File name:

b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe

Full analysis: https://app.any.run/tasks/380d942c-de2d-4de3-bedb-6fe15a0903ec
Verdict: Malicious activity
Analysis date: September 30, 2020, 08:22:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F1B044E9C52A9E2F60051D39000CC046

SHA1:

2AFFEEDAEF525BC9FA609710DEB24AF5477E3D9A

SHA256:

B140231893C88C5D7F9697E5451AE17D69A94688D8FDF1CBE00C9D4794F34D17

SSDEEP:

49152:kHVgiGeFHz8bcbChNhCvNZ4OuzShC8o7S2JP:yginFHz8bhQNBuzntP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)
      • msiexec.exe (PID: 2420)

    • Changes Windows auto-update feature

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Disables Windows Defender

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Loads the Task Scheduler COM API

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Actions looks like stealing of personal data

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Creates files in the program directory

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Searches for installed software

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Adds / modifies Windows certificates

      • msiexec.exe (PID: 2420)
      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Executable content was dropped or overwritten

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)
      • msiexec.exe (PID: 2420)

    • Starts Microsoft Installer

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Creates or modifies windows services

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Application launched itself

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2708)

    • Starts SC.EXE for service management

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Creates files in the user directory

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

  • INFO

    • Application launched itself

      • msiexec.exe (PID: 2420)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1276)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 2420)

    • Reads settings of System Certificates

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Creates files in the program directory

      • msiexec.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:07:16 14:29:03+02:00
PEType: PE32
LinkerVersion: 9
CodeSize: 150528
InitializedDataSize: 556032
UninitializedDataSize: -
EntryPoint: 0x378000
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Jul-2020 12:29:03
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 16-Jul-2020 12:29:03
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
0x00001000
0x000B3000
0x000B3000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.78159
.rsrc
0x000B4000
0x000003D0
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.23402
.idata
0x000B5000
0x00001000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.30872
0x000B6000
0x00195000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.264678
mimktfre
0x0024B000
0x0012D000
0x0012C800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.9303
yvsofpvn
0x00378000
0x00001000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.06952

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.95975
886
Latin 1 / Western European
English - United States
RT_MANIFEST

Imports

comctl32.dll
kernel32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1276C:\Windows\system32\MsiExec.exe -Embedding 5254535C0E03BB8168D737E9AD716EADC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1696"C:\Windows\System32\sc.exe" config gupdatem start= disabledC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1720"C:\Windows\System32\sc.exe" stop MozillaMaintenanceC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1724"C:\Windows\System32\sc.exe" stop edgeupdateC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2172"C:\Windows\System32\sc.exe" config edgeupdatem start= disabledC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2420C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2444"C:\Windows\System32\sc.exe" stop edgeupdatemC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2524"C:\Windows\System32\sc.exe" config gupdate start= disabledC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2708"C:\Users\admin\AppData\Local\Temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe" C:\Users\admin\AppData\Local\Temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2768"C:\Users\admin\AppData\Local\Temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe" C:\Users\admin\AppData\Local\Temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
5 470
Read events
828
Write events
4 592
Delete events
50

Modification events

(PID) Process:(2708) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2708) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2768) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dnscache
Operation:writeName:Id
Value:
8hth4tYMdHMqluE3J2+mr7nAEcEllUuFjLFupkqUG62DrirY0FN9OQ==
(PID) Process:(2768) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions
Operation:delete keyName:(default)
Value:
(PID) Process:(2768) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox
Operation:writeName:00001505
Value:
pDiO1N3DLcXfpTa7UzT81n9aAEZsEPBnhqpjYYYrSJmhKhAB/8rYGQ3oHOdczjio7Hv5PK0O0qKDXK5T/NSRTxKzbJls6cDnpzZlP3BUln3PtmRWEBweSrIzUBZ1z/QaJBmokzXORyg=
(PID) Process:(2768) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EdgeUpdate
Operation:writeName:UpdateDefault
Value:
0
(PID) Process:(2768) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EdgeUpdate
Operation:writeName:ProxyServer
Value:
0.0.0.0
(PID) Process:(2768) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EdgeUpdate
Operation:writeName:AutoUpdateCheckPeriodMinutes
Value:
0
(PID) Process:(2768) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EdgeUpdate
Operation:writeName:DisableAutoUpdateChecksCheckboxValue
Value:
1
(PID) Process:(2768) b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EdgeUpdate
Operation:writeName:Install{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Value:
0
Executable files
4
Suspicious files
28
Text files
3 087
Unknown types
11

Dropped files

PID
Process
Filename
Type
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Local\Temp\CabBD3B.tmp —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Local\Temp\TarBD4C.tmp —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Program Files\Google\Updater —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\minidumps —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\healthreport.sqlite —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_4D6B3EB9FCF965ACEB905EECDEB080B1der
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.jsontext
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Windows\System32\GroupPolicy\GPT.INItext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
7
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA7j3xstfX1ZpOivr3r64cM%3D
US
der
280 b
whitelisted
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDCpLyOwe8JNYnzhjuetFgf
US
der
472 b
whitelisted
1052
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1052
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA7yTSbUNi7CXXtef0luXqk%3D
US
der
279 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
104.31.93.244:443
up.jspixel.com
Cloudflare Inc
US
suspicious
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
104.20.22.46:443
nodejs.org
Cloudflare Inc
US
shared
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
1052
svchost.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
up.jspixel.com
  • 104.31.93.244
  • 104.31.92.244
  • 172.67.159.168
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
nodejs.org
  • 104.20.22.46
  • 104.20.23.46
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.sectigo.com
  • 151.139.128.14
whitelisted

Threats

No threats detected
Process
Message
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe