File name:

Soar.Launcher.V1.zip

Full analysis: https://app.any.run/tasks/8467086d-3690-4214-8619-143d5d4761ec
Verdict: Malicious activity
Analysis date: May 21, 2022, 00:22:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

60280521BBFD36C93A325BD978D87735

SHA1:

3FF95EFF4D43D94B9FB6789AA28AEAB819E0DBF2

SHA256:

A29B78612233387EA983280821FDBC76F8D72F4DE76E9CDAD3B70F66B3587E12

SSDEEP:

24576:U0bMgNTm9OF/mS6uJY9FvlUsj8uhz23zO18xw5TZU7nkn0j:U0lREuJuFvlUsoO6zOOw5y7nk0j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 888)
      • SoarLauncher.exe (PID: 3428)
      • ndp48-web.exe (PID: 1144)
      • ndp48-web.exe (PID: 3828)
      • Setup.exe (PID: 1516)
      • SetupUtility.exe (PID: 3744)
      • SetupUtility.exe (PID: 2108)
      • ServiceModelReg.exe (PID: 3384)
      • regtlibv12.exe (PID: 432)
      • regtlibv12.exe (PID: 2672)
      • regtlibv12.exe (PID: 2584)
      • regtlibv12.exe (PID: 3104)
      • regtlibv12.exe (PID: 632)
      • regtlibv12.exe (PID: 3112)
      • aspnet_regiis.exe (PID: 2504)
      • regtlibv12.exe (PID: 3680)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3448)
      • Setup.exe (PID: 1516)
      • SoarLauncher.exe (PID: 888)
      • SoarLauncher.exe (PID: 3428)
      • SoarLauncher.exe (PID: 684)
      • svchost.exe (PID: 2000)
      • aspnet_regiis.exe (PID: 2504)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2764)
      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 1884)
      • ndp48-web.exe (PID: 3828)
      • msiexec.exe (PID: 2324)

    • Actions looks like stealing of personal data

      • ndp48-web.exe (PID: 3828)

    • Changes settings of System certificates

      • Setup.exe (PID: 1516)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2764)
      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 3428)
      • SoarLauncher.exe (PID: 888)
      • ndp48-web.exe (PID: 3828)
      • Setup.exe (PID: 1516)
      • SetupUtility.exe (PID: 3744)
      • SetupUtility.exe (PID: 2108)
      • TMP4B16.tmp.exe (PID: 3620)
      • msiexec.exe (PID: 2324)
      • MsiExec.exe (PID: 1148)
      • MsiExec.exe (PID: 1964)
      • ServiceModelReg.exe (PID: 3384)
      • regtlibv12.exe (PID: 432)
      • regtlibv12.exe (PID: 2584)
      • mofcomp.exe (PID: 2876)
      • regtlibv12.exe (PID: 3104)
      • regtlibv12.exe (PID: 632)
      • regtlibv12.exe (PID: 3112)
      • mofcomp.exe (PID: 2816)
      • regtlibv12.exe (PID: 2672)
      • regtlibv12.exe (PID: 3680)
      • mofcomp.exe (PID: 3636)
      • aspnet_regiis.exe (PID: 2504)

    • Reads the computer name

      • WinRAR.exe (PID: 2764)
      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 3428)
      • ndp48-web.exe (PID: 3828)
      • Setup.exe (PID: 1516)
      • SetupUtility.exe (PID: 3744)
      • SetupUtility.exe (PID: 2108)
      • TMP4B16.tmp.exe (PID: 3620)
      • msiexec.exe (PID: 2324)
      • MsiExec.exe (PID: 1148)
      • MsiExec.exe (PID: 1964)
      • ServiceModelReg.exe (PID: 3384)
      • mofcomp.exe (PID: 2876)
      • mofcomp.exe (PID: 2816)
      • aspnet_regiis.exe (PID: 2504)
      • mofcomp.exe (PID: 3636)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2764)
      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 1884)
      • ndp48-web.exe (PID: 3828)
      • TMP4B16.tmp.exe (PID: 3620)
      • Setup.exe (PID: 1516)
      • msiexec.exe (PID: 2324)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2764)
      • iexplore.exe (PID: 1884)
      • iexplore.exe (PID: 2288)
      • ndp48-web.exe (PID: 3828)
      • msiexec.exe (PID: 2324)

    • Starts Internet Explorer

      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 3428)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 2288)

    • Reads CPU info

      • Setup.exe (PID: 1516)

    • Reads Environment values

      • Setup.exe (PID: 1516)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 2324)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 2324)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 2324)
      • aspnet_regiis.exe (PID: 2504)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 2324)

    • Checks for the .NET to be installed

      • msiexec.exe (PID: 2324)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 2324)
      • lodctr.exe (PID: 2264)
      • aspnet_regiis.exe (PID: 2504)

    • Removes files from Windows directory

      • msiexec.exe (PID: 2324)
      • lodctr.exe (PID: 2264)
      • aspnet_regiis.exe (PID: 2504)

  • INFO

    • Manual execution by user

      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 888)
      • SoarLauncher.exe (PID: 3428)

    • Checks supported languages

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 1884)
      • iexplore.exe (PID: 2288)
      • wevtutil.exe (PID: 3724)
      • wevtutil.exe (PID: 3676)
      • lodctr.exe (PID: 2264)

    • Reads the computer name

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 1884)
      • iexplore.exe (PID: 2288)
      • wevtutil.exe (PID: 3676)
      • wevtutil.exe (PID: 3724)
      • lodctr.exe (PID: 2264)

    • Application launched itself

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1884)
      • msiexec.exe (PID: 2324)

    • Changes internet zones settings

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1884)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 1884)
      • Setup.exe (PID: 1516)
      • msiexec.exe (PID: 2324)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 1884)
      • Setup.exe (PID: 1516)
      • msiexec.exe (PID: 2324)

    • Creates files in the user directory

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 2288)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 2288)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 1116)
      • SetupUtility.exe (PID: 3744)
      • svchost.exe (PID: 2000)
      • Setup.exe (PID: 1516)
      • msiexec.exe (PID: 2324)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1116)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1884)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1116)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1884)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1148)
      • MsiExec.exe (PID: 1964)
      • msiexec.exe (PID: 2324)

    • Creates or modifies windows services

      • msiexec.exe (PID: 2324)

    • Searches for installed software

      • msiexec.exe (PID: 2324)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: CmlLib.Core.Auth.Microsoft.dll
ZipUncompressedSize: 11776
ZipCompressedSize: 5080
ZipCRC: 0xc8311ec5
ZipModifyDate: 2022:05:15 12:15:05
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
34
Malicious processes
14
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs soarlauncher.exe no specs iexplore.exe iexplore.exe soarlauncher.exe no specs soarlauncher.exe no specs iexplore.exe iexplore.exe ndp48-web.exe no specs ndp48-web.exe setup.exe setuputility.exe no specs setuputility.exe no specs tmp4b16.tmp.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs servicemodelreg.exe no specs wevtutil.exe no specs wevtutil.exe no specs svchost.exe no specs lodctr.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs mofcomp.exe no specs mofcomp.exe no specs aspnet_regiis.exe no specs mofcomp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.tlb"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
RegTLib
Exit code:
0
Version:
14.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regtlibv12.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
632"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.tlb"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
RegTLib
Exit code:
0
Version:
14.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regtlibv12.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
684"C:\Users\admin\Desktop\SoarLauncher.exe" C:\Users\admin\Desktop\SoarLauncher.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
SoarLauncher
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\soarlauncher.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
888"C:\Users\admin\Desktop\SoarLauncher.exe" C:\Users\admin\Desktop\SoarLauncher.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
SoarLauncher
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\soarlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1116"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.6.2&processName=SoarLauncher.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Internet Explorer\iexplore.exe
SoarLauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1144"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ndp48-web.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ndp48-web.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.8 Setup
Exit code:
3221226540
Version:
4.8.04115.00
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\ndp48-web.exe
1148C:\Windows\system32\MsiExec.exe -Embedding 00D7B68127810371ADA8D989A387DD47C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1380"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1116 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
1516C:\45ce8c0674495f90b9869896803a\\Setup.exe /x86 /x64 /webC:\45ce8c0674495f90b9869896803a\Setup.exe
ndp48-web.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
0
Version:
14.8.4110.0 built by: NET48REL1LAST_B
Modules
Images
c:\45ce8c0674495f90b9869896803a\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\45ce8c0674495f90b9869896803a\setupengine.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1884"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.6.2&processName=SoarLauncher.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Internet Explorer\iexplore.exe
SoarLauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
92 554
Read events
78 785
Write events
12 121
Delete events
1 648

Modification events

(PID) Process:(2764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2764) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Soar.Launcher.V1.zip
(PID) Process:(2764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2764) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2 298
Suspicious files
78
Text files
449
Unknown types
27

Dropped files

PID
Process
Filename
Type
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\CmlLib.Core.Auth.Microsoft.pdbbinary
MD5:—
SHA256:—
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\CmlLib.Core.Auth.Microsoft.dllexecutable
MD5:—
SHA256:—
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\CmlLib.Core.Auth.Microsoft.UI.WinForm.dllexecutable
MD5:—
SHA256:—
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\CmlLib.Core.Auth.Microsoft.UI.WinForm.pdbbinary
MD5:—
SHA256:—
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\SoarLauncher.exeexecutable
MD5:—
SHA256:—
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\SoarLauncher.exe.configxml
MD5:—
SHA256:—
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\ICSharpCode.SharpZipLib.xmlxml
MD5:5C154669300FED0DE91C91B4CC1D8D0A
SHA256:ED45BCBC288668CF5C992A609E81B416832B5CDC972080137C6DD95E4FF368E0
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\runtimes\win-x64\native\WebView2Loader.dllexecutable
MD5:87ABCE99CF0336FA7D874D55FC7D1578
SHA256:6D0804B37A498A3ECDD317896F6C9E9C759566574E86A8E045FEAD5E9CB20106
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\runtimes\win-arm64\native\WebView2Loader.dllexecutable
MD5:C1C1CDC80DB0DEA9D2E2C8347553B7AB
SHA256:7ACE4A6C7BB2585131C14951C6E6FE270D8067FD481DE718FFA968645BE948E3
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\ICSharpCode.SharpZipLib.pdbbinary
MD5:779D8237C1BB0A2896B2B8415AB6E556
SHA256:CEF7890C128FD3D563E0ADEA3BBA414A66542C4563B745896BA4242F279DC6B9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
53
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
880
svchost.exe
GET
302
104.90.179.99:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=amd64&o1=netfx_Full_x86.msi
NL
—
—
whitelisted
880
svchost.exe
HEAD
302
104.90.179.99:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=x86&o1=netfx_Full.mzz
NL
—
—
whitelisted
880
svchost.exe
HEAD
302
104.90.179.99:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=amd64&o1=netfx_Full_x86.msi
NL
—
—
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
1380
iexplore.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQN1VoiX40jVOMldh7uDThi9DqeewQU1cFnOsKjnfR3UltZEjgp5lVou6UCEzMAHEqTV2OkE3jHH8YAAAAcSpM%3D
US
der
1.74 Kb
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
der
1.47 Kb
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1380
iexplore.exe
104.90.179.99:443
go.microsoft.com
Akamai Technologies, Inc.
NL
malicious
1380
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1380
iexplore.exe
13.107.246.45:443
dotnet.microsoft.com
Microsoft Corporation
US
malicious
1380
iexplore.exe
204.79.197.203:80
oneocsp.microsoft.com
Microsoft Corporation
US
malicious
1380
iexplore.exe
184.30.21.171:443
www.microsoft.com
GTT Communications Inc.
US
suspicious
1380
iexplore.exe
92.123.195.75:443
statics-marketingsites-wcus-ms-com.akamaized.net
Akamai International B.V.
—
unknown
1380
iexplore.exe
152.199.19.161:443
az416426.vo.msecnd.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1380
iexplore.exe
92.123.195.73:443
img-prod-cms-rt-microsoft-com.akamaized.net
Akamai International B.V.
—
whitelisted
1116
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1380
iexplore.exe
20.189.173.2:443
browser.events.data.microsoft.com
Microsoft Corporation
US
suspicious

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 104.90.179.99
whitelisted
ctldl.windowsupdate.com
  • 95.140.236.0
  • 178.79.242.128
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
dotnet.microsoft.com
  • 13.107.246.45
  • 13.107.213.45
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.18.233.62
whitelisted
statics-marketingsites-wcus-ms-com.akamaized.net
  • 92.123.195.75
  • 92.123.195.99
whitelisted
az416426.vo.msecnd.net
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Soar.Launcher.V1.zip