File name:

retrac fixer (3).zip

Full analysis: https://app.any.run/tasks/e4bd49f0-83b5-480b-8a1d-71157429adb7
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 30, 2026, 03:18:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
fileshare
evasion
anti-evasion
stealer
telegram
arch-doc
pyinstaller
openssl
tool
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

8D48F72C0CD6CF3AAAE37389EC567601

SHA1:

BC69D5044005E5C37F1572191C4954B973FE295F

SHA256:

C2BECEC5E5D3D8C54CE11634CE880B1C375B342CB078F0E41C7EBF878D30D985

SSDEEP:

98304:SnmalD6bnqAx+0+F99Ns88yU/wHI6LMmJrvi6QohaEvX1WhvZZ1A2OKWdWa97N5B:bkbM7OLT9EO6630fPqjkqbz6JSwQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 3120)

    • Steals credentials from Web Browsers

      • setup.exe (PID: 6732)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • ApVkGkWqB (PID: 4284)
      • Setup.exe (PID: 3120)

    • Starts a Microsoft application from unusual location

      • Setup.exe (PID: 3120)

    • The process drops C-runtime libraries

      • ApVkGkWqB (PID: 4284)
      • setup.exe (PID: 8096)

    • Process drops python dynamic module

      • ApVkGkWqB (PID: 4284)
      • setup.exe (PID: 8096)

    • Application launched itself

      • ApVkGkWqB (PID: 4284)
      • setup.exe (PID: 8096)

    • Loads Python modules

      • ApVkGkWqB (PID: 4304)
      • setup.exe (PID: 6732)

    • OpenSSL has been detected (YARA)

      • ApVkGkWqB (PID: 4304)

    • Executable content was dropped or overwritten

      • setup.exe (PID: 8096)
      • ApVkGkWqB (PID: 4304)
      • ApVkGkWqB (PID: 4284)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 4916)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 1772)
      • cmd.exe (PID: 5412)
      • cmd.exe (PID: 4916)
      • cmd.exe (PID: 6672)
      • cmd.exe (PID: 8008)

    • Reads the date of Windows installation

      • ApVkGkWqB (PID: 4304)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 5412)
      • cmd.exe (PID: 6672)

    • Checks for external IP

      • svchost.exe (PID: 2232)
      • setup.exe (PID: 6732)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 7728)
      • WMIC.exe (PID: 2680)

    • Uses TASKKILL.EXE to kill Browsers

      • setup.exe (PID: 6732)

    • Uses TASKKILL.EXE to kill process

      • setup.exe (PID: 6732)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 8104)

  • INFO

    • Checks supported languages

      • Setup.exe (PID: 3120)
      • ApVkGkWqB (PID: 4304)
      • ApVkGkWqB (PID: 4284)
      • setup.exe (PID: 8096)
      • setup.exe (PID: 6732)

    • Create files in a temporary directory

      • ApVkGkWqB (PID: 4284)
      • setup.exe (PID: 8096)
      • setup.exe (PID: 6732)
      • ApVkGkWqB (PID: 4304)

    • PyInstaller has been detected (YARA)

      • ApVkGkWqB (PID: 4304)
      • ApVkGkWqB (PID: 4284)

    • There is functionality for taking screenshot (YARA)

      • ApVkGkWqB (PID: 4304)
      • ApVkGkWqB (PID: 4284)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5448)

    • Manual execution by a user

      • Setup.exe (PID: 3120)

    • Reads the computer name

      • Setup.exe (PID: 3120)
      • ApVkGkWqB (PID: 4304)
      • setup.exe (PID: 8096)
      • setup.exe (PID: 6732)
      • ApVkGkWqB (PID: 4284)

    • The sample compiled with english language support

      • ApVkGkWqB (PID: 4284)
      • setup.exe (PID: 8096)
      • WinRAR.exe (PID: 5448)

    • Attempting to use file storage service

      • ApVkGkWqB (PID: 4304)

    • Reads security settings of Internet Explorer

      • ApVkGkWqB (PID: 4304)
      • WMIC.exe (PID: 2680)
      • WMIC.exe (PID: 7728)
      • WMIC.exe (PID: 8104)

    • Process checks computer location settings

      • ApVkGkWqB (PID: 4304)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2232)
      • setup.exe (PID: 6732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2023:10:26 03:16:26
ZipCRC: 0x334ed36e
ZipCompressedSize: 58403
ZipUncompressedSize: 119376
ZipFileName: vcruntime140.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
46
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe setup.exe no specs apvkgkwqb apvkgkwqb setup.exe no specs setup.exe no specs setup.exe setup.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs svchost.exe reg.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Users\admin\AppData\Local\Temp\MicrosoftStoreUWP\setup.exe" C:\Users\admin\AppData\Local\Temp\MicrosoftStoreUWP\setup.exe—ApVkGkWqB
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\microsoftstoreuwp\setup.exe
c:\windows\system32\ntdll.dll
1152REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1176\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1312taskkill /F /IM opera.exeC:\Windows\System32\taskkill.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1772C:\WINDOWS\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"C:\Windows\System32\cmd.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1772\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2232C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2332taskkill /F /IM chrome.exeC:\Windows\System32\taskkill.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2340\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 661
Read events
7 652
Write events
9
Delete events
0

Modification events

(PID) Process:(5448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\retrac fixer (3).zip
(PID) Process:(5448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:(5448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
195
Suspicious files
6
Text files
35
Unknown types
0

Dropped files

PID
Process
Filename
Type
5448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb5448.28027\auth\ApVkGkWqB —
MD5:—
SHA256:—
4284ApVkGkWqBC:\Users\admin\AppData\Local\Temp\_MEI42842\_hashlib.pydexecutable
MD5:3C7F5536FD531F5115738CAD734BA92D
SHA256:D4524B261F09806A828C62FC97E8517328B23D65AB87D20706A4BAFD86BBF345
4284ApVkGkWqBC:\Users\admin\AppData\Local\Temp\_MEI42842\_lzma.pydexecutable
MD5:1DFAF924B4576F551F6DFE3CAE50B230
SHA256:F7AD11FBBB7AEAF7B6566A532A3243E3AE5F92BAC480DBE5C2EF300FE2C1DABE
4284ApVkGkWqBC:\Users\admin\AppData\Local\Temp\_MEI42842\_ssl.pydexecutable
MD5:D900BF186DC66F71D07808EEAE323C17
SHA256:43E60BBDFF2FE41701F39FA25EA6A8251A2B7623FF18F980A209A451EB5E648F
4284ApVkGkWqBC:\Users\admin\AppData\Local\Temp\_MEI42842\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:B513FD176EE9A5FA4ED96BFA8681EC4E
SHA256:C5DC0DF2FCC456C2B08392EA7D539D43549D04D14ED83D69CD46F79B9E34902A
4284ApVkGkWqBC:\Users\admin\AppData\Local\Temp\_MEI42842\api-ms-win-core-handle-l1-1-0.dllexecutable
MD5:25EDBBC33347A1425EE23A1D7A6CB4EC
SHA256:94F7611FA4568F4577DEBA250C1254A3C83FFC7B4FD2F00243F3BFAC5A993FD8
4284ApVkGkWqBC:\Users\admin\AppData\Local\Temp\_MEI42842\api-ms-win-core-interlocked-l1-1-0.dllexecutable
MD5:4F3772ED964E993F0DBBEF152621D6E7
SHA256:69B0F1E099DAC7FFBBF1260EB4818ABEACD2B9CF105B742B16E6BD5DDA3BF035
4284ApVkGkWqBC:\Users\admin\AppData\Local\Temp\_MEI42842\api-ms-win-core-localization-l1-2-0.dllexecutable
MD5:BFDCE1F7BD47A57C0E87582B56FEB2D0
SHA256:79EC668286CB900C66E1CAF8A47309D986C9DC4D37A5D2DCEDB2FF2A973896D9
5448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb5448.28027\vcruntime140.dllexecutable
MD5:699DD61122D91E80ABDFCC396CE0EC10
SHA256:F843CD00D9AFF9A902DD7C98D6137639A10BD84904D81A085C28A3B29F8223C1
5448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb5448.28027\Setup.exeexecutable
MD5:42FE4A56C232D4F65BFA7AD9EAB99812
SHA256:66A1F6CCC9F869945BEC8149F1AF5CE5BB587D3D25C8008CFDC0BF3C0CEBF9C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
49
TCP/UDP connections
39
DNS requests
31
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
5316
svchost.exe
POST
400
20.190.159.128:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/FlightSettings/FSService?ProcessorClockSpeed=3094&IsRetailOS=1&OEMManufacturerName=DELL&FlightingPolicyValue=3&EnablePreviewBuilds=4294967295&OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&ManagePreviewBuilds=3&BranchReadinessLevelSource=0&AttrDataVer=186&ProcessorCores=6&BranchReadinessLevelRaw=16&TotalPhysicalRAM=6144&TPMVersion=0&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&DeviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&App=FSS&AppVer=10.0&SmartActiveHoursState=1&ActiveHoursStart=20&SecureBootCapable=0&ActiveHoursEnd=13&DeviceFamily=Windows.Desktop
US
text
87.3 Kb
whitelisted
6208
SIHClient.exe
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
6208
SIHClient.exe
GET
200
135.232.92.97:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
6208
SIHClient.exe
GET
200
20.165.94.63:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
6208
SIHClient.exe
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
922 b
whitelisted
5392
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
text
7.04 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5392
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5532
SearchApp.exe
184.86.251.22:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
23.11.40.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3428
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
www.bing.com
  • 184.86.251.22
  • 184.86.251.9
  • 184.86.251.7
whitelisted
ocsp.digicert.com
  • 23.11.40.157
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
google.com
  • 142.250.154.102
  • 142.250.154.101
  • 142.250.154.100
  • 142.250.154.139
  • 142.250.154.138
  • 142.250.154.113
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.69
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.23
  • 40.126.31.3
  • 20.190.159.130
  • 20.190.159.131
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted

Threats

PID
Process
Class
Message
5392
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
4304
ApVkGkWqB
Potentially Bad Traffic
ET INFO Observed File Sharing Service Download Domain (files .catbox .moe in TLS SNI)
4304
ApVkGkWqB
Not Suspicious Traffic
INFO [ANY.RUN] Downloading from a file sharing service is observed
2232
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2232
svchost.exe
Misc activity
INFO [ANY.RUN] External IP Check (ip-api .com)
2232
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6732
setup.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
6732
setup.exe
Potentially Bad Traffic
ET INFO Observed File Sharing Service Download Domain (files .catbox .moe in TLS SNI)
2232
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
2232
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
retrac fixer (3).zip