File name:

just_convert.exe

Full analysis: https://app.any.run/tasks/6e2ed908-0d3f-4499-9928-53f6df58d5e9
Verdict: Malicious activity
Analysis date: July 22, 2024, 21:23:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5:

803934AD84990131B204E821FFF1C214

SHA1:

07C6CF2228716E21C2E8C04FEF6D22649E7568A3

SHA256:

B85F7A1FD6AC63487A23BC072284FFAC645D92D4151277A9B7419BAC77B692C2

SSDEEP:

98304:yYFTz3glj3eTadHzz+8UIiTtbeI+li15+OYHGAB4pubeciiUKtVi2/wP1/5VR2ic:TXny

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • just_convert.exe (PID: 364)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • just_convert.exe (PID: 364)

    • Reads the date of Windows installation

      • just_convert.exe (PID: 364)

    • Creates a software uninstall entry

      • just_convert.exe (PID: 364)

    • Searches for installed software

      • just_convert.exe (PID: 364)

  • INFO

    • Disables trace logs

      • just_convert.exe (PID: 364)

    • Checks supported languages

      • just_convert.exe (PID: 364)
      • TextInputHost.exe (PID: 7172)
      • identity_helper.exe (PID: 704)
      • identity_helper.exe (PID: 6792)
      • identity_helper.exe (PID: 4296)

    • Reads the software policy settings

      • just_convert.exe (PID: 364)

    • Reads Environment values

      • just_convert.exe (PID: 364)
      • identity_helper.exe (PID: 4296)
      • identity_helper.exe (PID: 704)
      • identity_helper.exe (PID: 6792)

    • Checks proxy server information

      • just_convert.exe (PID: 364)

    • Reads the computer name

      • just_convert.exe (PID: 364)
      • TextInputHost.exe (PID: 7172)
      • identity_helper.exe (PID: 4296)
      • identity_helper.exe (PID: 704)
      • identity_helper.exe (PID: 6792)

    • Reads the machine GUID from the registry

      • just_convert.exe (PID: 364)

    • Application launched itself

      • firefox.exe (PID: 1508)
      • firefox.exe (PID: 7096)
      • firefox.exe (PID: 1264)
      • msedge.exe (PID: 7112)
      • msedge.exe (PID: 7632)
      • firefox.exe (PID: 7456)
      • msedge.exe (PID: 8120)

    • Reads Microsoft Office registry keys

      • just_convert.exe (PID: 364)
      • firefox.exe (PID: 1264)
      • msedge.exe (PID: 7632)
      • msedge.exe (PID: 7112)
      • firefox.exe (PID: 7456)
      • msedge.exe (PID: 8120)

    • Create files in a temporary directory

      • just_convert.exe (PID: 364)

    • Process checks computer location settings

      • just_convert.exe (PID: 364)

    • Creates files or folders in the user directory

      • just_convert.exe (PID: 364)

    • Manual execution by a user

      • msedge.exe (PID: 4792)
      • msedge.exe (PID: 8120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2056:04:25 01:49:59+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 3819520
InitializedDataSize: 17408
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.0.1.33
ProductVersionNumber: 5.0.1.33
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: JCF
FileVersion: 5.0.1.33
InternalName: JCF.exe
LegalCopyright: © 2024 B.L.A ASPIRE LTD. All rights reserved.
LegalTrademarks: -
OriginalFileName: JCF.exe
ProductName: JCF
ProductVersion: 5.0.1.33
AssemblyVersion: 5.0.1.33
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
224
Monitored processes
87
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start just_convert.exe slui.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs textinputhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5260 --field-trial-handle=2428,i,6775051445785642557,610791939848118229,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
304"C:\Program Files\mozilla firefox\firefox.exe" -contentproc --channel=1916 -parentBuildID 20240213221259 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 33693 -prefMapSize 244343 -appDir "C:\Program Files\mozilla firefox\browser" - {66a939b4-cdb7-4eb8-ae10-3918971768d1} 7456 "\\.\pipe\gecko-crash-server-pipe.7456" 2b0305e5410 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
364"C:\Users\admin\AppData\Local\Temp\just_convert.exe" C:\Users\admin\AppData\Local\Temp\just_convert.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
JCF
Exit code:
0
Version:
5.0.1.33
Modules
Images
c:\users\admin\appdata\local\temp\just_convert.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
700"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5836 --field-trial-handle=2428,i,4448717172574260451,6316024135323165016,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
704"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3544 --field-trial-handle=2304,i,2859245749013795613,14103583542821536867,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
892"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x290,0x294,0x298,0x288,0x2a0,0x7fff014a5fd8,0x7fff014a5fe4,0x7fff014a5ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
996"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3348 --field-trial-handle=2304,i,2859245749013795613,14103583542821536867,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4856 --field-trial-handle=2428,i,4448717172574260451,6316024135323165016,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1264"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
1336"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x1fc,0x1d4,0x1f4,0x168,0x2a8,0x7fff014a5fd8,0x7fff014a5fe4,0x7fff014a5ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
54 094
Read events
53 851
Write events
236
Delete events
7

Modification events

(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(364) just_convert.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\just_convert_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
4
Suspicious files
364
Text files
154
Unknown types
13

Dropped files

PID
Process
Filename
Type
364just_convert.exeC:\Users\admin\AppData\Local\Temp\UID\UID.txttext
MD5:9967D9C414F311FFD3BFA795ACB878CF
SHA256:505DBDB7B09F5A6239EA27FC22FDC7933C39F9C905FFEF4555CEBA542AAD1951
1264firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
1264firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:D91FAC8DB91DD8A498751DB7B4F322D8
SHA256:A8C84354A6CA07DA1AA9FC5ED0E6FD62016CB111C48536AE612EA1C30E761768
1264firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1264firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1264firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
364just_convert.exeC:\Users\admin\AppData\Local\Temp\JCF.Assets.Animation.mp4binary
MD5:4159EABDA0768F945F565E86C551455F
SHA256:708AD876AE5506AAB28204AC1B9FCADDFA90FA73D7BA7A52AA7096835990DC02
1264firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
364just_convert.exeC:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTDxml
MD5:90BE2701C8112BEBC6BD58A7DE19846E
SHA256:644FBCDC20086E16D57F31C5BAD98BE68D02B1C061938D2F5F91CBE88C871FBF
1264firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
204
DNS requests
265
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1264
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
1264
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
1264
firefox.exe
POST
200
2.16.241.15:80
http://r10.o.lencr.org/
unknown
—
—
unknown
1264
firefox.exe
POST
200
95.101.54.114:80
http://r3.o.lencr.org/
unknown
—
—
unknown
1264
firefox.exe
POST
200
2.16.241.15:80
http://r10.o.lencr.org/
unknown
—
—
unknown
1264
firefox.exe
POST
200
2.16.241.15:80
http://r10.o.lencr.org/
unknown
—
—
unknown
1264
firefox.exe
POST
200
2.16.241.15:80
http://r10.o.lencr.org/
unknown
—
—
unknown
1264
firefox.exe
POST
200
142.250.186.67:80
http://o.pki.goog/wr2
unknown
—
—
unknown
1264
firefox.exe
POST
—
142.250.186.67:80
http://o.pki.goog/wr2
unknown
—
—
unknown
1264
firefox.exe
POST
—
95.101.54.195:80
http://r11.o.lencr.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6012
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4288
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4016
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.23.209.140:443
—
Akamai International B.V.
GB
unknown
4204
svchost.exe
4.209.33.156:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
364
just_convert.exe
167.172.242.127:443
ytc.justlient.com
DIGITALOCEAN-ASN
US
unknown
5368
SearchApp.exe
92.122.215.58:443
www.bing.com
Akamai International B.V.
DE
unknown
5272
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 216.58.212.138
whitelisted
google.com
  • 142.250.185.78
whitelisted
ytc.justlient.com
  • 167.172.242.127
unknown
www.bing.com
  • 92.122.215.58
  • 2.20.142.122
  • 92.122.215.95
  • 2.20.142.186
  • 92.122.215.99
  • 92.122.215.72
  • 92.122.215.98
  • 92.122.215.2
  • 2.20.142.251
  • 2.20.143.112
  • 2.20.142.137
  • 2.20.142.123
  • 2.20.142.181
  • 2.20.142.145
  • 2.20.142.146
  • 2.20.142.139
  • 2.20.142.153
  • 2.20.142.138
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.76
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.20
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.199.58.43
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
just_convert.exe