File name:

1.zip

Full analysis: https://app.any.run/tasks/1445fc64-e31c-40cb-b8f0-590c5dbb438d
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Analysis date: March 25, 2025, 07:31:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-html
vidar
stealer
telegram
hijackloader
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

A3CFBA008B4D4100A4B93C0AB985AA2C

SHA1:

09B853475DFE1381856C8E8F3723284B2A1FE42A

SHA256:

A5EB6A84841F99E677D5A8A35E7BC84018FBA8F90D9A8C091692341F441A4C2F

SSDEEP:

98304:wF3wVbbaAzRtfh6HmycfW4m2lItZgfI050Kpa5mEvTXnN4GAyS7HBwZP/CAZOwQH:zCLXK4IyNIRS+y6uIN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7500)
    • HIJACKLOADER has been detected (YARA)

      • ABRequestDlg.exe (PID: 7468)
    • VIDAR mutex has been found

      • cmd.exe (PID: 5392)
    • VIDAR has been detected (YARA)

      • cmd.exe (PID: 5392)
    • Actions looks like stealing of personal data

      • cmd.exe (PID: 5392)
    • Steals credentials from Web Browsers

      • cmd.exe (PID: 5392)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7500)
      • ABRequestDlg.exe (PID: 5956)
    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7500)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • cmd.exe (PID: 5392)
    • Starts itself from another location

      • ABRequestDlg.exe (PID: 5956)
    • The process drops C-runtime libraries

      • ABRequestDlg.exe (PID: 5956)
    • Executable content was dropped or overwritten

      • ABRequestDlg.exe (PID: 5956)
    • Starts CMD.EXE for commands execution

      • ABRequestDlg.exe (PID: 7468)
    • There is functionality for taking screenshot (YARA)

      • cmd.exe (PID: 5392)
  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7500)
    • The sample compiled with english language support

      • WinRAR.exe (PID: 7500)
      • ABRequestDlg.exe (PID: 5956)
    • Checks supported languages

      • ABRequestDlg.exe (PID: 5956)
      • ABRequestDlg.exe (PID: 7468)
    • Creates files or folders in the user directory

      • ABRequestDlg.exe (PID: 5956)
    • Reads the computer name

      • ABRequestDlg.exe (PID: 5956)
      • ABRequestDlg.exe (PID: 7468)
    • Creates files in the program directory

      • cmd.exe (PID: 5392)
    • Checks proxy server information

      • cmd.exe (PID: 5392)
      • slui.exe (PID: 2644)
    • Create files in a temporary directory

      • ABRequestDlg.exe (PID: 7468)
    • Reads the software policy settings

      • slui.exe (PID: 2644)
      • slui.exe (PID: 7676)
    • Reads CPU info

      • cmd.exe (PID: 5392)
    • Application launched itself

      • chrome.exe (PID: 7888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Vidar

(PID) Process(5392) cmd.exe
C2https://t.me/g_etcontent
URLhttps://steamcommunity.com/profiles/76561199832267488
RC43333333333333333UUUUUUUUUUUUUUUU
Strings (1)
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:03:24 08:14:56
ZipCRC: 0x4ecca099
ZipCompressedSize: 47687
ZipUncompressedSize: 158768
ZipFileName: ABRequestDlg.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
178
Monitored processes
40
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe abrequestdlg.exe #HIJACKLOADER abrequestdlg.exe no specs #VIDAR cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1052\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3224 --field-trial-handle=1948,i,4248904590975745793,11498199950633837307,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1240"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4544 --field-trial-handle=1948,i,4248904590975745793,11498199950633837307,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1532C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exeABRequestDlg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1676"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3332 --field-trial-handle=1948,i,4248904590975745793,11498199950633837307,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2108"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5472 --field-trial-handle=1948,i,4248904590975745793,11498199950633837307,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2316"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5692 --field-trial-handle=1948,i,4248904590975745793,11498199950633837307,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2644C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2656"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5380 --field-trial-handle=1948,i,4248904590975745793,11498199950633837307,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3900"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5816 --field-trial-handle=1948,i,4248904590975745793,11498199950633837307,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
18 273
Read events
18 229
Write events
37
Delete events
7

Modification events

(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\1.zip
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7500) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Viewer
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3400000034000000F40300001D020000
(PID) Process:(5392) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
24
Suspicious files
136
Text files
31
Unknown types
0

Dropped files

PID
Process
Filename
Type
7500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7500.21179\libcrypto-1_1.dllexecutable
MD5:832205883448AB8C689D8A434D92F80B
SHA256:558ADDAE67D50612ACD60A02FB29D41BE61999D299348DF9A225E419CC9395ED
7500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7500.21179\cambistry.mkvbinary
MD5:55AA6AF417C2AAEE3042A41EFAA397FF
SHA256:B39FDE67A0FB165DE8D0D46602DFFC2D0A21F432E36519BBF8172ECD02A79CBC
5956ABRequestDlg.exeC:\Users\admin\AppData\Roaming\HostUninstall_dbg\libssl-1_1.dllexecutable
MD5:CDBF8CD36924FFB81B19487746F7F18E
SHA256:0813C77DF688B39F26BAD0BE2B3E4AFDE13E97D9A1EBCBDB3B1F4184218D1A57
5956ABRequestDlg.exeC:\Users\admin\AppData\Roaming\HostUninstall_dbg\ABRequestDlg.exeexecutable
MD5:CC41AEDB74D07C2D6391882F89205A35
SHA256:D418D652362D686E35938A404DBAD283E89A42E8CA9E8F6DD6E81CDCF52F5E8B
5956ABRequestDlg.exeC:\Users\admin\AppData\Roaming\HostUninstall_dbg\cambistry.mkvbinary
MD5:55AA6AF417C2AAEE3042A41EFAA397FF
SHA256:B39FDE67A0FB165DE8D0D46602DFFC2D0A21F432E36519BBF8172ECD02A79CBC
5956ABRequestDlg.exeC:\Users\admin\AppData\Roaming\HostUninstall_dbg\Amnet.dllexecutable
MD5:2C28879B223C0B94A4C79F4E103FCED5
SHA256:8401649BCFF7C98F954E08A35FE2E0E96FAA5FE985C79C87777D58BDA7AE30C5
7468ABRequestDlg.exeC:\Users\admin\AppData\Local\Temp\pxp
MD5:
SHA256:
5956ABRequestDlg.exeC:\Users\admin\AppData\Roaming\HostUninstall_dbg\msvcp80.dllexecutable
MD5:272A9E637ADCAF30B34EA184F4852836
SHA256:35B15B78C31111DB4FA11D9C9CAD3A6F22C92DAA5E6F069DC455E72073266CC4
7500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7500.21179\libssl-1_1.dllexecutable
MD5:CDBF8CD36924FFB81B19487746F7F18E
SHA256:0813C77DF688B39F26BAD0BE2B3E4AFDE13E97D9A1EBCBDB3B1F4184218D1A57
7500WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7500.21179\ABRequestDlg.exeexecutable
MD5:CC41AEDB74D07C2D6391882F89205A35
SHA256:D418D652362D686E35938A404DBAD283E89A42E8CA9E8F6DD6E81CDCF52F5E8B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
58
DNS requests
48
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
7796
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
unknown
5392
cmd.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
unknown
5720
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/l3dpysm7nqxd77b6alefz7rfgu_20250312.737806035.14/obedbbhbpmojnkanicioggnmelmoomoc_20250312.737806035.14_all_ENUS500000_bwoyl2xpcuusvabkocylfg7bee.crx3
unknown
unknown
5392
cmd.exe
GET
200
184.24.77.81:80
http://e5.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQeEcDJrP2kU%2B9LL2pzIRVgTVStuQQUmc0pw6FYJq96ekyEWo9ziGCw394CEgZh1pQRGYA1ofW59bBE13fPVg%3D%3D
unknown
unknown
2656
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
unknown
2656
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
unknown
5720
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/l3dpysm7nqxd77b6alefz7rfgu_20250312.737806035.14/obedbbhbpmojnkanicioggnmelmoomoc_20250312.737806035.14_all_ENUS500000_bwoyl2xpcuusvabkocylfg7bee.crx3
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
unknown
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
unknown
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
unknown
google.com
  • 142.250.185.174
unknown
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
unknown
client.wns.windows.com
  • 40.115.3.253
unknown
login.live.com
  • 20.190.160.2
  • 20.190.160.3
  • 20.190.160.5
  • 20.190.160.17
  • 20.190.160.22
  • 20.190.160.66
  • 40.126.32.140
  • 40.126.32.72
unknown
ocsp.digicert.com
  • 184.30.131.245
unknown
arc.msn.com
  • 20.199.58.43
unknown
slscr.update.microsoft.com
  • 20.12.23.50
unknown
www.microsoft.com
  • 23.35.229.160
unknown
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
unknown

Threats

PID
Process
Class
Message
5392
cmd.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
No debug info