analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Soar.Launcher.V1.zip

Full analysis: https://app.any.run/tasks/8467086d-3690-4214-8619-143d5d4761ec
Verdict: Malicious activity
Analysis date: May 21, 2022, 00:22:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

60280521BBFD36C93A325BD978D87735

SHA1:

3FF95EFF4D43D94B9FB6789AA28AEAB819E0DBF2

SHA256:

A29B78612233387EA983280821FDBC76F8D72F4DE76E9CDAD3B70F66B3587E12

SSDEEP:

24576:U0bMgNTm9OF/mS6uJY9FvlUsj8uhz23zO18xw5TZU7nkn0j:U0lREuJuFvlUsoO6zOOw5y7nk0j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 888)
      • SoarLauncher.exe (PID: 3428)
      • ndp48-web.exe (PID: 3828)
      • ndp48-web.exe (PID: 1144)
      • Setup.exe (PID: 1516)
      • SetupUtility.exe (PID: 3744)
      • SetupUtility.exe (PID: 2108)
      • ServiceModelReg.exe (PID: 3384)
      • regtlibv12.exe (PID: 432)
      • regtlibv12.exe (PID: 3680)
      • regtlibv12.exe (PID: 3104)
      • regtlibv12.exe (PID: 632)
      • regtlibv12.exe (PID: 3112)
      • regtlibv12.exe (PID: 2584)
      • regtlibv12.exe (PID: 2672)
      • aspnet_regiis.exe (PID: 2504)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3448)
      • Setup.exe (PID: 1516)
      • SoarLauncher.exe (PID: 888)
      • SoarLauncher.exe (PID: 3428)
      • SoarLauncher.exe (PID: 684)
      • svchost.exe (PID: 2000)
      • aspnet_regiis.exe (PID: 2504)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2764)
      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 1884)
      • ndp48-web.exe (PID: 3828)
      • msiexec.exe (PID: 2324)

    • Actions looks like stealing of personal data

      • ndp48-web.exe (PID: 3828)

    • Changes settings of System certificates

      • Setup.exe (PID: 1516)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2764)
      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 888)
      • SoarLauncher.exe (PID: 3428)
      • ndp48-web.exe (PID: 3828)
      • Setup.exe (PID: 1516)
      • SetupUtility.exe (PID: 3744)
      • SetupUtility.exe (PID: 2108)
      • TMP4B16.tmp.exe (PID: 3620)
      • msiexec.exe (PID: 2324)
      • MsiExec.exe (PID: 1148)
      • MsiExec.exe (PID: 1964)
      • ServiceModelReg.exe (PID: 3384)
      • regtlibv12.exe (PID: 432)
      • regtlibv12.exe (PID: 632)
      • regtlibv12.exe (PID: 2672)
      • regtlibv12.exe (PID: 3112)
      • regtlibv12.exe (PID: 3680)
      • regtlibv12.exe (PID: 2584)
      • mofcomp.exe (PID: 2876)
      • regtlibv12.exe (PID: 3104)
      • mofcomp.exe (PID: 2816)
      • aspnet_regiis.exe (PID: 2504)
      • mofcomp.exe (PID: 3636)

    • Reads the computer name

      • WinRAR.exe (PID: 2764)
      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 3428)
      • ndp48-web.exe (PID: 3828)
      • Setup.exe (PID: 1516)
      • TMP4B16.tmp.exe (PID: 3620)
      • SetupUtility.exe (PID: 3744)
      • SetupUtility.exe (PID: 2108)
      • msiexec.exe (PID: 2324)
      • MsiExec.exe (PID: 1148)
      • MsiExec.exe (PID: 1964)
      • ServiceModelReg.exe (PID: 3384)
      • mofcomp.exe (PID: 2816)
      • mofcomp.exe (PID: 2876)
      • mofcomp.exe (PID: 3636)
      • aspnet_regiis.exe (PID: 2504)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2764)
      • iexplore.exe (PID: 1884)
      • iexplore.exe (PID: 2288)
      • ndp48-web.exe (PID: 3828)
      • TMP4B16.tmp.exe (PID: 3620)
      • Setup.exe (PID: 1516)
      • msiexec.exe (PID: 2324)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2764)
      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 1884)
      • ndp48-web.exe (PID: 3828)
      • msiexec.exe (PID: 2324)

    • Starts Internet Explorer

      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 3428)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 2288)

    • Reads CPU info

      • Setup.exe (PID: 1516)

    • Reads Environment values

      • Setup.exe (PID: 1516)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 2324)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 2324)

    • Checks for the .NET to be installed

      • msiexec.exe (PID: 2324)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 2324)
      • aspnet_regiis.exe (PID: 2504)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 2324)

    • Creates files in the Windows directory

      • lodctr.exe (PID: 2264)
      • msiexec.exe (PID: 2324)
      • aspnet_regiis.exe (PID: 2504)

    • Removes files from Windows directory

      • lodctr.exe (PID: 2264)
      • msiexec.exe (PID: 2324)
      • aspnet_regiis.exe (PID: 2504)

  • INFO

    • Manual execution by user

      • SoarLauncher.exe (PID: 684)
      • SoarLauncher.exe (PID: 888)
      • SoarLauncher.exe (PID: 3428)

    • Application launched itself

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1884)
      • msiexec.exe (PID: 2324)

    • Reads the computer name

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 1884)
      • wevtutil.exe (PID: 3724)
      • lodctr.exe (PID: 2264)
      • wevtutil.exe (PID: 3676)

    • Changes internet zones settings

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1884)

    • Checks supported languages

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 1884)
      • iexplore.exe (PID: 2288)
      • wevtutil.exe (PID: 3724)
      • lodctr.exe (PID: 2264)
      • wevtutil.exe (PID: 3676)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 1884)
      • Setup.exe (PID: 1516)
      • msiexec.exe (PID: 2324)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1116)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 1884)
      • Setup.exe (PID: 1516)
      • msiexec.exe (PID: 2324)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 1116)
      • iexplore.exe (PID: 1884)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 2288)

    • Creates files in the user directory

      • iexplore.exe (PID: 1380)
      • iexplore.exe (PID: 2288)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 1116)
      • svchost.exe (PID: 2000)
      • SetupUtility.exe (PID: 3744)
      • Setup.exe (PID: 1516)
      • msiexec.exe (PID: 2324)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1116)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1884)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1148)
      • MsiExec.exe (PID: 1964)
      • msiexec.exe (PID: 2324)

    • Creates or modifies windows services

      • msiexec.exe (PID: 2324)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2324)

    • Searches for installed software

      • msiexec.exe (PID: 2324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: CmlLib.Core.Auth.Microsoft.dll
ZipUncompressedSize: 11776
ZipCompressedSize: 5080
ZipCRC: 0xc8311ec5
ZipModifyDate: 2022:05:15 12:15:05
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
34
Malicious processes
14
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs soarlauncher.exe no specs iexplore.exe iexplore.exe soarlauncher.exe no specs soarlauncher.exe no specs iexplore.exe iexplore.exe ndp48-web.exe no specs ndp48-web.exe setup.exe setuputility.exe no specs setuputility.exe no specs tmp4b16.tmp.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs servicemodelreg.exe no specs wevtutil.exe no specs wevtutil.exe no specs svchost.exe no specs lodctr.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs mofcomp.exe no specs mofcomp.exe no specs aspnet_regiis.exe no specs mofcomp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2764"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Soar.Launcher.V1.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3448"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
684"C:\Users\admin\Desktop\SoarLauncher.exe" C:\Users\admin\Desktop\SoarLauncher.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
SoarLauncher
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\soarlauncher.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1116"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.6.2&processName=SoarLauncher.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Internet Explorer\iexplore.exe
SoarLauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1380"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1116 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
888"C:\Users\admin\Desktop\SoarLauncher.exe" C:\Users\admin\Desktop\SoarLauncher.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
SoarLauncher
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\soarlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3428"C:\Users\admin\Desktop\SoarLauncher.exe" C:\Users\admin\Desktop\SoarLauncher.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
SoarLauncher
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\soarlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1884"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.6.2&processName=SoarLauncher.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Internet Explorer\iexplore.exe
SoarLauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2288"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1884 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
1144"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ndp48-web.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ndp48-web.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.8 Setup
Exit code:
3221226540
Version:
4.8.04115.00
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\ndp48-web.exe
Total events
92 554
Read events
78 785
Write events
0
Delete events
0

Modification events

No data
Executable files
2 298
Suspicious files
78
Text files
449
Unknown types
27

Dropped files

PID
Process
Filename
Type
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\CmlLib.Core.Auth.Microsoft.pdbbinary
MD5:9594C9B01A378565F207F9BEA743A8F2
SHA256:3D0E939BCDF429FAA5B757B66FC3D5D8A37434FCB9768A69D01C0B7C7E9B712B
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\SevenZip.dllexecutable
MD5:3C933A17D4C6A8D46819FABB2930C5AA
SHA256:2E6726224DC56B42F457DE1BEEBFCC9061433A86E127EC608A247F2710608E26
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\CmlLib.Core.Auth.Microsoft.dllexecutable
MD5:BD0FC2EE9052E5FF48A3D379AFE2A1A9
SHA256:CD83FC97EA150926C44F4CC8763CF32A14377ADD0F1E95EA6456A1DC3A658FBD
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\Microsoft.Web.WebView2.WinForms.dllexecutable
MD5:BB0C41C9FD5327D00FF3A896180E7554
SHA256:1858D4DBF4AF0BE62117A9387EA91C37342B1896509F8F9704758710FCB391E9
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\SevenZip.xmlxml
MD5:140DD7C9541B2EFCA5506B069FA31481
SHA256:85B35574B9960FDAA5F2E36F09C0962876DF13BC697F385ED6BC6D942E912CCE
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\CmlLib.Core.Auth.Microsoft.UI.WinForm.dllexecutable
MD5:B92762D7FFB0A06C83CCD71009E81F25
SHA256:537C2ADCEC0B3B782E7B830EC47345678879BC0744FFAD14F06240D32F5502E4
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\ICSharpCode.SharpZipLib.xmlxml
MD5:5C154669300FED0DE91C91B4CC1D8D0A
SHA256:ED45BCBC288668CF5C992A609E81B416832B5CDC972080137C6DD95E4FF368E0
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\ICSharpCode.SharpZipLib.dllexecutable
MD5:D59EF46A5F01DDFE7EB691E6C725A247
SHA256:C287E9B07A8251828F35914364C89A37DB606B0C1D64457F9EB8FA2258F0DEE3
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\Newtonsoft.Json.dllexecutable
MD5:081D9558BBB7ADCE142DA153B2D5577A
SHA256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
2764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2764.21653\CmlLib.Core.Auth.Microsoft.dll.configxml
MD5:B6C8B39062178DEA6A21B466F36B340D
SHA256:5D818AFC8AE194380B60787BBD244F8F939489CD26BF26B4713D249BBC03E4DF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
53
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
880
svchost.exe
HEAD
302
104.90.179.99:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=x86&o1=netfx_Full.mzz
NL
—
—
whitelisted
880
svchost.exe
GET
302
104.90.179.99:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=x86&o1=netfx_Full.mzz
NL
—
—
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
1380
iexplore.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQN1VoiX40jVOMldh7uDThi9DqeewQU1cFnOsKjnfR3UltZEjgp5lVou6UCEzMAHEqTV2OkE3jHH8YAAAAcSpM%3D
US
der
1.74 Kb
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
1380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1380
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1380
iexplore.exe
204.79.197.203:80
oneocsp.microsoft.com
Microsoft Corporation
US
whitelisted
1380
iexplore.exe
104.90.179.99:443
go.microsoft.com
Akamai Technologies, Inc.
NL
malicious
1380
iexplore.exe
152.199.19.161:443
az416426.vo.msecnd.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1380
iexplore.exe
92.123.195.75:443
statics-marketingsites-wcus-ms-com.akamaized.net
Akamai International B.V.
—
unknown
1380
iexplore.exe
13.107.246.45:443
dotnet.microsoft.com
Microsoft Corporation
US
suspicious
1380
iexplore.exe
184.30.21.171:443
www.microsoft.com
GTT Communications Inc.
US
suspicious
1380
iexplore.exe
95.140.236.0:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
GB
whitelisted
1380
iexplore.exe
92.123.195.73:443
img-prod-cms-rt-microsoft-com.akamaized.net
Akamai International B.V.
—
whitelisted
1116
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 104.90.179.99
whitelisted
ctldl.windowsupdate.com
  • 95.140.236.0
  • 178.79.242.128
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
dotnet.microsoft.com
  • 13.107.246.45
  • 13.107.213.45
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.18.233.62
whitelisted
statics-marketingsites-wcus-ms-com.akamaized.net
  • 92.123.195.75
  • 92.123.195.99
whitelisted
az416426.vo.msecnd.net
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Soar.Launcher.V1.zip