File name:

DeltaExecutor.zip

Full analysis: https://app.any.run/tasks/5025c6cf-0848-4af7-9e2b-b496bf9c9e66
Verdict: Malicious activity
Analysis date: February 01, 2025, 15:41:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

DAD4B5A87B45EC1155C85316166281C8

SHA1:

71A349592EABE03D41A8251661F0657B5B521DE5

SHA256:

CDDD2185F56A6808725A11AED2199F3B938553FF06B010EDE7AB26CF8FECAC0E

SSDEEP:

98304:ze89tUKcxmX3g5VhxNWYgsBFqSmS0w2Wruvx4HzyQsEVVldsk8+AbBwy13j8fpuf:8BF2K45gCHF1KxJJMD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3172)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3172)
      • DeltaExecutor.exe (PID: 6960)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 3172)

    • Possibly malicious use of IEX has been detected

      • DeltaExecutor.exe (PID: 6960)

    • Starts POWERSHELL.EXE for commands execution

      • DeltaExecutor.exe (PID: 6960)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7192)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 1400)

    • Drops 7-zip archiver for unpacking

      • msiexec.exe (PID: 1400)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 1400)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3172)
      • msedge.exe (PID: 6412)
      • msedge.exe (PID: 5616)
      • msiexec.exe (PID: 1400)
      • msedge.exe (PID: 1144)

    • Creates files in the program directory

      • DeltaExecutor.exe (PID: 6960)

    • Checks supported languages

      • DeltaExecutor.exe (PID: 6960)
      • identity_helper.exe (PID: 7188)
      • 7zFM.exe (PID: 7252)
      • msiexec.exe (PID: 1400)

    • Reads the computer name

      • DeltaExecutor.exe (PID: 6960)
      • identity_helper.exe (PID: 7188)
      • msiexec.exe (PID: 1400)
      • 7zFM.exe (PID: 7252)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 3172)
      • msiexec.exe (PID: 1400)
      • msedge.exe (PID: 1144)

    • Application launched itself

      • msedge.exe (PID: 7088)
      • msedge.exe (PID: 5616)

    • Manual execution by a user

      • msedge.exe (PID: 5616)
      • 7zFM.exe (PID: 7252)

    • Reads Environment values

      • identity_helper.exe (PID: 7188)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7108)

    • Manages system restore points

      • SrTasks.exe (PID: 2092)

    • The sample compiled with russian language support

      • msiexec.exe (PID: 1400)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1400)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 5616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:11:13 11:15:28
ZipCRC: 0x7798f956
ZipCompressedSize: 769737
ZipUncompressedSize: 1437056
ZipFileName: clrjit.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
70
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe deltaexecutor.exe no specs deltaexecutor.exe conhost.exe msedge.exe no specs powershell.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs msiexec.exe vssvc.exe no specs msedge.exe no specs msedge.exe srtasks.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 7zfm.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
68"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5596 --field-trial-handle=2408,i,11827011880343853315,16297856653682367935,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
540"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5744 --field-trial-handle=2408,i,11827011880343853315,16297856653682367935,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
900"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=3884 --field-trial-handle=2408,i,11827011880343853315,16297856653682367935,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1144"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4956 --field-trial-handle=2408,i,11827011880343853315,16297856653682367935,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1400C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1448"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5296 --field-trial-handle=2408,i,11827011880343853315,16297856653682367935,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1668"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6808 --field-trial-handle=2408,i,11827011880343853315,16297856653682367935,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1684"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3000 --field-trial-handle=2408,i,11827011880343853315,16297856653682367935,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2092C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2100"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2b4,0x7ff8206f5fd8,0x7ff8206f5fe4,0x7ff8206f5ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
18 410
Read events
18 059
Write events
334
Delete events
17

Modification events

(PID) Process:(3172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\DeltaExecutor.zip
(PID) Process:(3172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6960) DeltaExecutor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6960) DeltaExecutor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
42
Suspicious files
224
Text files
146
Unknown types
0

Dropped files

PID
Process
Filename
Type
3172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3172.32721\clrjit.dllexecutable
MD5:92795535F2855D02685A78985D2F3D28
SHA256:7399B0EFE5B3D0A9656F35A7317C9210DFDA4374FBBA7B2FD07671A5855A9345
3172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3172.32721\hostfxr.dllexecutable
MD5:A4431266F13F98D48A2F2B10FD2D8A71
SHA256:88945E1FD1B63C3D941F67E6CF161680F1288C97FB7AC6028D2645477708F124
3172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3172.32721\coreclr.dllexecutable
MD5:CBB2F646B9B2A67DAD68C35BBC7CB7C8
SHA256:C6E05A6D8433F111916F2B107B765A9159F41FA1C7A5D8E267645DBD6734D737
3172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3172.32721\System.Runtime.dllexecutable
MD5:6F1DAE472A14AE8466BEF121470C2E14
SHA256:1048754B003EC6E9815E1FE328901C0D952C4BABC997CA5BC4C4085FCD4B2377
3172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3172.32721\README.txttext
MD5:3A06935DDF57B2FACEC08DEA3D29740C
SHA256:77CFCB6BA324785DE19110F03E7DF78ED523A61F747824B296B924D584F9D154
3172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3172.32721\DeltaExecutor.exeexecutable
MD5:A614A895161A44B174F8B0C5E0D94ADF
SHA256:D6F67C596A3017FAB0F6908F38DE0F996FE8742DC7131D491343D128D96564F6
3172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3172.32721\System.Diagnostics.Process.dllexecutable
MD5:A688B390880E4BA55B2A4E52A6EFB5C4
SHA256:B47FA6C38902EB8AF6745A6F968BBF79BA9E35C7B41D9D48975D87B1F8BFAA59
3172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3172.32721\System.Private.CoreLib.dllexecutable
MD5:C8EBFCFD8C7A69E30D45B4498ECE29D0
SHA256:620A4B11FB37AB997950870B06FEE3038C5922A052E06871B9C1A7E1A19C1262
5616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF13d3ce.TMP —
MD5:—
SHA256:—
5616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
89
DNS requests
86
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7096
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7096
SIHClient.exe
GET
200
23.38.73.129:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8084
svchost.exe
HEAD
200
217.20.57.18:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/de2c6004-9bb9-4e49-b0e2-d9188dc643bb?P1=1738918752&P2=404&P3=2&P4=HNbGyFYH7voZ%2fCnv%2b2x%2bKKEtYKKY5C93K%2fJZmufjSHTI1i2Eyv5Gdhxnf5z8d0BlLGjregj7AR5ouyBRF6JK3w%3d%3d
unknown
—
—
whitelisted
6488
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8084
svchost.exe
GET
206
217.20.57.18:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/de2c6004-9bb9-4e49-b0e2-d9188dc643bb?P1=1738918752&P2=404&P3=2&P4=HNbGyFYH7voZ%2fCnv%2b2x%2bKKEtYKKY5C93K%2fJZmufjSHTI1i2Eyv5Gdhxnf5z8d0BlLGjregj7AR5ouyBRF6JK3w%3d%3d
unknown
—
—
whitelisted
8084
svchost.exe
GET
206
217.20.57.18:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/de2c6004-9bb9-4e49-b0e2-d9188dc643bb?P1=1738918752&P2=404&P3=2&P4=HNbGyFYH7voZ%2fCnv%2b2x%2bKKEtYKKY5C93K%2fJZmufjSHTI1i2Eyv5Gdhxnf5z8d0BlLGjregj7AR5ouyBRF6JK3w%3d%3d
unknown
—
—
whitelisted
8084
svchost.exe
GET
206
217.20.57.18:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/de2c6004-9bb9-4e49-b0e2-d9188dc643bb?P1=1738918752&P2=404&P3=2&P4=HNbGyFYH7voZ%2fCnv%2b2x%2bKKEtYKKY5C93K%2fJZmufjSHTI1i2Eyv5Gdhxnf5z8d0BlLGjregj7AR5ouyBRF6JK3w%3d%3d
unknown
—
—
whitelisted
8084
svchost.exe
GET
206
217.20.57.18:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/de2c6004-9bb9-4e49-b0e2-d9188dc643bb?P1=1738918752&P2=404&P3=2&P4=HNbGyFYH7voZ%2fCnv%2b2x%2bKKEtYKKY5C93K%2fJZmufjSHTI1i2Eyv5Gdhxnf5z8d0BlLGjregj7AR5ouyBRF6JK3w%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
23.219.150.101:80
—
AKAMAI-AS
CL
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
640
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
2.19.106.8:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7096
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.0
  • 40.126.31.0
  • 40.126.31.131
  • 40.126.31.2
  • 20.190.159.4
  • 40.126.31.129
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 2.19.106.8
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.38.73.129
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
igk.filexspace.com
  • 104.21.80.1
  • 104.21.48.1
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.32.1
  • 104.21.112.1
  • 104.21.96.1
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted

Threats

PID
Process
Class
Message
6412
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6412
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6412
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6412
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
Process
Message
conhost.exe
CONSRV: Ignoring backspace to previous line
conhost.exe
CONSRV: Ignoring backspace to previous line
conhost.exe
CONSRV: Ignoring backspace to previous line
conhost.exe
CONSRV: Ignoring backspace to previous line
conhost.exe
CONSRV: Ignoring backspace to previous line
conhost.exe
CONSRV: Ignoring backspace to previous line
conhost.exe
CONSRV: Ignoring backspace to previous line
conhost.exe
CONSRV: Ignoring backspace to previous line
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DeltaExecutor.zip