File name:

π—žπ— π—¦π—£π—œπ—–π—’.exe

Full analysis: https://app.any.run/tasks/10d76e24-9647-47f6-b3c3-8ce7489e8b24
Verdict: Malicious activity
Analysis date: August 04, 2024, 04:35:21
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
susp-powershell
wmi-base64
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5:

5D4FBA0B7799AFC9E6545B737A9C1233

SHA1:

350444CCA78E9B593F3E2CC5F4E49A3022CBC287

SHA256:

BE944EEED71FBFAA27360FAF468A946D1899B287C9665F3543E3F30DFCDCD31E

SSDEEP:

98304:of0BiPcJNdaBCv4UZ4dQ9sBCynSSDc+jDNqgb3TdQnZgsJdO8FJeecokJ+Jl+HzO:o5orjL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Registers / Runs the DLL via REGSVR32.EXE

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

  • SUSPICIOUS

    • Application launched itself

      • cmd.exe (PID: 7016)
      • cmd.exe (PID: 5500)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7016)
      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)
      • cmd.exe (PID: 5500)

    • Executable content was dropped or overwritten

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Executes application which crashes

      • regsvr32.exe (PID: 2508)
      • regsvr32.exe (PID: 1536)

    • Reads security settings of Internet Explorer

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Reads the date of Windows installation

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Executing commands from a ".bat" file

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 5500)
      • cmd.exe (PID: 7016)

    • Uses WMIC.EXE to obtain computer system information

      • cmd.exe (PID: 5500)
      • cmd.exe (PID: 7016)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5500)
      • cmd.exe (PID: 7016)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5500)
      • cmd.exe (PID: 7016)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7016)
      • cmd.exe (PID: 5500)

    • Hides command output

      • cmd.exe (PID: 5032)
      • cmd.exe (PID: 6620)
      • cmd.exe (PID: 6840)
      • cmd.exe (PID: 5600)

  • INFO

    • Reads the computer name

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Checks supported languages

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)
      • mode.com (PID: 3972)
      • mode.com (PID: 4824)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Found Base64 encoded access to UAC via PowerShell (YARA)

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Found Base64 encoded JSON usage via PowerShell (YARA)

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Found Base64 encoded file access via PowerShell (YARA)

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Found Base64 encoded reference to WMI classes (YARA)

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Found Base64 encoded access to Windows Identity via PowerShell (YARA)

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Create files in a temporary directory

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 904)
      • WerFault.exe (PID: 2468)

    • Process checks computer location settings

      • π—žπ— π—¦π—£π—œπ—–π—’.exe (PID: 6268)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 5292)
      • WMIC.exe (PID: 2804)

    • Checks operating system version

      • cmd.exe (PID: 7016)
      • cmd.exe (PID: 5500)

    • Reads Microsoft Office registry keys

      • reg.exe (PID: 1356)
      • reg.exe (PID: 6188)
      • reg.exe (PID: 2228)
      • reg.exe (PID: 1236)
      • reg.exe (PID: 5540)
      • reg.exe (PID: 6040)
      • reg.exe (PID: 4292)
      • reg.exe (PID: 5796)
      • reg.exe (PID: 1536)
      • reg.exe (PID: 6604)
      • reg.exe (PID: 1184)
      • reg.exe (PID: 376)
      • reg.exe (PID: 4160)
      • reg.exe (PID: 6936)
      • reg.exe (PID: 6288)
      • reg.exe (PID: 3984)
      • reg.exe (PID: 2396)
      • reg.exe (PID: 6480)
Find more information about signature artifacts and mapping to MITRE ATT&CKβ„’ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.2)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 3.22
CodeSize: 5884768
InitializedDataSize: 289700
UninitializedDataSize: 40952
EntryPoint: 0x3460
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.2.1.5
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug, Pre-release, Patched, Private build, Special build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: universal school app
CompanyName: universal school app
FileDescription: universal school app
FileVersion: 4.2.1.5
InternalName: universal school app
LegalCopyright: universal school app
LegalTrademarks: universal school app
OriginalFileName: universal school app
ProductName: universal school app
ProductVersion: 3
PrivateBuild: 2
SpecialBuild: 4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
256
Monitored processes
124
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT π—žπ— π—¦π—£π—œπ—–π—’.exe regsvr32.exe no specs regsvr32.exe werfault.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs findstr.exe no specs regsvr32.exe no specs reg.exe no specs find.exe no specs regsvr32.exe wmic.exe no specs find.exe no specs powershell.exe no specs find.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs findstr.exe no specs reg.exe no specs find.exe no specs wmic.exe no specs find.exe no specs powershell.exe no specs find.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs reg.exe no specs mode.com no specs reg.exe no specs reg.exe no specs findstr.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs choice.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs reg.exe no specs mode.com no specs reg.exe no specs reg.exe no specs findstr.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs find.exe no specs reg.exe no specs findstr.exe no specs find.exe no specs cmd.exe no specs choice.exe no specs π—žπ— π—¦π—£π—œπ—–π—’.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304findstr /i /r "project.*" C:\Windows\System32\findstr.exeβ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
376findstr /i /r "project.*" C:\Windows\System32\findstr.exeβ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
376reg query HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext C:\Windows\System32\reg.exeβ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
644findstr /i /v "project visio" C:\Windows\System32\findstr.exeβ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
888reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR C:\Windows\System32\reg.exeβ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
904C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2508 -s 732C:\Windows\SysWOW64\WerFault.exeβ€”regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1048findstr /i /r ".*volume" C:\Windows\System32\findstr.exeβ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1048C:\WINDOWS\system32\cmd.exe /c dir /b /ad C:\WINDOWS\System32\spp\tokens\skusC:\Windows\System32\cmd.exeβ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1104find /i "0x0" C:\Windows\System32\find.exeβ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1164find /i "Full" C:\Windows\System32\find.exeβ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
Total events
20Β 199
Read events
20Β 159
Write events
34
Delete events
6

Modification events

(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081
Operation:writeName:ProgramId
Value:
0000f519feec486de87ed73cb92d3cac802400000000
(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081
Operation:writeName:FileId
Value:
0000cb377e2ba78e131d7a1887c58c073e23d003454f
(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081
Operation:writeName:LowerCaseLongPath
Value:
c:\windows\syswow64\regsvr32.exe
(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081
Operation:writeName:LongPathHash
Value:
regsvr32.exe|8f2966bc37740081
(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081
Operation:writeName:Name
Value:
regsvr32.exe
(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081
Operation:writeName:OriginalFileName
Value:
regsvr32.exe
(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081
Operation:writeName:Publisher
Value:
microsoft corporation
(PID) Process:(904)Β WerFault.exeKey:\REGISTRY\A\{dd3871ca-5951-872f-6b84-953fa2ce2785}\Root\InventoryApplicationFile\regsvr32.exe|8f2966bc37740081
Operation:writeName:Version
Value:
10.0.19041.1 (winbuild.160101.0800)
Executable files
2
Suspicious files
6
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
6268π—žπ— π—¦π—£π—œπ—–π—’.exeC:\Users\admin\AppData\Local\Temp\963937.tmp β€”
MD5:β€”
SHA256:β€”
904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_regsvr32.exe_dcfebec5cacfe697149c8c5334526b1dab6d33_ce3feb90_9fe73ade-5a71-44bd-b907-6c6aa98a6bb7\Report.wer β€”
MD5:β€”
SHA256:β€”
6268π—žπ— π—¦π—£π—œπ—–π—’.exeC:\Users\admin\AppData\Local\Temp\965578.tmp β€”
MD5:β€”
SHA256:β€”
2468WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_regsvr32.exe_52c4d1b8eb5d1bfbc9a832b0a3dfcba115563_ce3feb90_5b58d4aa-1020-4c4e-9fdc-d082f92cb291\Report.wer β€”
MD5:β€”
SHA256:β€”
6268π—žπ— π—¦π—£π—œπ—–π—’.exeC:\Users\admin\AppData\Local\Temp\964140.tmptext
MD5:2066543D1C4B0648A58882AD2296F9AC
SHA256:8A3CCB0AC1C6ABE75EF5D0EEEFF03DE1027077D53086AFEE1E17C097F4DF7B73
904WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:3512933E31CC1C948D3657836DA53413
SHA256:4D63AD5AF667D3FFAED2C851C8E372A4DA21682A4EC7B68E27ABCE63CCBA14E5
904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBA74.tmp.xmlxml
MD5:9EE56A90A80C6F628DE1AB84E72EEA70
SHA256:F6C4ACA63815893BAA920D967358D4CD04AA822ED0642028BF4286AC7E52A3D8
6268π—žπ— π—¦π—£π—œπ—–π—’.exeC:\Users\admin\AppData\Local\Temp\964093.dllexecutable
MD5:EC1D3176604FEF69007926FE403428BB
SHA256:3DF3AB31CF95F300E4D45008CA2A3F960755B2000B2E80D0F562AACDAE206B5C
904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERB997.tmp.dmpbinary
MD5:EB9A18DC42E3C20965DAE05E02A76037
SHA256:C80DF4FB4E185D80CB195397E12E868E33E20FB5133A5FADE2F392FD1F6E0BFD
6268π—žπ— π—¦π—£π—œπ—–π—’.exeC:\Users\admin\AppData\Local\Temp\965765.dllexecutable
MD5:EC1D3176604FEF69007926FE403428BB
SHA256:3DF3AB31CF95F300E4D45008CA2A3F960755B2000B2E80D0F562AACDAE206B5C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
36
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
β€”
β€”
whitelisted
2616
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
β€”
β€”
whitelisted
2616
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
β€”
β€”
whitelisted
6600
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
β€”
β€”
whitelisted
6544
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
β€”
β€”
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
β€”
β€”
β€”
whitelisted
2536
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
β€”
β€”
β€”
whitelisted
2804
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
β€”
β€”
β€”
whitelisted
2536
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
2.23.209.140:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2616
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.bing.com
  • 2.23.209.140
  • 2.23.209.149
  • 2.23.209.189
  • 2.23.209.130
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.176
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.134
  • 40.126.32.138
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.140
  • 40.126.32.74
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
th.bing.com
  • 2.23.209.179
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.176
  • 2.23.209.185
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.189
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
Β© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
π—žπ— π—¦π—£π—œπ—–π—’.exe