File name:

2019-08-27-initial-Urnsif-binary.exe

Full analysis: https://app.any.run/tasks/42aab1f2-4b1a-43bc-8c33-885f5144eb12
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 05:53:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

4C6FCE7CB8E83EE5C7D10052E1B7D1FD

SHA1:

E6E271E587097DC689F2E9F63A62E664DB07AC0F

SHA256:

C4234865023F7C6DD8F5A8C3C2D73295C2F9119314F90AFEDA3B110548DB0810

SSDEEP:

6144:pZXOmeUyRncE9qgLU0nJcwbCfLqCpe837T62IwN2hQ9jYD4:pCxhcwJ1JcOCDw837GkN8ikD4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 6112)
      • iexplore.exe (PID: 7916)
      • iexplore.exe (PID: 5984)
      • iexplore.exe (PID: 5640)
      • iexplore.exe (PID: 4892)
      • iexplore.exe (PID: 7264)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 6112)
      • iexplore.exe (PID: 7916)
      • iexplore.exe (PID: 7264)
      • iexplore.exe (PID: 5984)
      • iexplore.exe (PID: 5640)
      • iexplore.exe (PID: 4892)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 6112)
      • iexplore.exe (PID: 7916)
      • iexplore.exe (PID: 5984)
      • iexplore.exe (PID: 4892)
      • iexplore.exe (PID: 7264)
      • iexplore.exe (PID: 5640)

  • INFO

    • The sample compiled with english language support

      • 2019-08-27-initial-Urnsif-binary.exe (PID: 7244)

    • Checks supported languages

      • 2019-08-27-initial-Urnsif-binary.exe (PID: 7244)
      • ielowutil.exe (PID: 4896)

    • Reads the computer name

      • ielowutil.exe (PID: 4896)
      • 2019-08-27-initial-Urnsif-binary.exe (PID: 7244)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 1228)

    • Reads the software policy settings

      • SIHClient.exe (PID: 6800)
      • slui.exe (PID: 7300)
      • slui.exe (PID: 7556)

    • Checks proxy server information

      • slui.exe (PID: 7556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:08:26 09:20:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 88576
InitializedDataSize: 170496
UninitializedDataSize: -
EntryPoint: 0x2e8e
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 6.1.49.95
ProductVersionNumber: 6.1.49.95
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unknown (04E0)
CompanyName: Give_seem
FileDescription: Weightcharacter Confio Software
FileVersion: 6.1.49.95
InternalName: Weightcharacter Confio Software
LegalCopyright: Band
OriginalFileName: peoplecorrect.exe
ProductName: Weightcharacter Confio Software
ProductVersion: 6.1.49.95
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
31
Malicious processes
6
Suspicious processes
6

Behavior graph

Click at the process to see the details
start 2019-08-27-initial-urnsif-binary.exe no specs sppextcomobj.exe no specs slui.exe sihclient.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe slui.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1088"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1196"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1228"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2096"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3828"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4692"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4736 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4736"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4892"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5044 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4896"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -EmbeddingC:\Program Files (x86)\Internet Explorer\ielowutil.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Low-Mic Utility Tool
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\ielowutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
50 672
Read events
50 370
Write events
252
Delete events
50

Modification events

(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Expires
Value:
2024-07-20 10:38:27
(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:LastModified
Value:
2001-01-01 00:00:00
(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:PotentialFailover
Value:
0
(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="utf-8"?><ServiceEnvironment ServiceID="522D76A4-93E1-47F8-B8CE-07C937AD1A1E" ID="DNSResiliency-CloudFlare-Live" Revision="1"><DNSConfigData><DNSconfigs elementVersion="1"><DNSconfig hostname="slscr.update.microsoft.com" pingtest="/sls/ping" domain=".update.microsoft.com" dnsserver="162.159.36.2"></DNSconfig><DNSconfig hostname="fe3cr.delivery.mp.microsoft.com" pingtest="/clientwebservice/ping" domain=".delivery.mp.microsoft.com" dnsserver="162.159.36.2"></DNSconfig></DNSconfigs><Flags elementVersion="1"><FeatureSwitchOn>1</FeatureSwitchOn><EnforceNRPTRule>0</EnforceNRPTRule><EnforceDomain>0</EnforceDomain><SkipDefaultDNSResolver>0</SkipDefaultDNSResolver></Flags></DNSConfigData></ServiceEnvironment>
(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:ETag
Value:
"XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\dns
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="utf-8"?><ServiceEnvironment ServiceID="522D76A4-93E1-47F8-B8CE-07C937AD1A1E" ID="DNSResiliency-CloudFlare-Live" Revision="1"><DNSConfigData><DNSconfigs elementVersion="1"><DNSconfig hostname="slscr.update.microsoft.com" pingtest="/sls/ping" domain=".update.microsoft.com" dnsserver="162.159.36.2"></DNSconfig><DNSconfig hostname="fe3cr.delivery.mp.microsoft.com" pingtest="/clientwebservice/ping" domain=".delivery.mp.microsoft.com" dnsserver="162.159.36.2"></DNSconfig></DNSconfigs><Flags elementVersion="1"><FeatureSwitchOn>1</FeatureSwitchOn><EnforceNRPTRule>0</EnforceNRPTRule><EnforceDomain>0</EnforceDomain><SkipDefaultDNSResolver>0</SkipDefaultDNSResolver></Flags></DNSConfigData></ServiceEnvironment>
(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Expires
Value:
2024-07-19 22:38:28
(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:LastModified
Value:
2001-01-01 00:00:00
(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:PotentialFailover
Value:
0
(PID) Process:(6800) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="UTF-8"?><ServiceEnvironment ServiceID="E7A50285-D08D-499D-9FF8-180FDC2332BC" ID="SIHProd" Revision="1"><WUClientData /><StoreClientData /><SIHClientData><Engine elementVersion="1" /><Actions elementVersion="1" /></SIHClientData></ServiceEnvironment>
Executable files
0
Suspicious files
50
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
6800SIHClient.exeC:\Windows\Logs\SIH\SIH.20250325.055336.564.1.etlbinary
MD5:0411BF145B9F04B31F45A9CC7394578D
SHA256:BD626BFD0CEE8A9F3E7DF137CD49ADEFBDF55C18154AA9266025A65E1C38C0EC
1088iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF7D5772249C8E2BAE.TMPbinary
MD5:2FA1F992AFFC38441446A6DF11EFF9C7
SHA256:3C1BF68C569A18B94D5E62D1730601467D4B525A3E184F495E1DA8F303BA22B9
1228iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFBB2D718BDDC88D5D.TMPbinary
MD5:6F23E6732072B17DCB8849A80A4F454F
SHA256:F5C3AD2CAAAD571477D45E5D13170A3BC047DDA596AA47E3DCE4426E3BDD5360
7624iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFB0F4897A226DC360.TMPbinary
MD5:FB233D0A134CCF68E49F020FFDF71467
SHA256:AA5BE859A2C6E12FED59BBD03475965280ED17A942F7ABEBAD8D11B3303295D9
1228iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{7FC90C60-093D-11F0-B4ED-18F7786F96EE}.datbinary
MD5:156A954BEBF701D2827CE8230A854D3A
SHA256:53E982F13DAC94C76A667D79B7D3D4E7609E63313BAF5DE337892F1FA03F3DAC
1228iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{7FC90C62-093D-11F0-B4ED-18F7786F96EE}.datbinary
MD5:045E24AF5D5933539B5479C1752EBFEC
SHA256:79BA18580FEA5ECB452CE11DA8769AF8FF3D13E38AA3221F7A6516397259CAAA
7624iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF7657399D9D39D3AE.TMPbinary
MD5:B2864AA723268FD9DA93F113D42DF2DF
SHA256:58D2450751C0793DEC2FF590222705E09EDDD4B873E5F43B7377DCFE56A6F550
7624iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{A5DB8ED5-093D-11F0-B4ED-18F7786F96EE}.datbinary
MD5:CB6F4396F958316776E3B13CB991C0E8
SHA256:B46642FA0E6C2172B85DF842D741853E4AEFB368CD2F8A684D7D24C84879BE91
7624iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{A5DB8ED3-093D-11F0-B4ED-18F7786F96EE}.datbinary
MD5:10CFA850768E0226B5FB8ECBCE540520
SHA256:202152F592A6D98997C8065B0899906748909ACC185BEA081265016378771331
8160iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF4B4B5F27FF91CB26.TMPbinary
MD5:C5A58D445FE3BDE040C1B11B763ACA84
SHA256:A2C3B915CF3338888CACC4F257F97D96CB4A4ED7BB376591CAEF5BBC2BF360AB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
82
DNS requests
30
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7264
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/CGd4yvp1vn2hIj/UxS2iya5NEWuZBMTEtkzT/PYhYPn4iIJ4iyem9/H0lx_2B7dj9dBfl/W3YeNOKZqeZY_2BS3X/17NveGIzh/Bl7oRUD_2BgY_2BRHfUz/O4UtwXBj9X3BR_2Bq9e/1xIgPEc8eJiOI9Taa5mMJ7/bCX8xi.avi
unknown
—
—
whitelisted
7816
iexplore.exe
GET
404
49.13.77.253:80
http://sizfjalenk51.com/images/qrXKT62OnMEMib_2FcR/PnMTvGk7RVSfimKw6tA0pE/dar0ydFDp3Uiq/ztyMUZE_/2BFjWMI5jME14renLet_2Fq/5RyYSpqOE3/hy2p98ge9ya0UeMCX/KMgYfTOb3BAu/aD3LckhqMhY/GEij6WBPYvdlTJ/DFyVqkC.avi
unknown
—
—
unknown
6112
iexplore.exe
GET
404
142.250.184.206:80
http://google.com/images/hYJsVs2_2FhMFu7RPEhDh/8w_2FGolYfJniK3P/4gntkt4u3djR9FA/dRTybAVDvrX21lx0Dp/88BOak8B8/3b7Fng9q7kkX3OVtS9NM/xsOhV_2Fqook9ORRjuf/5oE_2BIGwvf12Tx8SCWbJo/zdy3b_2Fr/hZfRRGkZgu/U.avi
unknown
—
—
whitelisted
7916
iexplore.exe
GET
404
49.13.77.253:80
http://v25brigittet.com/images/oAOmq9Y2jcxkXA/Sd_2F4nra_2BiOKK_2FHz/Omf82Z36_2BK3v1X/eb4zbg4PdlCmNKj/g8s7m9rmE_2B7PO3Zl/G0tpyKsBh/gzjWILqqdSr0r4VV77DY/1szGUDSdSgwXizwbuwo/AOdUuZk3k438dC95Ovn65o/OT2Jez.avi
unknown
—
—
malicious
5984
iexplore.exe
GET
404
49.13.77.253:80
http://k23ueugeniay.com/images/_2FscgdBtoQXLx1_2FXuf/JJAOwIxiwsV872Pp/l3pLqF6Jj187GcD/_2F7LSwRKdhI5vgr2z/CqSKbXX47/Ze69xnGu4AWoXKhuT18w/yPTFstHP30SYn9Et62_/2BVLKpz6Ba3TaMNnhMKTZs/JHLGg4GUXg79A/6kK_2Bq.avi
unknown
—
—
malicious
4892
iexplore.exe
GET
404
49.13.77.253:80
http://v25brigittet.com/images/cRoS74G_/2FkOqmYKnPRtVIJhP6qELv4/cexKmLxYSY/MZ3Ll223L56eoV5Pk/oQV4722OpkCt/3lMJUk8bsQ6/UFHa094lgwNwpy/XGcje8dj4s8fS2ME_2BNB/ARmvIh_2FLEZpV7E/i0_2BLoQDwK91Xy/957uwSvkF3y8Q3r_2F/G2pdcQcD6/KALBUAf.avi
unknown
—
—
malicious
6972
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/j1Rvp5R0NZFst/IbDC5gMF/PGvh4XCp_2BE8q7L2Cvgy9c/NGb179idUn/cSuzABAxSkHQEp6vT/xvSDcVa28PYo/hxN2IzRA6yw/uahRD_2F1sINoG/pbBFvBRRnq55dp8lVE92h/ZyfOJo2f2tgMBSQZ/PWJdUFz9AaAhH_2/Bdrr7yT7Bi/WhQPl9o.avi
unknown
—
—
whitelisted
6228
iexplore.exe
GET
404
49.13.77.253:80
http://k23ueugeniay.com/images/SXUOVNaZ_2Fy/NJe9FRKCUeO/Q4T8IkKUb2uZDi/HHnuemie13dOLwrbvKQC1/LPTRv7AgmQMMBnnu/Gj324OV4HHRAn1y/bTE9QLdmx8LMoAXbL4/WSLiEgIhC/dg2ppgKPl34gsa4_2Bzp/eD9m3zYx1AP/Z802PQE.avi
unknown
—
—
malicious
8136
iexplore.exe
GET
404
49.13.77.253:80
http://sizfjalenk51.com/images/Q_2FVGYY2zhLL1v/qrbjIG33fLA3Bbd7G_/2FENspffe/Io2m4aUqGDs7opIzf7qf/NKvp2Sx5_2BcmLM4HOt/a4AadkgclpAivzTVvvoplk/LdmNFVIVVF258/oj2CSntC/7gJzoUhe6xZdPQIeW55XBH_/2F2jnT4j/OI4.avi
unknown
—
—
unknown
5640
iexplore.exe
GET
404
49.13.77.253:80
http://sizfjalenk51.com/images/hBPD3UpNVM/fM5HYd0gwMegEse66/uCL2pk2lMqsZ/jX9feaYkVO5/z4FJQjuxnI_2Bv/B5ammZ65SzBrBK_2BtOJ7/1_2B_2BG6h6PbAgy/WHptPI6ktIgTAvp/lReG_2F7EKagCmH5vZ/agZea1dY_/2FWgWozRdaNLn/A9Tlkd.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7588
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6800
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6800
SIHClient.exe
13.95.31.18:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.206
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.71
  • 20.190.159.129
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.128
  • 40.126.31.69
  • 20.190.159.131
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2603:1030:c02:2::284
whitelisted
18.31.95.13.in-addr.arpa
  • —
unknown
4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
iecvlist.microsoft.com
  • 52.239.160.33
whitelisted

Threats

PID
Process
Class
Message
6112
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
7916
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7264
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5640
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4892
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5984
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-08-27-initial-Urnsif-binary.exe