File name:

MDE_File_Sample_bc2db72e771ecffb29e5cf80108e09207987dfe7.zip

Full analysis: https://app.any.run/tasks/ac3adab7-745a-4989-9472-6d2e67c51aa3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 28, 2025, 14:35:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
arch-exec
arch-doc
loader
qrcode
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

B17ECB8CDCB5E60CAF54343673C340A9

SHA1:

171F492E67072AB2EEED89F8A4C318248D7DCDCE

SHA256:

C0717C365766C5FE4416A92ACE055798F9C282E5683C4FEBA7454B6636482767

SSDEEP:

98304:QYrcmdImrwmPqWAGp76XFIauy6zwWE8M7wSUkf+L6WXO0Ed5OQ+tiMKufsszhL5z:1nu5F5pk1XCkYeIXJrYfOhSBRZF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes Windows Defender settings

      • proxy.exe (PID: 6656)

    • Adds path to the Windows Defender exclusion list

      • proxy.exe (PID: 6656)

    • Registers / Runs the DLL via REGSVR32.EXE

      • CapableClear.exe (PID: 2244)

    • Actions looks like stealing of personal data

      • GDutilit.exe (PID: 2776)

  • SUSPICIOUS

    • Searches for installed software

      • proxy.exe (PID: 6656)
      • CapableService.exe (PID: 6760)
      • About.exe (PID: 6944)
      • Capable.exe (PID: 4920)
      • About.exe (PID: 1660)
      • About.exe (PID: 6108)
      • Capable.exe (PID: 3032)
      • CapableGamebox.exe (PID: 5132)
      • CapableClear.exe (PID: 2244)
      • CapableWall.exe (PID: 4380)
      • CapableClearSer.exe (PID: 2664)
      • CapableGameBoxSer.exe (PID: 7144)
      • CapableWallSer.exe (PID: 3364)
      • About.exe (PID: 4016)
      • GDutilit.exe (PID: 2776)
      • About.exe (PID: 5936)
      • BKUt.exe (PID: 6268)

    • Starts POWERSHELL.EXE for commands execution

      • proxy.exe (PID: 6656)

    • Script adds exclusion path to Windows Defender

      • proxy.exe (PID: 6656)

    • Executable content was dropped or overwritten

      • proxy.exe (PID: 6656)
      • Capable.exe (PID: 3032)
      • Capable.exe (PID: 4896)

    • Creates/Modifies COM task schedule object

      • proxy.exe (PID: 6656)
      • regsvr32.exe (PID: 2896)
      • GDutilit.exe (PID: 2776)
      • BKUt.exe (PID: 6268)

    • Reads security settings of Internet Explorer

      • proxy.exe (PID: 6656)
      • CapableService.exe (PID: 6760)
      • About.exe (PID: 6944)
      • Capable.exe (PID: 4920)
      • About.exe (PID: 6108)
      • Capable.exe (PID: 3032)
      • CapableWallSer.exe (PID: 3364)
      • CapableGameBoxSer.exe (PID: 7144)
      • About.exe (PID: 1660)
      • CapableClear.exe (PID: 2244)
      • About.exe (PID: 5936)

    • Creates a software uninstall entry

      • proxy.exe (PID: 6656)

    • Executes as Windows Service

      • CapableService.exe (PID: 6760)
      • CapableClearSer.exe (PID: 2664)
      • CapableWallSer.exe (PID: 3364)
      • CapableGameBoxSer.exe (PID: 7144)
      • GDSevicat.exe (PID: 5528)
      • BKSvc.exe (PID: 6824)

    • Application launched itself

      • About.exe (PID: 6944)
      • Capable.exe (PID: 4920)
      • About.exe (PID: 1660)
      • About.exe (PID: 6108)
      • EnginView.exe (PID: 5044)

    • There is functionality for taking screenshot (YARA)

      • About.exe (PID: 6108)
      • About.exe (PID: 5936)
      • EnginView.exe (PID: 5044)
      • EnginView.exe (PID: 728)

    • The process creates files with name similar to system file names

      • Capable.exe (PID: 3032)

    • Process drops legitimate windows executable

      • Capable.exe (PID: 4896)

    • Process requests binary or script from the Internet

      • EnginView.exe (PID: 6876)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 900)

    • Manual execution by a user

      • proxy.exe (PID: 1660)
      • proxy.exe (PID: 6656)
      • Capable.exe (PID: 2896)
      • Capable.exe (PID: 4896)

    • Checks supported languages

      • proxy.exe (PID: 6656)
      • CapableService.exe (PID: 6760)
      • About.exe (PID: 6944)
      • About.exe (PID: 1660)
      • About.exe (PID: 6108)
      • Capable.exe (PID: 4920)
      • CapableClear.exe (PID: 2244)
      • Capable.exe (PID: 3032)
      • CapableGamebox.exe (PID: 5132)
      • CapableWall.exe (PID: 4380)
      • CapableClearSer.exe (PID: 2664)
      • CapableWallSer.exe (PID: 3364)
      • CapableGameBoxSer.exe (PID: 7144)
      • About.exe (PID: 4016)
      • GDutilit.exe (PID: 2776)
      • About.exe (PID: 5936)
      • BKUt.exe (PID: 6268)

    • Reads the computer name

      • proxy.exe (PID: 6656)
      • CapableService.exe (PID: 6760)
      • About.exe (PID: 6944)
      • About.exe (PID: 1660)
      • Capable.exe (PID: 4920)
      • About.exe (PID: 6108)
      • Capable.exe (PID: 3032)
      • CapableClear.exe (PID: 2244)
      • CapableWall.exe (PID: 4380)
      • CapableGamebox.exe (PID: 5132)
      • CapableWallSer.exe (PID: 3364)
      • CapableGameBoxSer.exe (PID: 7144)
      • CapableClearSer.exe (PID: 2664)
      • About.exe (PID: 4016)
      • GDutilit.exe (PID: 2776)
      • About.exe (PID: 5936)
      • BKUt.exe (PID: 6268)

    • The sample compiled with chinese language support

      • WinRAR.exe (PID: 900)
      • proxy.exe (PID: 6656)
      • Capable.exe (PID: 3032)

    • Creates files or folders in the user directory

      • proxy.exe (PID: 6656)
      • CapableService.exe (PID: 6760)
      • CapableGameBoxSer.exe (PID: 7144)
      • About.exe (PID: 6108)
      • CapableClearSer.exe (PID: 2664)
      • CapableWallSer.exe (PID: 3364)
      • Capable.exe (PID: 3032)
      • GDutilit.exe (PID: 2776)
      • About.exe (PID: 5936)
      • BKUt.exe (PID: 6268)

    • Reads the software policy settings

      • slui.exe (PID: 5800)
      • slui.exe (PID: 3008)

    • Process checks computer location settings

      • proxy.exe (PID: 6656)
      • About.exe (PID: 6944)
      • Capable.exe (PID: 4920)
      • About.exe (PID: 1660)
      • CapableClear.exe (PID: 2244)
      • About.exe (PID: 6108)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2040)

    • Reads the machine GUID from the registry

      • proxy.exe (PID: 6656)
      • GDutilit.exe (PID: 2776)
      • BKUt.exe (PID: 6268)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2040)

    • The sample compiled with english language support

      • Capable.exe (PID: 3032)
      • Capable.exe (PID: 4896)

    • Creates files in the program directory

      • GDutilit.exe (PID: 2776)
      • BKUt.exe (PID: 6268)

    • Create files in a temporary directory

      • GDutilit.exe (PID: 2776)
      • Capable.exe (PID: 3032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2025:04:28 14:31:34
ZipCRC: 0x41dc1494
ZipCompressedSize: 16142097
ZipUncompressedSize: 17945384
ZipFileName: bc2db72e771ecffb29e5cf80108e09207987dfe7
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
178
Monitored processes
41
Malicious processes
3
Suspicious processes
9

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe proxy.exe no specs proxy.exe slui.exe powershell.exe no specs conhost.exe no specs capableservice.exe about.exe no specs about.exe no specs capable.exe no specs about.exe capable.exe capableclear.exe no specs capablewall.exe no specs capablegamebox.exe no specs capableclearser.exe capablegameboxser.exe capablewallser.exe about.exe no specs regsvr32.exe no specs regsvr32.exe no specs gdutilit.exe about.exe rundll32.exe no specs bkut.exe capable.exe no specs capable.exe about.exe enginview.exe no specs enginview.exe no specs enginview.exe enginview.exe no specs enginview.exe no specs gdsevicat.exe gdutilit.exe no specs bksvc.exe bkut.exe no specs bkut.exe no specs bkut.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728"C:\Users\admin\Desktop\CapableWin\Render\EnginView.exe" --type=renderer --no-sandbox --log-file="C:\Users\admin\Desktop\CapableWin\Render\debug.log" --field-trial-handle=1712,5568859909453119225,8938829250214944421,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=zh-CN --log-file="C:\Users\admin\Desktop\CapableWin\Render\debug.log" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2356 /prefetch:1C:\Users\admin\Desktop\CapableWin\Render\EnginView.exe—EnginView.exe
User:
admin
Integrity Level:
HIGH
Description:
Chromium Embedded Framework (CEF) Client Application
Version:
88.2.9+g5c8711a+chromium-88.0.4324.182
Modules
Images
c:\users\admin\desktop\capablewin\render\enginview.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
744C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
900"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\MDE_File_Sample_bc2db72e771ecffb29e5cf80108e09207987dfe7.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1128"C:\Users\admin\Desktop\CapableWin\About.exe" -yjlcme=oxBAvHuD9uPmV74ARcy9kQ==C:\Users\admin\Desktop\CapableWin\About.exe
Capable.exe
User:
admin
Company:
北京华网智讯软件有限公司
Integrity Level:
HIGH
Description:
About.exe
Exit code:
0
Version:
6.1.2.250407
Modules
Images
c:\users\admin\desktop\capablewin\about.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1660"C:\Users\admin\Desktop\proxy.exe" C:\Users\admin\Desktop\proxy.exe—explorer.exe
User:
admin
Company:
北京华网智讯软件有限公司
Integrity Level:
MEDIUM
Description:
全能电脑助手
Exit code:
3221226540
Version:
6.1.2.250407
Modules
Images
c:\users\admin\desktop\proxy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1660"C:\Users\admin\Desktop\CapableWin\About.exe" -yjlcme=NrMQK+qazFnwowQaJEMyMQ==C:\Users\admin\Desktop\CapableWin\About.exe—proxy.exe
User:
admin
Company:
北京华网智讯软件有限公司
Integrity Level:
HIGH
Description:
About.exe
Exit code:
0
Version:
6.1.2.250407
Modules
Images
c:\users\admin\desktop\capablewin\about.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2040"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\Users\admin\Desktop\CapableWin"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—proxy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2244"C:\Users\admin\Desktop\CapableWin\Tools\Capable-Clear\CapableClear.exe" -bboyge=zOZTYFWppW9/+twjoaBilw==C:\Users\admin\Desktop\CapableWin\Tools\Capable-Clear\CapableClear.exe—Capable.exe
User:
admin
Company:
北京华网智讯软件有限公司
Integrity Level:
HIGH
Description:
CapableClear.exe
Exit code:
0
Version:
6.1.2.250407
Modules
Images
c:\users\admin\desktop\capablewin\tools\capable-clear\capableclear.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2664C:\Users\admin\Desktop\CapableWin\Tools\Capable-Clear\CapableClearSer.exe -jqjtsuC:\Users\admin\Desktop\CapableWin\Tools\Capable-Clear\CapableClearSer.exe
services.exe
User:
SYSTEM
Company:
北京华网智讯软件有限公司
Integrity Level:
SYSTEM
Description:
CapableService.exe
Version:
6.1.2.250407
Modules
Images
c:\users\admin\desktop\capablewin\tools\capable-clear\capableclearser.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
21 785
Read events
20 046
Write events
1 714
Delete events
25

Modification events

(PID) Process:(900) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(900) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(900) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(900) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\MDE_File_Sample_bc2db72e771ecffb29e5cf80108e09207987dfe7.zip
(PID) Process:(900) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(900) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(900) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(900) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(900) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6656) proxy.exeKey:HKEY_CURRENT_USER\SOFTWARE\CapableWin\mkey
Operation:writeName:wsjevs
Value:
0
Executable files
64
Suspicious files
82
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
6656proxy.exeC:\Users\admin\Desktop\CapableWin\CapableMenu.dllexecutable
MD5:BEFF34350ED8379F3967D7465D48F752
SHA256:B8AC07C291BFFE3EAD2011354280FD426D9875FD78F3CE77C6F67417B72E940A
6656proxy.exeC:\Users\admin\Desktop\CapableWin\Capable.exeexecutable
MD5:7DE3B59B5E517A7039C81D7DB61C0E07
SHA256:2D2DF0C0F2F10CD2168A6840EFED4DE133C974D35E66E1E174EDA3407025976F
900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb900.28247\bc2db72e771ecffb29e5cf80108e09207987dfe7executable
MD5:D6DC2577E719FCA551866410CCD2B74D
SHA256:4C63D9E2697D2189F4DE72CB0B7964B734172F6EBE8DDEDF0EAE2A395696F4ED
6656proxy.exeC:\Users\admin\Desktop\CapableWin\CapableLogin.dllexecutable
MD5:9FAECC2D6B2E4682187D0634E1144099
SHA256:34EE8868F56949DFD49BFA42EB1AB10ADB85C269B8C60F020F9F74946F803209
6656proxy.exeC:\Users\admin\Desktop\CapableWin\Capable.dllexecutable
MD5:1BEE7FAC43DBA2F15B016C048162B687
SHA256:427CD27AB4B2ECA3669EDB31CCE7B10F2EBF92CC41C48BF67B1C6BA7343ECAB9
6656proxy.exeC:\Users\admin\Desktop\CapableWin\Tools\Capable-AdWall\CapableWallSer.exeexecutable
MD5:4D98644B56A09B6344486460CC9A4D49
SHA256:75BAEBF9B23B30505805E7042A74CB4E41F37E37208B1E5D64D4BE4DD68DD25E
6656proxy.exeC:\Users\admin\Desktop\CapableWin\CapableMenu64.dllexecutable
MD5:9E3A8A8D92FD15E05B1DE58A80197C90
SHA256:36FC857896AAABD79D519731D20058CC9294A37B15A90A434EEB82146FAA3DB5
6656proxy.exeC:\Users\admin\Desktop\CapableWin\CapableTools.dllexecutable
MD5:421F5127BAEA39624F85B6A3B3EE1AA5
SHA256:3AC9F480D645AAA4A0802927E30DB1651FE1BDBEA3184D5A5F304C7B9CC0D8D0
6656proxy.exeC:\Users\admin\Desktop\CapableWin\CapableUtils.dllexecutable
MD5:B223C4A15783080A97A92B5504D6F007
SHA256:C70E845B90BDDED4CD176039831AA3FFBE658A17490E137055F83A649E2755BE
6656proxy.exeC:\Users\admin\Desktop\CapableWin\CapableService.exeexecutable
MD5:BF48D726F5029F767F7D791E28994219
SHA256:BE96DBCA9AF2B9E3560FAB7B9553170EACD5444C6078045477C75E08B54E452D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
102
TCP/UDP connections
93
DNS requests
44
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4560
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6656
proxy.exe
GET
200
106.14.92.120:80
http://jto.newtab123.com/dvi0vp/?d=g1zgC9Cq42ZGnz0hJfHgt/Uk00jZFdJ+CRWI4xJZVmON9Jo+nLdZk0FToYL8IEX9NB5Yv04jpdEV2DbOjIqny2n93m75Eyo/UeGb0Cv5fC4rL3l60fjLQSAK1sUquwPatdfZOJLH3c/nihg8q+pLhXEoyNswwucyJvOdorXQPYxIo8da8cS223OU42w8jrpufIv8+oAczHI2JygV1RjkDBjEchiC0gnD2b0A0UJ8DJ9TZjvD9rUz8cxxy1cB5zDa&_=1745850995
unknown
—
—
unknown
6656
proxy.exe
GET
200
106.14.92.120:80
http://jto.newtab123.com/dvi0vp/?d=g1zgC9Cq42ZGnz0hJfHgt83HCVf6BkOkepqcC61UmfiYVdK8LiZiR17p89/ehu0vUuO8bBS79WxLnzQdjfQgR1DcsaaUE/9hdI3YDNGbVW6IJsYJ6RrmvX8PpJ4IgXtOOTohVRnI8lEPLs/HWs6+9jEi2DKkci3+sP/TT2CFQXgWts9QL9i6YXyG6fEeA4l9OK/qD4K1jCEBuJahYpyTp0cvW6g1kUONnuK8g2N03Ke4cCsmxEtmnRkdS8Zay16LpdWGxLri/HhxV8cq5DiJe0ll5HOL+wBCkBoSVIS5IP4=&_=1745850996
unknown
—
—
unknown
4560
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6656
proxy.exe
GET
200
168.235.193.213:80
http://ott.newtab123.com/dvi0vp/cp/p/?p=b0FL9fZkGvdhJLphXdsUqw==&_=1745850996
unknown
—
—
unknown
6656
proxy.exe
GET
200
106.14.92.120:80
http://jto.newtab123.com/dvi0vp/?d=g1zgC9Cq42ZGnz0hJfHgt83HCVf6BkOkepqcC61UmfiYVdK8LiZiR17p89/ehu0vUuO8bBS79WxLnzQdjfQgR1DcsaaUE/9hdI3YDNGbVW6IJsYJ6RrmvX8PpJ4IgXtOl/owJ3bp2pleEIuDcV7BZO+33SNd2PtoA4+3e1S3Ri/4n1i9otUWYFW0mgGaLTTON9CCwz1za+FmaBpqTp9P0kT/Yhojfp7G38uhUGG5hAL2g/fLFMDKfGjmnQrrpsDccAiyH8r5AbG5kjJ/YdbzN4nPNGvbSGB6xAXWaSN9F/dMSXr7PzwwsH47LB/DUvAD&_=1745851056
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.73
  • 20.190.159.0
  • 40.126.31.128
  • 40.126.31.3
  • 40.126.31.130
  • 20.190.159.64
  • 20.190.159.131
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
jto.newtab123.com
  • 106.14.92.120
unknown

Threats

No threats detected
Process
Message
GDSevicat.exe
GDSevicat.exe
CheckRegSZValue false -
GDSevicat.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zipx\UserChoice
GDSevicat.exe
CheckRegSZValue false -
GDSevicat.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\UserChoice
GDSevicat.exe
GDSevicat.exe
GDSevicat.exe
CheckRegSZValue false -
GDSevicat.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\UserChoice
GDSevicat.exe
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MDE_File_Sample_bc2db72e771ecffb29e5cf80108e09207987dfe7.zip