File name:

win2.exe

Full analysis: https://app.any.run/tasks/12e8d7af-b3a7-481c-b0b7-ad3a3f74cbdf
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: August 15, 2024, 00:39:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
metasploit
backdoor
meterpreter
payload
mimikatz
tools
cobaltstrike
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

72B7CA848CC99D30FF880AD47DCFFA19

SHA1:

41738E61E33AF1CCB79CF66FCA7B309CD6FC3993

SHA256:

C68B0EC86FA68091C62EF8543E134B634107097A9E8F43B6C0D69ED1E385EF7B

SSDEEP:

1536:bFGzZN4QyuJPh1n8RfQJ/BEq/K+ypMb+KR0Nc8QsMqUR:xGVPywPf8R4JZEq/Kte0Nc8Qs6R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • METASPLOIT has been detected (SURICATA)

      • win2.exe (PID: 6880)

    • METERPRETER has been detected (SURICATA)

      • win2.exe (PID: 6880)

    • Payload loading activity detected

      • win2.exe (PID: 6880)

    • METASPLOIT has been detected (YARA)

      • win2.exe (PID: 6880)

    • MIMIKATZ has been detected (YARA)

      • win2.exe (PID: 6880)

    • COBALTSTRIKE has been detected (YARA)

      • artifact_x64.exe (PID: 2340)
      • artifact_x64.exe (PID: 6976)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • win2.exe (PID: 6880)

    • Connects to unusual port

      • win2.exe (PID: 6880)

    • Reads security settings of Internet Explorer

      • artifact_x64.exe (PID: 6976)
      • artifact_x64.exe (PID: 2340)

    • Executes application which crashes

      • artifact_x64.exe (PID: 2340)
      • artifact_x64.exe (PID: 6976)

  • INFO

    • Checks supported languages

      • win2.exe (PID: 6880)
      • artifact_x64.exe (PID: 6976)
      • artifact_x64.exe (PID: 2340)

    • Reads the computer name

      • win2.exe (PID: 6880)
      • artifact_x64.exe (PID: 6976)
      • artifact_x64.exe (PID: 2340)

    • Reads the machine GUID from the registry

      • win2.exe (PID: 6880)

    • Checks proxy server information

      • artifact_x64.exe (PID: 6976)
      • artifact_x64.exe (PID: 2340)
      • WerFault.exe (PID: 2928)
      • WerFault.exe (PID: 6268)

    • Manual execution by a user

      • artifact_x64.exe (PID: 6976)
      • artifact_x64.exe (PID: 2340)

    • Reads the software policy settings

      • WerFault.exe (PID: 2928)
      • WerFault.exe (PID: 6268)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 2928)
      • WerFault.exe (PID: 6268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

CobalStrike

(PID) Process(6976) artifact_x64.exe
C2127.0.0.1:80/fl6U
HeadersUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
(PID) Process(2340) artifact_x64.exe
C2127.0.0.1:80/fl6U
HeadersUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:03:26 14:22:10+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 45056
InitializedDataSize: 40960
UninitializedDataSize: -
EntryPoint: 0x17aa
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.2.14.0
ProductVersionNumber: 2.2.14.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
CompanyName: Apache Software Foundation
FileDescription: ApacheBench command line utility
FileVersion: 2.2.14
InternalName: ab.exe
LegalCopyright: Copyright 2009 The Apache Software Foundation.
OriginalFileName: ab.exe
ProductName: Apache HTTP Server
ProductVersion: 2.2.14
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #METERPRETER win2.exe #COBALTSTRIKE artifact_x64.exe werfault.exe #COBALTSTRIKE artifact_x64.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
2340"C:\Users\admin\Desktop\artifact_x64.exe" C:\Users\admin\Desktop\artifact_x64.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\artifact_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
CobalStrike
(PID) Process(2340) artifact_x64.exe
C2127.0.0.1:80/fl6U
HeadersUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
2928C:\WINDOWS\system32\WerFault.exe -u -p 2340 -s 1132C:\Windows\System32\WerFault.exe
artifact_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\cryptsp.dll
6268C:\WINDOWS\system32\WerFault.exe -u -p 6976 -s 1196C:\Windows\System32\WerFault.exe
artifact_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
6880"C:\Users\admin\Desktop\win2.exe" C:\Users\admin\Desktop\win2.exe
explorer.exe
User:
admin
Company:
Apache Software Foundation
Integrity Level:
MEDIUM
Description:
ApacheBench command line utility
Exit code:
0
Version:
2.2.14
Modules
Images
c:\users\admin\desktop\win2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6976"C:\Users\admin\Desktop\artifact_x64.exe" C:\Users\admin\Desktop\artifact_x64.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\artifact_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
CobalStrike
(PID) Process(6976) artifact_x64.exe
C2127.0.0.1:80/fl6U
HeadersUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
Total events
9 070
Read events
9 050
Write events
20
Delete events
0

Modification events

(PID) Process:(6976) artifact_x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6976) artifact_x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6976) artifact_x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6976) artifact_x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6268) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
Operation:writeName:00180010F429971D
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000042CB6C300049C042863C8A748EF9A2B200000000020000000000106600000001000020000000166F6AE365D18AA30070693AD75041EC5EAA7FCDE19FB06F3E7CAF9092E42A8B000000000E8000000002000020000000C724C18CDF1A1F4F60960787E3CAD09E40055A6EE21DFF6F8E00FA90B7589CE18000000095A14F7B5B9DDC3FAE57FA9538F72D06B6C8156008EF4301E87E86B2EB1A5409C65256EAC4DDD7B96DF7F23D86FC7D69717973728BB615C486DB0F45DEE5D1585B27B657459AC87046ABB7A36B101A5466AF9033D3C8D5E0B87B886AE6621788CCCAEA08E8F9259C3A811F678327C6361F18C9AB9A4C99D7A1818E76E0C97994400000002E260AF26C0104255DB80BCCC898807C03431D9A2501AD63F07DEB7DC9FAF3893EE8AE3A77AEBE162FCCC6D22F8DE54836EA3BDF5F28DEA970D3E2D5974AB0A0
(PID) Process:(6268) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:DeviceTicket
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000042CB6C300049C042863C8A748EF9A2B200000000020000000000106600000001000020000000E47D5C9E6B40E3BA5471A8315A5D1E06AC2473D2F69D7B833F9A313FD6FCAAF3000000000E8000000002000020000000FF9E61D86B3A0527C7D070AF25D9790BB39BED34C59207B189BB52889362D2E72008000021C8877800C23809E221520FC19A5F7E703726B93C5E88A2AA9014E7A73EB342842F38240C8090CC30756A3C265CFDA6A79F10AB2F9BAD291C9CB405D69B6673D206533EB09B05C51E8574950E47CE926575DE24036171BC6B0F357B4958707CF163E90652DBF3B9ADFEE4E79CCB90D0105E2B2CFF83FFE7F28136463508EC74ED4A49166EA935F49685C38E07EDCDA77A40BE1CC9D64E9866D96AE474603D87546BB8A51C30C1B756E9094BDD69C237B8B4D35718C53D4A1B14F4D7B5E1B4E8A5AD86CE6944E8386ED060BA52912F8CA39FC58B2D09F53EFBDA53F5B7EDA0FA1A0AFB88AEEF8E041DB14230C9942A4556FF4FF7B5014298C14A1FB67FA1BAD9BCB6B2B9CB5DC155B1CC97E0E4F8465225AE9AF32B93B843F4CD4FEA652500C4A632D8C4AC0627F1637E3AA8DA9D4493223942AC39550C6C885E63692B07475A2BAFAB8CEA6204F4898D37B808D301737AFD23CE1BD9C6A6C6A55166E1EB79233FE5C722987E14CA7BF487FD5E974909D6051B4805989EDB48DE3018C374EEFDCA5CFB651E4ACE964B7681B290E6198FC8F6EC2C681D87370B0A366A49E643BC0EA9FA19EA5F03C58C507C635772DB0C5C19C9A5A5F09947BAEB8BBA0D9F7281A4C4A66EC20F3C4A2DFD1156F4C4BDAE422CEE0F135E5EB0269F6C76EDE8544962B026E5B4C9134DDAEC50ABC52C0191989EE130E98896A87527A6C8D74EB8A0A627771DAF1ED6B89F946A0086B9D442441397C5BF77AD1775DEFAC97F90C465DC04C8E20B1FEADF01E64C1EEA08A4F82F7114D7BC6DDF2330A6A292D2AF7E3961F4D0A1EA8FC0A79AFDBD9C3F060E0BCFE563A4B0300777C239DFB569B370EA8DDECE3E45DC20C7489EADE2438F2824E2E2F50E0C6D161AD5F26E6574668F9BD36E89CF810AF077CA273BFCD9ADD856F790D8EA78383C871A1D689A9438EA36F092E0F1CE6FC39B51CE8915D0D04F0D8E26B6F0364855073431724FAE508E74B9BDDF25DFEF2FFEAE5293959BB18F7EF4736EE38C7B060BBA04B8B29F5480AB4F000C62379060432EEC5127F39329EE0964ADFB47F4374955311B79C06DE1AEB66ABF0A3040F353EF50C0B69DFAD010C83A03FE1F0D53E9466C8864AB4A057536593B5410F97C3BB403824FF78636DCB20804A8BC672217D2AE47E9D2E319321BD2D4A1C123897FE337EAF0ABDB7026D447821DDC2885B362E70FD757ABB52CA7B4BD6B46B43CD1D6DE21230C8CC84038B7F460E181AEC1619CF3CB840BF4A9D61942D14B80E0E41074F2F5F2D0559AFCB4D131507C9D942A3A10C29F6FEF29719FA989F5485A12ACAFC8C447D057C9978F026986827266FC975E86CCA4FE5ED446AB8D880BB58178B1228A1F756FA8DE72D9CBA49FB2C02FEC7658ECCD190DE35376C5501F561BFEC71F30A8164B44405B99C3623968101E2DE2801AD30A7D78AC37523DF3566D7CDED104417A4D439A6A8F1D7CE2EC51009B366B643D8110263B793835C0B972E579EF0AB296BA8D565F4E6B9AA7C884A9A1947C27A554DD638E3AA976D73F3C45144B6E7D9B43D934E6CDE4946FD39BAB30CFF5068BCABE6D8BD712D49AE9EC74640FF5159A1EBAE6815D7CD29A74AD8ED7E43D1B012B981BF8E8566762A3F6AAC403F7AD0CFE9C50970946C14C0F5351AD27E026F5528EC1EF6C15447173C243C3771A6D13FE7E1609CCBD698305DFCEB29A88D8B8D464712C9AB55165C8ED9D67FAE596CF8842583B98ED380F53AF0F79C96F6026E7713503CD77A84549C416B952058EF57884DA8D9FC97F02FA53901605612FF8A0D0ED890119FB888E65FDD17435C36ED48441F868BD578149AA71806D47FB848625F99787C312F8B03D47D60361C6749AC2485966DCDCB20CA04EB62F62854021FD989007116B5FAC179DEE48E6EA60D163969D605DA444783C1B7E6742AFF5A2F6D58FAEF66DB8E60F1881AD28891FEB062325385C3F6B0BC33084EB9220F9E93C33E7859F66529C572B5823002D434E04766CDF1CAAF4DAE1BD814D52DC456A4961ED4DEA2EAD2704C58327C506EE63772871100C075DD8EADDFA8D2752A01A80AAF38926C7C9DB5A9FBAAA6813BAF74C58A4B14BD96EC434EACADBF28A5A503D09B96CBCE7AD12B662F149C8567D1B9A31C754382E8E6E96C01558DED30A2CF102005DA559AEEA0777C6419ADF4622A5FCD83F174C48D31BC10EC3C016C9BB0F10213247D4FEE3551371F25AA2DA58E68B8B0633DE1E14978A73A71FE14A6E9C08CC36A0FF8F7FB5F027C51C029C8890D08D9B6E3C89AB1CE95465A958FA12BB44C812FF6B64BF93080FA57360D4B573141741BEAD9F6137F576A126CC56056FFB2EBE8E5EE32D5E865AE29C4F2DD325FBCB6B8F7A821731F4CF931C4F840A17014C56EDA314BED3557A359685711C5A6426D3F72B70A6B27162E53F1168FA1CAD5B748C4113FA947F60CB798CA6D3618F3F95EE0183CE2DD8AB6A769F42D66B1AA69436F246D005FCFBF4F31E22E9AD31BF018A84C34FFDD1EE9963020F2D385E48885CC743A3E5ABD7404AAAE4EA0323A602A613D3DFA93877C2F1DF460DFF093666226A641776B4543BA6726C0521668A3BA3DB5565C97AA4D245CC178F5F69626CFDFE3FF28B462D1B6AD8B55191A4C19A45467C34EFFC84086DA05829F173BC3636D677C0B66E2E8980DE8B870061E19A71D2714303EDC20A3C0EF01E4A74A09D7A5E08DBC27A0E3F32BAD53468B85CBFCE477EB9B522FCB8399F4389BBD6E40BA0718CB54A2BBD8E544166BD10CD413714AB6627F006C7E2B976F7894C4824B356C62D501DD2A45E002761011B46A020260552BEC05FE4598085AE40F8C9E506CDF80C98CB946F889C7FA2B792805264CC6DF3A10FF0E9FB90DF28F09D5B1FA5466D19BC895F554ED1B609C95AE0EC2851F85574AD36E5878CBACA243240000000B9FB9BAB1184CF288FFB0E07537CC28A2D840B46CD3772C648C4D4A3F7AA4C5575FD3DE0E58DAAF8B629937B5A286FA4867780FAE3030CC4F0554BD42F884DEC
(PID) Process:(6268) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:DeviceId
Value:
00180010F429971D
(PID) Process:(6268) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:ApplicationFlags
Value:
1
(PID) Process:(2340) artifact_x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2340) artifact_x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
0
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6268WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_artifact_x64.exe_6dd1d93f3b7a1a541f54b144999c782884bd513a_79ee42c2_6a73349c-1231-4c16-8e34-4c22f4669e4c\Report.wer —
MD5:—
SHA256:—
2928WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_artifact_x64.exe_aa8feaf7b7a1d23470e1d4637c15cafa849a726e_79ee42c2_a2ded95b-6386-4d17-b475-68b19cccb9bf\Report.wer —
MD5:—
SHA256:—
6268WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER3F87.tmp.dmpbinary
MD5:CB600DC814E025F4B15B4EEF1AC8399E
SHA256:D0A6C1B71FD9681FE2D8060092B7741FCF635953BACA7AEF8129EDC84CD6DBE0
2928WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\artifact_x64.exe.2340.dmpbinary
MD5:80EB6116D1C8724B59BD1149807E8F1B
SHA256:C402BDB36C7ADC8A9CD246206DB185860B183B47C888AA2678208F7651374F5A
2928WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER903.tmp.xmlxml
MD5:B4F994D845E9F6E07F3BEA25A8EF25AE
SHA256:EB01941EFEF513B8B3EE2889E2AFE53226860D7E33D61C6F0DC5F16DBCADAD5A
6268WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER4024.tmp.WERInternalMetadata.xmlxml
MD5:04D24161F97DC7256071617F8720D475
SHA256:AD97FEF2CB6FC8E5B22F2508717F8170CC160F4CB866692B9D9303D5B00C9940
6268WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER4054.tmp.xmlxml
MD5:8BCACC7501684026A8ACB0ACB5EE9B57
SHA256:721FD744C6E6C9E0BD5154AFD7F813CAE7CFBC9C9211A92AB3B789D22B4802C3
6268WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\artifact_x64.exe.6976.dmpbinary
MD5:AABDBBD20FEA1EE1B3DB3EEBA0010036
SHA256:C2EB79A7C50E40AF00AC6EDDD2DD725D5876C6B27CE9DC330C3E3A8C9362BA93
2928WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER893.tmp.dmpdmp
MD5:F0682CFC19A9381F10F4F66D96699022
SHA256:7E6FB12748089C194B198A560ED7F3D35C3D39D2EEBF796CB8B9EB683B20210D
6268WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:82C30E45BF5F93A5DB1D5E47F913053B
SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
37
DNS requests
16
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4540
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6672
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6700
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1184
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4540
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6880
win2.exe
3.13.191.225:19996
—
AMAZON-02
US
unknown
4540
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.23
  • 20.190.159.75
whitelisted
th.bing.com
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.179
  • 2.23.209.182
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted

Threats

PID
Process
Class
Message
6880
win2.exe
A Network Trojan was detected
ET MALWARE Possible Metasploit Payload Common Construct Bind_API (from server)
6880
win2.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Meterpreter Payload PE EXE Download
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
win2.exe