File name:

0422d000-f76f-40aa-8285-d3afaf818b2c

Full analysis: https://app.any.run/tasks/c9f0d62f-6386-4689-9aae-061043836d87
Verdict: Malicious activity
Analysis date: August 16, 2024, 18:58:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

02A8CBCC407D9D37ECCA84EA687BD128

SHA1:

9934FF1457FB354B30444FEB0F3681307DB0B08B

SHA256:

D16B1B54A74B79BC0FA3791D8B04850E34D9DE40A31480FA89CE902394047DCE

SSDEEP:

98304:pFpdYkE+y94O9EMBNlsmqVlDFmFqjUTwFWfE5lNC9Gy6KfIjnrnCNy5mWI8CLYu0:hsVTBJLWALYrYsZg2Dt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • FGA64.exe (PID: 6928)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6492)
      • FolderGuard-23.5-setup.exe (PID: 7092)
      • Setup64.exe (PID: 6276)
      • FG64.exe (PID: 6484)
      • FGA64.exe (PID: 6928)
      • folderguard.pro.x32-patch-20.10+.exe (PID: 5988)
      • FG64.exe (PID: 7088)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 2932)
      • FG64.exe (PID: 6356)

    • Drops a system driver (possible attempt to evade defenses)

      • FolderGuard-23.5-setup.exe (PID: 7092)
      • Setup64.exe (PID: 6276)

    • Executable content was dropped or overwritten

      • FolderGuard-23.5-setup.exe (PID: 7092)
      • Setup64.exe (PID: 6276)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 6700)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 2932)
      • folderguard.pro.x32-patch-20.10+.exe (PID: 5988)

    • Drops the executable file immediately after the start

      • FolderGuard-23.5-setup.exe (PID: 7092)
      • Setup64.exe (PID: 6276)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 6700)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 2932)
      • folderguard.pro.x32-patch-20.10+.exe (PID: 5988)

    • Reads the date of Windows installation

      • FolderGuard-23.5-setup.exe (PID: 7092)
      • Setup64.exe (PID: 6276)
      • FG64.exe (PID: 6484)
      • FG64.exe (PID: 7088)
      • FG64.exe (PID: 6356)

    • Creates/Modifies COM task schedule object

      • Setup64.exe (PID: 6276)
      • FGA64.exe (PID: 6928)

    • Creates a software uninstall entry

      • Setup64.exe (PID: 6276)

    • Searches for installed software

      • dllhost.exe (PID: 6948)
      • Setup64.exe (PID: 6276)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6888)
      • FG64.exe (PID: 2080)

    • Creates file in the systems drive root

      • folderguard.pro.x32-patch-20.10+.exe (PID: 5988)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 2932)

    • Application launched itself

      • FG64.exe (PID: 7088)

  • INFO

    • Manual execution by a user

      • FolderGuard-23.5-setup.exe (PID: 7092)
      • FG64.exe (PID: 7088)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 5944)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 6700)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 2932)
      • folderguard.pro.x32-patch-20.10+.exe (PID: 2340)
      • folderguard.pro.x32-patch-20.10+.exe (PID: 5988)

    • Checks supported languages

      • FolderGuard-23.5-setup.exe (PID: 7092)
      • Setup64.exe (PID: 6276)
      • FG64.exe (PID: 6484)
      • FGA64.exe (PID: 6928)
      • FG64.exe (PID: 2080)
      • FG64.exe (PID: 7088)
      • TextInputHost.exe (PID: 7032)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 6700)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 2932)
      • FG64.exe (PID: 4424)
      • FG64.exe (PID: 644)
      • folderguard.pro.x32-patch-20.10+.exe (PID: 5988)
      • FG64.exe (PID: 6356)
      • FGA64.exe (PID: 4672)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6492)

    • Create files in a temporary directory

      • FolderGuard-23.5-setup.exe (PID: 7092)
      • Setup64.exe (PID: 6276)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 6700)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 2932)
      • folderguard.pro.x32-patch-20.10+.exe (PID: 5988)

    • Reads the computer name

      • FolderGuard-23.5-setup.exe (PID: 7092)
      • Setup64.exe (PID: 6276)
      • FGA64.exe (PID: 6928)
      • TextInputHost.exe (PID: 7032)
      • FG64.exe (PID: 2080)
      • FG64.exe (PID: 7088)
      • FG64.exe (PID: 6484)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 6700)
      • folderguard.pro.x32-patch-20.10+.exe (PID: 5988)
      • FG64.exe (PID: 4424)
      • folderguard.pro.x64-patch-20.10+.exe (PID: 2932)
      • FG64.exe (PID: 6356)
      • FGA64.exe (PID: 4672)
      • FG64.exe (PID: 644)

    • Process checks computer location settings

      • FolderGuard-23.5-setup.exe (PID: 7092)
      • Setup64.exe (PID: 6276)
      • FG64.exe (PID: 6484)
      • FG64.exe (PID: 6356)
      • FG64.exe (PID: 7088)

    • Creates files in the program directory

      • Setup64.exe (PID: 6276)
      • FGA64.exe (PID: 6928)

    • Creates files or folders in the user directory

      • Setup64.exe (PID: 6276)
      • FGA64.exe (PID: 6928)

    • UPX packer has been detected

      • FolderGuard-23.5-setup.exe (PID: 7092)

    • Reads the machine GUID from the registry

      • FGA64.exe (PID: 6928)

    • Reads Microsoft Office registry keys

      • folderguard.pro.x32-patch-20.10+.exe (PID: 5988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
23
Malicious processes
3
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs THREAT folderguard-23.5-setup.exe setup64.exe no specs setup64.exe vssvc.exe no specs SPPSurrogate no specs srtasks.exe no specs conhost.exe no specs fg64.exe no specs fga64.exe fg64.exe no specs fg64.exe no specs textinputhost.exe no specs folderguard.pro.x64-patch-20.10+.exe no specs folderguard.pro.x64-patch-20.10+.exe folderguard.pro.x64-patch-20.10+.exe folderguard.pro.x32-patch-20.10+.exe no specs folderguard.pro.x32-patch-20.10+.exe fg64.exe no specs fg64.exe no specs fg64.exe no specs fga64.exe

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Program Files\Folder Guard\FG64.exe" C:\Program Files\Folder Guard\FG64.exe—FG64.exe
User:
admin
Company:
WinAbility® Software Corporation
Integrity Level:
MEDIUM
Description:
Folder Guard
Exit code:
0
Version:
23.5
Modules
Images
c:\program files\folder guard\fg64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\program files\folder guard\fgh64.dll
2080"C:\Program Files\Folder Guard\FG64.exe" /serviceC:\Program Files\Folder Guard\FG64.exe—services.exe
User:
SYSTEM
Company:
WinAbility® Software Corporation
Integrity Level:
SYSTEM
Description:
Folder Guard
Version:
23.5
Modules
Images
c:\program files\folder guard\fg64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2340"C:\Users\admin\Desktop\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\folderguard.pro.x32-patch-20.10+.exe" C:\Users\admin\Desktop\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\folderguard.pro.x32-patch-20.10+.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\folder guard 23.5 multilingual [pesktop.com]\fix\folderguard.pro.x32-patch-20.10+.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2932"C:\Users\admin\Desktop\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\folderguard.pro.x64-patch-20.10+.exe" C:\Users\admin\Desktop\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\folderguard.pro.x64-patch-20.10+.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\folder guard 23.5 multilingual [pesktop.com]\fix\folderguard.pro.x64-patch-20.10+.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\temp\dup2patcher.dll
4424"C:\Program Files\Folder Guard\FG64.exe" C:\Program Files\Folder Guard\FG64.exe—FG64.exe
User:
admin
Company:
WinAbility® Software Corporation
Integrity Level:
MEDIUM
Description:
Folder Guard
Exit code:
0
Version:
23.5
Modules
Images
c:\program files\folder guard\fg64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\program files\folder guard\fguard64.dll
c:\windows\system32\gdi32full.dll
4672"C:\Program Files\Folder Guard\FGA64.exe" C:\Program Files\Folder Guard\FGA64.exe
FG64.exe
User:
admin
Company:
WinAbility® Software Corporation
Integrity Level:
HIGH
Description:
Folder Guard Application
Version:
23.5
Modules
Images
c:\program files\folder guard\fga64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\program files\folder guard\fguard64.dll
5196\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5944"C:\Users\admin\Desktop\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\folderguard.pro.x64-patch-20.10+.exe" C:\Users\admin\Desktop\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\folderguard.pro.x64-patch-20.10+.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\folder guard 23.5 multilingual [pesktop.com]\fix\folderguard.pro.x64-patch-20.10+.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5988"C:\Users\admin\Desktop\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\folderguard.pro.x32-patch-20.10+.exe" C:\Users\admin\Desktop\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\folderguard.pro.x32-patch-20.10+.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\folder guard 23.5 multilingual [pesktop.com]\fix\folderguard.pro.x32-patch-20.10+.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\temp\dup2patcher.dll
6180C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:12C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
50 412
Read events
49 379
Write events
909
Delete events
124

Modification events

(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\0422d000-f76f-40aa-8285-d3afaf818b2c.rar
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6492) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\Windows\System32\ieframe.dll,-10046
Value:
Internet Shortcut
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
23
Suspicious files
21
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6492.854\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\folderguard.pro.x32-patch-20.10+.exeexecutable
MD5:8C4966D30F771E0337384C557BCF684D
SHA256:2083E7629829DAB1A01BF09D032CEEFA3217EFD4FAA12716A7F444F04A05F68B
7092FolderGuard-23.5-setup.exeC:\Users\admin\AppData\Local\Temp\~FG.TMP\FGH64.dllexecutable
MD5:9026BD30BB531C872BD7327416DADEF0
SHA256:E6C0746DB64193C5D383E845F30D7547D024F1BCBBD8A03E08ABCCB0923C8A63
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6492.854\Folder Guard 23.5 Multilingual [PeskTop.com]\FolderGuard-23.5-setup.exeexecutable
MD5:B15FE755A333A619572B73C418455E39
SHA256:9CE1233A498965E3C1A658922CC8447E2AD3F899B10107CC95B3C971AFFC8DAF
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6492.854\Folder Guard 23.5 Multilingual [PeskTop.com]\fix\keygen.exeexecutable
MD5:88210A0094BD1051DCDEFFD9CE59665F
SHA256:AF0326224E6B65A402FE202E225FEFC72241055946D93ABCAC61A24316C47889
7092FolderGuard-23.5-setup.exeC:\Users\admin\AppData\Local\Temp\~FG.TMP\Setup64.exeexecutable
MD5:246626E06F9774088EF8C6FD8315C5AD
SHA256:56B505077A432E27A5E74EBB89C22BAF4CD2C0FE41CCA6C2694148FB46786E36
6276Setup64.exeC:\Users\admin\AppData\Local\Temp\~DFE02942E8A621D2EB.TMPbinary
MD5:CA13F76F0B45C414200CF734EF2CA0F8
SHA256:46618E9BC7A70E9CF7425C438889A90CD33E05437EBEE7A7B360F5760BD39925
7092FolderGuard-23.5-setup.exeC:\Users\admin\AppData\Local\Temp\~FG.TMP\FG64.exeexecutable
MD5:D18CBF5CFAEC9FAEFAE70829061FCCF8
SHA256:FFA354AA02B81BA862FD34E5A35B4C52E71FE4EE187ADFD75CD362369F523016
7092FolderGuard-23.5-setup.exeC:\Users\admin\AppData\Local\Temp\~FG.TMP\FGUARD64.dllexecutable
MD5:5F07C9921ADF4E3336285F51CE8A9B60
SHA256:886C6525101EFD64DB15FFF25C74FC67A1697AE4E1164CE08F80AF135D0157EF
6276Setup64.exeC:\Users\admin\AppData\Local\Temp\~DF694A16CAB9E8F6C1.TMPbinary
MD5:8A64200BE1B7CFE18DA4AEB1B8892B9C
SHA256:36448F1F69617F3FDD1CBB2A2B36D2685CC79BC86E6A542A2F37F3C44757CFC9
6276Setup64.exeC:\Users\admin\AppData\Local\Temp\~DFFCD82DD6613436BF.TMPbinary
MD5:4479BE9CF6AEB0019EFDE9B0B2869F78
SHA256:8A1251EB01D1F4B89D2FA9A5D9DA2E259558306FFBC67F3AF6FC3852910DD9F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
53
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5992
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6816
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5992
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6872
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1116
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5600
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5600
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
104.126.37.160:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5992
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
www.bing.com
  • 104.126.37.160
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.163
  • 104.126.37.171
  • 104.126.37.186
  • 104.126.37.153
  • 104.126.37.170
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.23
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.71
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
th.bing.com
  • 104.126.37.153
  • 104.126.37.139
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.170
  • 104.126.37.169
  • 104.126.37.162
  • 104.126.37.155
  • 104.126.37.131
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0422d000-f76f-40aa-8285-d3afaf818b2c