File name:

Borat.7z

Full analysis: https://app.any.run/tasks/7c5826c0-b1b0-4656-bb7f-182c374e6ade
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: June 11, 2024, 23:51:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
asyncrat
uac
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

43C20E4EE2DD87C70DD0ED082DC74431

SHA1:

71051DEE5D0480B8AA30A599A95D0AD928F7BB9E

SHA256:

B2F4CC95E54ACC818410D79072CCD44A4DBB21AFAD82C2A4608B7B52F1502867

SSDEEP:

98304:4mnI+WmnzFhcWMOo/5ucNWw7tq3o280CB6oWprH0Vtcpot+FfRT5apCeiFqQgijQ:BtYHMwzJ4hoHQLs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 6492)
      • BoratRat.exe (PID: 4700)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6492)
      • BoratRat.exe (PID: 4700)
      • Client.exe (PID: 5896)

    • ASYNCRAT has been detected (YARA)

      • BoratRat.exe (PID: 4700)

    • Changes the autorun value in the registry

      • Client.exe (PID: 5896)

    • Bypass User Account Control (fodhelper)

      • fodhelper.exe (PID: 5404)

    • Bypass User Account Control (Modify registry)

      • ChromeBoratEdition.exe (PID: 4620)

    • Starts NET.EXE for service management

      • powershell.exe (PID: 6836)

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 4060)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 6492)

    • The process checks if it is being run in the virtual environment

      • BoratRat.exe (PID: 4700)

    • Reads security settings of Internet Explorer

      • BoratRat.exe (PID: 4700)
      • ChromeBoratEdition.exe (PID: 1180)

    • Creates file in the systems drive root

      • BoratRat.exe (PID: 4700)

    • Executable content was dropped or overwritten

      • BoratRat.exe (PID: 4700)
      • Client.exe (PID: 5896)

    • Executing commands from a ".bat" file

      • Client.exe (PID: 5896)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2764)

    • Starts CMD.EXE for commands execution

      • Client.exe (PID: 5896)
      • ChromeBoratEdition.exe (PID: 4620)
      • powershell.exe (PID: 6836)

    • The executable file from the user directory is run by the CMD process

      • ChromeBoratEdition.exe (PID: 4620)

    • Starts POWERSHELL.EXE for commands execution

      • ChromeBoratEdition.exe (PID: 1180)

    • Reads the date of Windows installation

      • ChromeBoratEdition.exe (PID: 1180)

    • Base64-obfuscated command line is found

      • ChromeBoratEdition.exe (PID: 1180)

    • Changes default file association

      • ChromeBoratEdition.exe (PID: 4620)

    • Starts SC.EXE for service management

      • powershell.exe (PID: 6836)

    • Identifying current user with WHOAMI command

      • powershell.exe (PID: 6836)

    • Found strings related to reading or modifying Windows Defender settings

      • powershell.exe (PID: 6836)

    • BASE64 encoded PowerShell command has been detected

      • ChromeBoratEdition.exe (PID: 1180)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 6836)

  • INFO

    • Manual execution by a user

      • BoratRat.exe (PID: 4700)
      • BoratClient.exe (PID: 5076)
      • Client.exe (PID: 5896)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6492)

    • Checks supported languages

      • BoratRat.exe (PID: 4700)
      • BoratClient.exe (PID: 5076)
      • ChromeBoratEdition.exe (PID: 4620)
      • Client.exe (PID: 5896)
      • ChromeBoratEdition.exe (PID: 1180)

    • Reads the computer name

      • BoratRat.exe (PID: 4700)
      • BoratClient.exe (PID: 5076)
      • Client.exe (PID: 5896)
      • ChromeBoratEdition.exe (PID: 4620)
      • ChromeBoratEdition.exe (PID: 1180)

    • Reads the machine GUID from the registry

      • BoratRat.exe (PID: 4700)
      • Client.exe (PID: 5896)
      • ChromeBoratEdition.exe (PID: 4620)
      • ChromeBoratEdition.exe (PID: 1180)

    • Creates files or folders in the user directory

      • BoratRat.exe (PID: 4700)
      • Client.exe (PID: 5896)

    • Create files in a temporary directory

      • BoratRat.exe (PID: 4700)
      • Client.exe (PID: 5896)

    • Reads the software policy settings

      • slui.exe (PID: 5960)
      • ChromeBoratEdition.exe (PID: 4620)
      • ChromeBoratEdition.exe (PID: 1180)
      • slui.exe (PID: 4952)

    • Reads Environment values

      • BoratRat.exe (PID: 4700)
      • ChromeBoratEdition.exe (PID: 4620)
      • ChromeBoratEdition.exe (PID: 1180)

    • Checks proxy server information

      • slui.exe (PID: 4952)

    • Reads Microsoft Office registry keys

      • fodhelper.exe (PID: 5404)

    • Process checks computer location settings

      • ChromeBoratEdition.exe (PID: 1180)

    • Reads security settings of Internet Explorer

      • fodhelper.exe (PID: 5404)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6836)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
26
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs #ASYNCRAT boratrat.exe sppextcomobj.exe no specs slui.exe boratclient.exe no specs slui.exe client.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs chromeboratedition.exe no specs cmd.exe no specs conhost.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe chromeboratedition.exe no specs powershell.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs securityhealthsystray.exe no specs whoami.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1120C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1180"C:\Users\admin\AppData\Roaming\ChromeBoratEdition.exe" C:\Users\admin\AppData\Roaming\ChromeBoratEdition.exe—fodhelper.exe
User:
admin
Integrity Level:
HIGH
Version:
1.0.7.0
Modules
Images
c:\users\admin\appdata\roaming\chromeboratedition.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1256"C:\WINDOWS\system32\whoami.exe" /groupsC:\Windows\System32\whoami.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
whoami - displays logged on user information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\whoami.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1708"C:\WINDOWS\system32\net1.exe" start TrustedInstallerC:\Windows\System32\net1.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
1788timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2764C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmpE18E.tmp.bat""C:\Windows\System32\cmd.exe—Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
3100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3672SecurityHealthSystray C:\Windows\System32\SecurityHealthSystray.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Security notification icon
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\securityhealthsystray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4020\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4060"C:\WINDOWS\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe" C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
43 373
Read events
43 067
Write events
274
Delete events
32

Modification events

(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Borat.7z
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
33
Suspicious files
6
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\bin\ip2region.db —
MD5:—
SHA256:—
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\BackupCertificate.zipcompressed
MD5:9322F71EDD95192E1F4D275BFD6D87F3
SHA256:F13033134C386E85A1E9009E863A3E6380438F83E3336B76A33E701A88F64946
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\BoratRat.exeexecutable
MD5:65B694D69D327EFE28FCBCE125401E96
SHA256:DE60ECBBFEF30C93FE8875EF69B358B20076D1F969FC3D21AB44D59DC9EF7CAB
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\bin\Keylogger.exeexecutable
MD5:A45679BDCF30F068032BD37A194FA175
SHA256:16BEB1AE2DE2974CCC2371D9F619F492295E590ABB65D3102E362C8EC27F2BBB
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\bin\Extra.dllexecutable
MD5:62C231BAFA469AB04F090FCB4475D360
SHA256:6A4F32B0228092CE68E8448C6F4B74B4C654F40FB2D462C1D6BBD4B4EF09053D
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\BoratRat.exe.configxml
MD5:3E645CCCA1C44A00210924A3B0780955
SHA256:F29E697EFD7C5ECB928C0310EA832325BF6518786C8E1585E1B85CDC8701602F
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\ServerCertificate.p12der
MD5:478EE44A47895E687296B9AB34DF04C4
SHA256:4B0612B2CD5E7ECC456D5C29C89917B8EC881C5F4FD94AFE157098CA96308781
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\bin\Discord.dllexecutable
MD5:7EE673594BBB20F65448AAB05F1361D0
SHA256:8FA7634B7DCA1A451CF8940429BE6AD2440821ED04D5D70B6E727E5968E0B5F6
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\bin\Audio.dllexecutable
MD5:9726D7FE49C8BA43845AD8E5E2802BB8
SHA256:DF31A70CEB0C481646EEAF94189242200FAFD3DF92F8B3EC97C0D0670F0E2259
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6492.21656\Borat\bin\FileManager.dllexecutable
MD5:4CCD3DFB14FFDDDFA598D1096F0190EA
SHA256:7F8A306826FCB0EE985A2B6D874C805F7F9B2062A1123EA4BB7F1EBA90FC1B81
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
60
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2384
svchost.exe
GET
200
23.45.13.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
2384
svchost.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
3904
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
6792
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
2908
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
6436
SIHClient.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6436
SIHClient.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2384
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5076
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5140
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
2384
svchost.exe
23.45.13.35:80
crl.microsoft.com
Akamai International B.V.
US
unknown
4680
SearchApp.exe
23.194.131.160:443
www.bing.com
Akamai International B.V.
US
unknown
4680
SearchApp.exe
23.194.131.145:443
www.bing.com
Akamai International B.V.
US
unknown
2384
svchost.exe
2.17.0.227:80
www.microsoft.com
AKAMAI-AS
DK
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.45.13.35
  • 23.45.13.24
whitelisted
www.bing.com
  • 23.194.131.145
  • 23.194.131.177
  • 23.194.131.169
  • 23.194.131.139
  • 23.194.131.137
  • 23.194.131.160
  • 23.194.131.168
  • 23.194.131.161
  • 23.194.131.171
whitelisted
r.bing.com
  • 23.194.131.160
  • 23.194.131.169
  • 23.194.131.171
  • 23.194.131.139
  • 23.194.131.168
  • 23.194.131.137
  • 23.194.131.161
  • 23.194.131.177
  • 23.194.131.145
whitelisted
www.microsoft.com
  • 2.17.0.227
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.0
  • 40.126.31.71
  • 20.190.159.68
  • 20.190.159.75
  • 20.190.159.64
  • 20.190.159.73
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 2.17.1.249
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Borat.7z