeC:\USERS\ADMIN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\VARIATIONSbinary
MD5:11B5180FA66C3FA16144BA6D52303FE2
SHA256:B077B9DB281ED58008156216E7706EEBDF11CD570A943995CBFFA4F88CE80A51
2736FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-04-25.1527.2736.1.aodlbinary
MD5:923BF0E545D9C37CA8874C8D6C4A30E6
SHA256:AB32C675D35DDBEBFCF8B11720C3E550024E8D0DF557838F17186377E3D0FE65
2616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\dbb222c9-8a0c-4dcc-9096-a239a0496492.tmptext
MD5:E3D335C337E905A4BD598BECF2C61E67
SHA256:8E51425B2A87E1B88AE7190E825D07E53C00DA580C3A56007E15ECD82A48E9FF
5040SystemSettings.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O7CH42I2XYBLTO26U2L7.tempbinary
MD5:4FCB2A3EE025E4A10D21E1B154873FE2
SHA256:90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228
2616msedge.exeC:\USERS\ADMIN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\CRASHPAD\SETTINGS.DATbinary
MD5:D20113C51947F70866A211CD0235260E
SHA256:18C9564529F9AFB18CC43CAA92BE73967644F5B98C4F05F02C50A64270B6D824
5040SystemSettings.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-ms~RF458443.TMPbinary
MD5:4FCB2A3EE025E4A10D21E1B154873FE2
SHA256:90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228
3548sample.exeC:\Users\admin\AppData\Local\Temp\sanfdr.battext
MD5:62902AB57C8EBCBB9CEC7CD7AD8CB42E
SHA256:5F5BF8703C64EDADF8A0145CCB4E3A05A2A347EE3BF82EF89063ACF74C8E3C51
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
64
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
svchost.exe
GET
—
2.18.233.62:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4944
SIHClient.exe
GET
200
2.18.233.62:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
der
418 b
whitelisted
5952
MoUsoCoreWorker.exe
GET
200
2.21.20.133:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
der
1.11 Kb
whitelisted
4944
SIHClient.exe
GET
200
2.18.233.62:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
der
409 b
whitelisted
5756
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1944
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
der
814 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5952
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5952
MoUsoCoreWorker.exe
2.21.20.137:80
crl.microsoft.com
Akamai International B.V.
DE
suspicious
—
—
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5756
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
13.77.207.86:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
6948
slui.exe
13.77.207.86:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
5756
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5952
MoUsoCoreWorker.exe
2.18.233.62:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5952
MoUsoCoreWorker.exe
2.21.20.133:80
crl.microsoft.com
Akamai International B.V.
DE
suspicious
4224
huter.exe
112.175.88.208:11150
—
Korea Telecom
KR
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.21.20.137
  • 2.21.20.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
officeclient.microsoft.com
  • 52.109.52.148
whitelisted
www.microsoft.com
  • 2.18.233.62
  • 88.221.169.152
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
  • 20.242.39.171
whitelisted
crl4.digicert.com
  • 192.229.221.95
whitelisted
nexusrules.officeapps.live.com
  • 20.224.254.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sample.exe