File name:

New Text Document mod.exe

Full analysis: https://app.any.run/tasks/6955419a-499a-49c8-bd5f-461ddd198dd0
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 15, 2024, 01:39:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
dyndns
github
hausbomber
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C6040234EE8EAEDBE618632818C3B1B3

SHA1:

68115F8C3394C782AA6BA663AC78695D2B80BF75

SHA256:

BB459869E5EF6D6DD6F0329080D7CB12542C4B37163AE2CD782620ADCD7D55A0

SSDEEP:

12288:f3H6yScLnqOl0r5Zu0LMFbtizFJ6rAPvOxrcg0i7u48S+isSl:f3HzLnqOaNMCFJ6kPvOxrcg0i7uFSsE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • New Text Document mod.exe (PID: 6420)

    • HAUSBOMBER has been detected (YARA)

      • ._cache_New Text Document mod.exe (PID: 6468)

    • DCRAT has been detected (YARA)

      • ._cache_New Text Document mod.exe (PID: 6468)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • New Text Document mod.exe (PID: 6420)
      • ._cache_New Text Document mod.exe (PID: 6468)

    • Executable content was dropped or overwritten

      • New Text Document mod.exe (PID: 6420)
      • ._cache_New Text Document mod.exe (PID: 6468)

    • Reads security settings of Internet Explorer

      • ._cache_New Text Document mod.exe (PID: 6468)
      • Extreme%20Injector%20v3.exe (PID: 6768)
      • s.exe (PID: 6812)
      • a.exe (PID: 1060)
      • New Text Document mod.exe (PID: 6420)

    • Reads the date of Windows installation

      • ._cache_New Text Document mod.exe (PID: 6468)
      • New Text Document mod.exe (PID: 6420)
      • Extreme%20Injector%20v3.exe (PID: 6768)

    • Process drops legitimate windows executable

      • ._cache_New Text Document mod.exe (PID: 6468)

    • There is functionality for communication dyndns network (YARA)

      • New Text Document mod.exe (PID: 6420)

    • There is functionality for taking screenshot (YARA)

      • New Text Document mod.exe (PID: 6420)

    • There is functionality for communication over UDP network (YARA)

      • New Text Document mod.exe (PID: 6420)

    • Checks Windows Trust Settings

      • s.exe (PID: 6812)

    • Application launched itself

      • Extreme%20Injector%20v3.exe (PID: 6768)

    • Potential Corporate Privacy Violation

      • ._cache_New Text Document mod.exe (PID: 6468)

    • Starts a Microsoft application from unusual location

      • stub.exe (PID: 7536)

  • INFO

    • Checks supported languages

      • New Text Document mod.exe (PID: 6420)
      • ._cache_New Text Document mod.exe (PID: 6468)
      • Extreme%20Injector%20v3.exe (PID: 6768)
      • s.exe (PID: 6812)
      • handicap.exe (PID: 6368)
      • a.exe (PID: 1060)
      • b.exe (PID: 4604)
      • Extreme%20Injector%20v3.exe (PID: 6048)
      • build2.exe (PID: 7932)
      • stub.exe (PID: 7536)

    • Creates files in the program directory

      • New Text Document mod.exe (PID: 6420)

    • Process checks computer location settings

      • New Text Document mod.exe (PID: 6420)
      • ._cache_New Text Document mod.exe (PID: 6468)
      • Extreme%20Injector%20v3.exe (PID: 6768)

    • Reads the machine GUID from the registry

      • ._cache_New Text Document mod.exe (PID: 6468)
      • Extreme%20Injector%20v3.exe (PID: 6768)
      • s.exe (PID: 6812)
      • Extreme%20Injector%20v3.exe (PID: 6048)

    • Reads Environment values

      • ._cache_New Text Document mod.exe (PID: 6468)
      • Extreme%20Injector%20v3.exe (PID: 6048)

    • Disables trace logs

      • ._cache_New Text Document mod.exe (PID: 6468)
      • Extreme%20Injector%20v3.exe (PID: 6048)

    • Checks proxy server information

      • ._cache_New Text Document mod.exe (PID: 6468)
      • handicap.exe (PID: 6368)
      • s.exe (PID: 6812)
      • a.exe (PID: 1060)
      • Extreme%20Injector%20v3.exe (PID: 6048)

    • Reads the computer name

      • ._cache_New Text Document mod.exe (PID: 6468)
      • handicap.exe (PID: 6368)
      • s.exe (PID: 6812)
      • Extreme%20Injector%20v3.exe (PID: 6768)
      • b.exe (PID: 4604)
      • Extreme%20Injector%20v3.exe (PID: 6048)
      • a.exe (PID: 1060)
      • stub.exe (PID: 7536)
      • New Text Document mod.exe (PID: 6420)

    • Reads the software policy settings

      • ._cache_New Text Document mod.exe (PID: 6468)
      • Extreme%20Injector%20v3.exe (PID: 6048)
      • s.exe (PID: 6812)

    • Application launched itself

      • msedge.exe (PID: 7360)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 7360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (96.4)
.exe | Win32 Executable Delphi generic (2)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.3)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 629760
InitializedDataSize: 148992
UninitializedDataSize: -
EntryPoint: 0x9ab80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.4
ProductVersionNumber: 1.0.0.4
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Turkish
CharacterSet: Windows, Turkish
CompanyName: Synaptics
FileDescription: Synaptics Pointing Device Driver
FileVersion: 1.0.0.4
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: Synaptics Pointing Device Driver
ProductVersion: 1.0.0.0
Comments: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
22
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT new text document mod.exe #HAUSBOMBER ._cache_new text document mod.exe conhost.exe no specs extreme%20injector%20v3.exe no specs s.exe handicap.exe rundll32.exe no specs a.exe conhost.exe no specs b.exe no specs extreme%20injector%20v3.exe msedge.exe msedge.exe no specs stub.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs build2.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1060"C:\Users\admin\Desktop\a\a.exe" C:\Users\admin\Desktop\a\a.exe
._cache_New Text Document mod.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\a\a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4084\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4604"C:\Users\admin\Desktop\a\b.exe" C:\Users\admin\Desktop\a\b.exe—._cache_New Text Document mod.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\a\b.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6048"C:\Users\admin\Desktop\a\Extreme%20Injector%20v3.exe" C:\Users\admin\Desktop\a\Extreme%20Injector%20v3.exe
Extreme%20Injector%20v3.exe
User:
admin
Company:
master131
Integrity Level:
HIGH
Description:
Extreme Injector
Version:
3.7.3.0
Modules
Images
c:\users\admin\desktop\a\extreme%20injector%20v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6336C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6368"C:\Users\admin\Desktop\a\handicap.exe" C:\Users\admin\Desktop\a\handicap.exe
._cache_New Text Document mod.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\a\handicap.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
6420"C:\Users\admin\Desktop\New Text Document mod.exe" C:\Users\admin\Desktop\New Text Document mod.exe
explorer.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Version:
1.0.0.4
Modules
Images
c:\users\admin\desktop\new text document mod.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6468"C:\Users\admin\Desktop\._cache_New Text Document mod.exe" C:\Users\admin\Desktop\._cache_New Text Document mod.exe
New Text Document mod.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\._cache_new text document mod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6476\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—._cache_New Text Document mod.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6768"C:\Users\admin\Desktop\a\Extreme%20Injector%20v3.exe" C:\Users\admin\Desktop\a\Extreme%20Injector%20v3.exe—._cache_New Text Document mod.exe
User:
admin
Company:
master131
Integrity Level:
MEDIUM
Description:
Extreme Injector
Exit code:
0
Version:
3.7.3.0
Modules
Images
c:\users\admin\desktop\a\extreme%20injector%20v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
16 269
Read events
16 179
Write events
89
Delete events
1

Modification events

(PID) Process:(6420) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6420) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6420) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6420) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6420) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6420) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Synaptics Pointing Device Driver
Value:
C:\ProgramData\Synaptics\Synaptics.exe
(PID) Process:(6420) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000062B06A59D2B415429F74E9109B0A815394040000
(PID) Process:(6468) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6468) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6468) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
17
Suspicious files
149
Text files
70
Unknown types
0

Dropped files

PID
Process
Filename
Type
7360msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe9bce.TMP —
MD5:—
SHA256:—
7360msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6420New Text Document mod.exeC:\Users\admin\Desktop\._cache_New Text Document mod.exeexecutable
MD5:69994FF2F00EECA9335CCD502198E05B
SHA256:2E2E035ECE4ACCDEE838ECAACDC263FA526939597954D18D1320D73C8BF810C2
7360msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFe9bde.TMP —
MD5:—
SHA256:—
7360msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFe9bde.TMP —
MD5:—
SHA256:—
7360msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7360msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7360msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RFe9bed.TMP —
MD5:—
SHA256:—
7360msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7360msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe9bfd.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
8
DNS requests
97
Threats
44

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6468
._cache_New Text Document mod.exe
GET
200
124.220.235.28:80
http://124.220.235.28/tool/Extreme%20Injector%20v3.exe
unknown
—
—
unknown
6468
._cache_New Text Document mod.exe
GET
200
41.216.183.157:8000
http://41.216.183.157:8000/s.exe
unknown
—
—
unknown
6468
._cache_New Text Document mod.exe
GET
200
41.216.183.157:8000
http://41.216.183.157:8000/handicap.exe
unknown
—
—
unknown
6468
._cache_New Text Document mod.exe
GET
200
41.216.183.157:8000
http://41.216.183.157:8000/a.exe
unknown
—
—
unknown
6468
._cache_New Text Document mod.exe
GET
200
41.216.183.157:8000
http://41.216.183.157:8000/b.exe
unknown
—
—
unknown
2248
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4692
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6468
._cache_New Text Document mod.exe
GET
200
185.215.113.19:80
http://185.215.113.19/inc/msedge.exe
unknown
—
—
unknown
6468
._cache_New Text Document mod.exe
GET
200
82.147.85.52:80
http://82.147.85.52/build2.exe
unknown
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
4708
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4788
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6468
._cache_New Text Document mod.exe
151.101.66.49:443
urlhaus.abuse.ch
FASTLY
US
unknown
6468
._cache_New Text Document mod.exe
124.220.235.28:80
—
Shenzhen Tencent Computer Systems Company Limited
CN
unknown
4708
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
urlhaus.abuse.ch
  • 151.101.66.49
  • 151.101.2.49
  • 151.101.194.49
  • 151.101.130.49
whitelisted
id1.cloud.huawei.com
  • 49.4.37.143
  • 49.4.18.163
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
www.bing.com
  • 2.16.110.121
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.69
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
th.bing.com
  • 2.16.110.121
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

PID
Process
Class
Message
6468
._cache_New Text Document mod.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6468
._cache_New Text Document mod.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6468
._cache_New Text Document mod.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6468
._cache_New Text Document mod.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6468
._cache_New Text Document mod.exe
Misc activity
ET INFO Packed Executable Download
6468
._cache_New Text Document mod.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
6468
._cache_New Text Document mod.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6468
._cache_New Text Document mod.exe
A Network Trojan was detected
ET MALWARE Single char EXE direct download likely trojan (multiple families)
6468
._cache_New Text Document mod.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6468
._cache_New Text Document mod.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
New Text Document mod.exe