File name:

EndpointBasecamp.exe

Full analysis: https://app.any.run/tasks/69f72b21-4f38-4a2a-a1fa-0c37801b9618
Verdict: Malicious activity
Analysis date: December 31, 2024, 09:55:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

76F41CBA65CF625DF1BCCE3F8AB5ED96

SHA1:

BBD65C9DC67D164EAEEE1AB7C80B58323710F434

SHA256:

A949D4AC7F1B4EEF9FC5F2E45CBBEC29D253BD2B189B1A9E41C4B13781D8C2D7

SSDEEP:

98304:1WRgsH2EMRFSpbBEYNEUEBYGgpvq9YsV4tdhQwaZ9n83TxmQNyw+Eiqb58:k8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process verifies whether the antivirus software is installed

      • conhost.exe (PID: 6860)
      • EndpointBasecamp.exe (PID: 6404)
      • EndpointBasecamp.exe (PID: 6288)
      • EndpointBasecamp.exe (PID: 6928)
      • VOMSvcWebInstaller.exe (PID: 6852)
      • conhost.exe (PID: 7160)
      • TelemetryAgentServiceWebInstaller.exe (PID: 7148)
      • EndpointBasecamp.exe (PID: 5588)
      • EndpointBasecamp.exe (PID: 5036)
      • VOneModuleInstaller.exe (PID: 3172)
      • EndpointBasecamp.exe (PID: 7048)
      • conhost.exe (PID: 7008)
      • EndpointBasecampDebugger.exe (PID: 2612)
      • WSCommunicator.exe (PID: 6980)
      • EndpointBasecamp.exe (PID: 6936)
      • conhost.exe (PID: 4400)
      • WSCommunicator.exe (PID: 6948)

    • Checks Windows Trust Settings

      • EndpointBasecamp.exe (PID: 6404)
      • EndpointBasecamp.exe (PID: 6928)
      • EndpointBasecamp.exe (PID: 7048)
      • VOMSvcWebInstaller.exe (PID: 6852)
      • TelemetryAgentServiceWebInstaller.exe (PID: 7148)
      • VOneModuleInstaller.exe (PID: 3172)
      • EndpointBasecamp.exe (PID: 5588)
      • EndpointBasecamp.exe (PID: 5036)
      • WSCommunicator.exe (PID: 6948)
      • EndpointBasecamp.exe (PID: 6936)
      • WSCommunicator.exe (PID: 6980)
      • EndpointBasecampDebugger.exe (PID: 2612)

    • Executable content was dropped or overwritten

      • EndpointBasecamp.exe (PID: 6404)
      • EndpointBasecamp.exe (PID: 6288)
      • VOMSvcWebInstaller.exe (PID: 6852)
      • TelemetryAgentServiceWebInstaller.exe (PID: 7148)
      • VOneModuleInstaller.exe (PID: 3172)
      • WSCommunicator.exe (PID: 6948)

    • Executes as Windows Service

      • EndpointBasecamp.exe (PID: 6404)
      • WSCommunicator.exe (PID: 6980)

    • Drops a system driver (possible attempt to evade defenses)

      • VOMSvcWebInstaller.exe (PID: 6852)

    • Application launched itself

      • EndpointBasecamp.exe (PID: 6404)

    • The process checks if it is being run in the virtual environment

      • EndpointBasecamp.exe (PID: 7048)

  • INFO

    • The sample compiled with english language support

      • EndpointBasecamp.exe (PID: 6404)
      • EndpointBasecamp.exe (PID: 6288)
      • VOMSvcWebInstaller.exe (PID: 6852)
      • TelemetryAgentServiceWebInstaller.exe (PID: 7148)
      • VOneModuleInstaller.exe (PID: 3172)
      • WSCommunicator.exe (PID: 6948)

    • Reads the software policy settings

      • EndpointBasecamp.exe (PID: 6404)
      • EndpointBasecamp.exe (PID: 7048)
      • VOMSvcWebInstaller.exe (PID: 6852)
      • EndpointBasecamp.exe (PID: 5588)
      • VOneModuleInstaller.exe (PID: 3172)
      • WSCommunicator.exe (PID: 6948)
      • WSCommunicator.exe (PID: 6980)
      • EndpointBasecampDebugger.exe (PID: 2612)

    • Checks supported languages

      • EndpointBasecamp.exe (PID: 6288)
      • EndpointBasecamp.exe (PID: 6404)
      • EndpointBasecamp.exe (PID: 7048)
      • EndpointBasecamp.exe (PID: 6928)
      • VOMSvcWebInstaller.exe (PID: 6852)
      • EndpointBasecamp.exe (PID: 5588)
      • VOneModuleInstaller.exe (PID: 3172)
      • WSCommunicator.exe (PID: 6948)
      • EndpointBasecamp.exe (PID: 5036)
      • EndpointBasecamp.exe (PID: 6936)
      • EndpointBasecampDebugger.exe (PID: 2612)
      • WSCommunicator.exe (PID: 6980)

    • Reads the machine GUID from the registry

      • EndpointBasecamp.exe (PID: 6404)
      • EndpointBasecamp.exe (PID: 6288)
      • EndpointBasecamp.exe (PID: 6928)
      • VOMSvcWebInstaller.exe (PID: 6852)
      • EndpointBasecamp.exe (PID: 7048)
      • EndpointBasecamp.exe (PID: 5588)
      • TelemetryAgentServiceWebInstaller.exe (PID: 7148)
      • WSCommunicator.exe (PID: 6948)
      • VOneModuleInstaller.exe (PID: 3172)
      • EndpointBasecamp.exe (PID: 5036)
      • EndpointBasecamp.exe (PID: 6936)
      • WSCommunicator.exe (PID: 6980)
      • EndpointBasecampDebugger.exe (PID: 2612)

    • Creates files in the program directory

      • EndpointBasecamp.exe (PID: 6288)
      • VOMSvcWebInstaller.exe (PID: 6852)
      • TelemetryAgentServiceWebInstaller.exe (PID: 7148)
      • EndpointBasecamp.exe (PID: 7048)
      • VOneModuleInstaller.exe (PID: 3172)
      • WSCommunicator.exe (PID: 6948)

    • Reads the computer name

      • VOMSvcWebInstaller.exe (PID: 6852)
      • VOneModuleInstaller.exe (PID: 3172)
      • WSCommunicator.exe (PID: 6948)
      • EndpointBasecampDebugger.exe (PID: 2612)

    • Manual execution by a user

      • Taskmgr.exe (PID: 6584)
      • Taskmgr.exe (PID: 4300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:03 01:58:33+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 3428352
InitializedDataSize: 1078784
UninitializedDataSize: -
EntryPoint: 0x2b2f82
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.1.0.5015
ProductVersionNumber: 1.1.0.5015
FileFlagsMask: 0x003f
FileFlags: Private build, Special build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Trend Micro Endpoint Basecamp
FileVersion: 1.1.0.5015
ProductVersion: 1.1
ProductName: Trend Micro Endpoint Basecamp
CompanyName: Trend Micro Inc.
LegalCopyright: Copyright (C) 2024 Trend Micro Incorporated. All rights reserved.
LegalTrademarks: Copyright (C) Trend Micro Inc.
OriginalFileName: EndpointBasecamp.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
26
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start endpointbasecamp.exe conhost.exe no specs endpointbasecamp.exe vomsvcwebinstaller.exe conhost.exe no specs endpointbasecamp.exe no specs conhost.exe no specs endpointbasecamp.exe conhost.exe no specs telemetryagentservicewebinstaller.exe conhost.exe no specs endpointbasecamp.exe no specs conhost.exe no specs vonemoduleinstaller.exe endpointbasecamp.exe no specs conhost.exe no specs wscommunicator.exe conhost.exe no specs wscommunicator.exe endpointbasecamp.exe no specs conhost.exe no specs endpointbasecampdebugger.exe conhost.exe no specs taskmgr.exe no specs taskmgr.exe endpointbasecamp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2612"C:\WINDOWS\temp\jc83SCfmOdp\ICL0ggMTfPN\EndpointBasecampDebugger.exe" /device_id 15c350c7-e9e2-47e2-99f3-ba477c551094 /collect_file "C:\Program Files (x86)\Trend Micro\Endpoint Basecamp\log\EndpointBasecamp.log" "XBC client" /collect_file "C:\windows\Temp\apo_preassess.log" "ES precheck" /collect_file "C:\windows\Temp\edr_indicator.log" "ES indicator" /collect_file "C:\Windows\Temp\ESE_Debug" "ES client" /collect_file "C:\windows\Temp\Cloud Endpoint" "MGCP client" /collect_file "C:\windows\Temp\TMER_Installer.log" "ER_Installer"C:\Windows\Temp\jc83SCfmOdp\ICL0ggMTfPN\EndpointBasecampDebugger.exe
EndpointBasecamp.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Trend Micro Endpoint Basecamp Debugger
Exit code:
0
Version:
1.1.0.4643
Modules
Images
c:\windows\temp\jc83scfmodp\icl0ggmtfpn\endpointbasecampdebugger.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3172C:\Windows\Temp\ROPQFoGt9mZ\nz8atYgpfnw\VOneModuleInstaller.exe --setup --dest="vom" --moduleId="ceta" --moduleDir="Ceta" --moduleDll="Ceta.dll" --pkg="C:\Windows\Temp\ROPQFoGt9mZ\nz8atYgpfnw\Telemetry Agent"C:\Windows\Temp\ROPQFoGt9mZ\nz8atYgpfnw\VOneModuleInstaller.exe
TelemetryAgentServiceWebInstaller.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Trend Micro Vision One Management Service Web Installer
Exit code:
0
Version:
1.2.0.565
Modules
Images
c:\windows\temp\ropqfogt9mz\nz8atygpfnw\vonemoduleinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcrypt.dll
4144"C:\Users\admin\AppData\Local\Temp\EndpointBasecamp.exe" C:\Users\admin\AppData\Local\Temp\EndpointBasecamp.exe—explorer.exe
User:
admin
Company:
Trend Micro Inc.
Integrity Level:
MEDIUM
Description:
Trend Micro Endpoint Basecamp
Exit code:
3221226540
Version:
1.1.0.5015
Modules
Images
c:\users\admin\appdata\local\temp\endpointbasecamp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4300"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
4400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—EndpointBasecampDebugger.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4604\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—EndpointBasecamp.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5036"C:\Program Files (x86)\Trend Micro\Endpoint Basecamp\EndpointBasecamp.exe" /xbc_auth_sdk dQEPfUpO4tG8E39pgit1C:\Program Files (x86)\Trend Micro\Endpoint Basecamp\EndpointBasecamp.exe—VOneModuleInstaller.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Trend Micro Endpoint Basecamp
Exit code:
0
Version:
1.1.0.5015
Modules
Images
c:\program files (x86)\trend micro\endpoint basecamp\endpointbasecamp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\bcrypt.dll
c:\windows\syswow64\ws2_32.dll
5588"C:\Program Files (x86)\Trend Micro\Endpoint Basecamp\EndpointBasecamp.exe" /xbc_auth_sdk 75JNO0BPXPnYXhR20k6LC:\Program Files (x86)\Trend Micro\Endpoint Basecamp\EndpointBasecamp.exe—TelemetryAgentServiceWebInstaller.exe
User:
SYSTEM
Company:
Trend Micro Inc.
Integrity Level:
SYSTEM
Description:
Trend Micro Endpoint Basecamp
Exit code:
0
Version:
1.1.0.5015
Modules
Images
c:\program files (x86)\trend micro\endpoint basecamp\endpointbasecamp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\bcrypt.dll
c:\windows\syswow64\ws2_32.dll
6288"C:\Users\admin\AppData\Local\Temp\EndpointBasecamp.exe" C:\Users\admin\AppData\Local\Temp\EndpointBasecamp.exe
explorer.exe
User:
admin
Company:
Trend Micro Inc.
Integrity Level:
HIGH
Description:
Trend Micro Endpoint Basecamp
Exit code:
0
Version:
1.1.0.5015
Modules
Images
c:\users\admin\appdata\local\temp\endpointbasecamp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcrypt.dll
6316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—EndpointBasecamp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
73 673
Read events
73 568
Write events
96
Delete events
9

Modification events

(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:runtime_stage
Value:
0
(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:device_id
Value:
15c350c7-e9e2-47e2-99f3-ba477c551094
(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:proxy_server
Value:
(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:proxy_bypass
Value:
(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:proxy_source
Value:
6
(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:runtime_proxy_source
Value:
0
(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:sg_proxy_source
Value:
0
(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\SecurityKeys
Operation:writeName:proxy_username
Value:
FepjXg==
(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\SecurityKeys
Operation:writeName:proxy_password
Value:
MornBg==
(PID) Process:(6288) EndpointBasecamp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\TrendMicro\TMSecurityService
Operation:writeName:gcs_server
Value:
Executable files
35
Suspicious files
26
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
6404EndpointBasecamp.exeC:\Windows\Temp\1DLCvwqR6ZX\dMWyKNURVLt\dllXbcSdk.dllexecutable
MD5:6F4F857F82598671CF40469E01ADB2D5
SHA256:E33317340FF28D16DD6B6582E42ABBA84B9768CB745DF8039D543F2318A623A5
6404EndpointBasecamp.exeC:\Windows\Temp\1DLCvwqR6ZX\USeTe17anpe.zipcompressed
MD5:079F6C0FE340209BD19A3DCD89ACCC5E
SHA256:73D4F99B226C3D7FDF92E016AED5631EFA7AD2B0B8BFDE27E150F1F1F8927E07
6852VOMSvcWebInstaller.exeC:\Windows\Temp\1DLCvwqR6ZX\dMWyKNURVLt\vom\WSC\dllWscSdk.dllexecutable
MD5:CB289CC0C1B9E8A23D2BCFA2BBF24796
SHA256:5B95613CE8C01C4B53BB53CFEEF95FC17E69CE017FFB49E5156E06BAC60DFF40
6288EndpointBasecamp.exeC:\Program Files (x86)\Trend Micro\Endpoint Basecamp\EndpointBasecamp.exeexecutable
MD5:76F41CBA65CF625DF1BCCE3F8AB5ED96
SHA256:A949D4AC7F1B4EEF9FC5F2E45CBBEC29D253BD2B189B1A9E41C4B13781D8C2D7
6852VOMSvcWebInstaller.exeC:\Windows\Temp\1DLCvwqR6ZX\dMWyKNURVLt\vom\modules\CeBridgeProxyModule\CeBridgeProxyModule.dllexecutable
MD5:C14F3D5062472FC0578443B282FC0B06
SHA256:590D8D707165C0C55E108B3155CAD4B32452E2F8710210D3DBFD63BEEB9BA72C
6852VOMSvcWebInstaller.exeC:\Windows\Temp\1DLCvwqR6ZX\dMWyKNURVLt\vom\VOMSvc.cfgbinary
MD5:CD32DDF03CAFFD9F0C6419226ADB76B0
SHA256:0B6E0BD297CCCE7577BAC8ED1D90F390E14C0ECF063BD312276A2C6B07472258
6852VOMSvcWebInstaller.exeC:\Windows\Temp\1DLCvwqR6ZX\dMWyKNURVLt\vom\PackageCheck.catcat
MD5:23CAD2C04314E773E3E96E6998BAB7C1
SHA256:366B5F5EE010ED5A9835B7C1439EDCC6B75BA0D9DFCA71C400964D013E7F5C58
6852VOMSvcWebInstaller.exeC:\Windows\Temp\1DLCvwqR6ZX\dMWyKNURVLt\VOMSvc.zipcompressed
MD5:CEEE8EDB378A89C227C0A4CD9395C91D
SHA256:E46B37C6174C8C375EDDC959E3C383099B4159ECF6B04F231BCD0434C51293A4
6852VOMSvcWebInstaller.exeC:\Windows\Temp\1DLCvwqR6ZX\dMWyKNURVLt\vom\VOM.dllexecutable
MD5:59CC56B78F03195727337C74FEF33ACB
SHA256:D8BB0AB62179081FD5604D35EA82021097F4D31CCDA6823852611D1FEB92B1F1
6852VOMSvcWebInstaller.exeC:\Windows\Temp\1DLCvwqR6ZX\dMWyKNURVLt\vom\dllXbcSdk.dllexecutable
MD5:6F4F857F82598671CF40469E01ADB2D5
SHA256:E33317340FF28D16DD6B6582E42ABBA84B9768CB745DF8039D543F2318A623A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
60
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6216
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
—
—
unknown
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
18.245.65.219:80
http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAq4j16W4SPpkH6HDeODfNA%3D
unknown
—
—
whitelisted
5576
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5576
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2356
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.38.73.129:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.19.80.27:443
www.bing.com
Akamai International B.V.
DE
whitelisted
6288
EndpointBasecamp.exe
18.185.221.143:443
api-eu1.xbc.trendmicro.com
AMAZON-02
DE
whitelisted
1176
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
www.microsoft.com
  • 23.38.73.129
whitelisted
www.bing.com
  • 2.19.80.27
  • 2.19.80.89
whitelisted
api-eu1.xbc.trendmicro.com
  • 18.185.221.143
  • 52.57.165.52
  • 52.57.120.221
  • 18.185.175.236
  • 18.194.11.104
  • 52.29.115.64
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.133
  • 40.126.32.68
  • 40.126.32.138
  • 40.126.32.140
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
release-us1.mgcp.trendmicro.com
  • 18.245.31.83
  • 18.245.31.49
  • 18.245.31.47
  • 18.245.31.111
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EndpointBasecamp.exe