File name:

ibd2sql-main.zip

Full analysis: https://app.any.run/tasks/4309edba-3e43-4334-adb5-2ee551dbb2d5
Verdict: Malicious activity
Analysis date: August 18, 2024, 18:20:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

75CB4CD94AEAA270E4F05A2EB55210D8

SHA1:

D382E74DBD99FE131E16AA31A962BDD8096CF0B3

SHA256:

D320279923973B7700E7A5306ABA163D8E0FDC6FAF89ED54202356EFF94D4CE9

SSDEEP:

1536:aIaM6NU3RbI+ZxFro4givOTwCn/46OUlFDjXSFaXgIuBlj2C/P:aIaTf+HFr1g+OEA5OuXXSoMBlj2eP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • python-3.12.5-amd64.exe (PID: 8100)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • python-3.12.5-amd64.exe (PID: 8100)
      • python-3.12.5-amd64.exe (PID: 8000)

    • Searches for installed software

      • python-3.12.5-amd64.exe (PID: 8100)

    • Creates a software uninstall entry

      • python-3.12.5-amd64.exe (PID: 8100)

    • The process drops C-runtime libraries

      • python-3.12.5-amd64.exe (PID: 8100)
      • msiexec.exe (PID: 5244)

    • Process drops legitimate windows executable

      • python-3.12.5-amd64.exe (PID: 8100)
      • msiexec.exe (PID: 5244)

    • Drops the executable file immediately after the start

      • python-3.12.5-amd64.exe (PID: 8100)
      • python-3.12.5-amd64.exe (PID: 8000)
      • msiexec.exe (PID: 5244)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5244)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 5244)

  • INFO

    • Manual execution by a user

      • msedge.exe (PID: 1216)
      • cmd.exe (PID: 6464)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 1216)

    • Checks supported languages

      • TextInputHost.exe (PID: 5656)
      • identity_helper.exe (PID: 7900)
      • msiexec.exe (PID: 5244)
      • python-3.12.5-amd64.exe (PID: 8000)
      • python-3.12.5-amd64.exe (PID: 8100)

    • Reads the computer name

      • TextInputHost.exe (PID: 5656)
      • identity_helper.exe (PID: 7900)
      • python-3.12.5-amd64.exe (PID: 8100)
      • msiexec.exe (PID: 5244)

    • Reads Environment values

      • identity_helper.exe (PID: 7900)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 1216)
      • msedge.exe (PID: 6420)
      • msiexec.exe (PID: 5244)

    • Application launched itself

      • msedge.exe (PID: 1216)

    • The process uses the downloaded file

      • msedge.exe (PID: 7564)
      • msedge.exe (PID: 1216)

    • Creates files or folders in the user directory

      • python-3.12.5-amd64.exe (PID: 8100)
      • msiexec.exe (PID: 5244)

    • Reads the machine GUID from the registry

      • python-3.12.5-amd64.exe (PID: 8100)
      • msiexec.exe (PID: 5244)

    • Create files in a temporary directory

      • python-3.12.5-amd64.exe (PID: 8000)
      • python-3.12.5-amd64.exe (PID: 8100)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5244)

    • Reads the software policy settings

      • msiexec.exe (PID: 5244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (36.3)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:08:09 11:39:08
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ibd2sql-main/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
45
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs textinputhost.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs python-3.12.5-amd64.exe python-3.12.5-amd64.exe msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
532"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=2380,i,9887126371588821199,14262268722535835318,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1140"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=7212 --field-trial-handle=2380,i,9887126371588821199,14262268722535835318,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1184"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3492 --field-trial-handle=2380,i,9887126371588821199,14262268722535835318,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1216"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=DefaultC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1452"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7024 --field-trial-handle=2380,i,9887126371588821199,14262268722535835318,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1716"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=6116 --field-trial-handle=2380,i,9887126371588821199,14262268722535835318,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1860"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4076 --field-trial-handle=2380,i,9887126371588821199,14262268722535835318,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2228C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5104"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=6264 --field-trial-handle=2380,i,9887126371588821199,14262268722535835318,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5144"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=1520 --field-trial-handle=2380,i,9887126371588821199,14262268722535835318,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
37 154
Read events
36 567
Write events
561
Delete events
26

Modification events

(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ibd2sql-main.zip
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(1216) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
Executable files
61
Suspicious files
416
Text files
252
Unknown types
0

Dropped files

PID
Process
Filename
Type
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\ibd2sql\ibd2sql.pytext
MD5:3B5F8632E03F3701F77BEC48AE921105
SHA256:1D2BB836740FD5690A13CEFDF5441A187A9BAF15A7BCC0F471EEBF96B98F4256
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\ibd2sql\blob.pytext
MD5:03AC9994C2EEBE3639AA5148FA01B670
SHA256:B5EABD369E5174C42E91D9EB5FBF9EE767CFB58A71583D2C00C51C8BEB75BAE7
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\ibd2sql\innodb_page.pytext
MD5:827452A083ECDAB996FA93AB7435761C
SHA256:72C84F3806362FAAF52C318F711E9B78608734F2BB0743012732502B9644EA0C
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\ibd2sql\innodb_page_ibuf.pytext
MD5:E29D2F32F61577875912EFF50DB83BC9
SHA256:E95160BF554E917C9A89CDDC2F5D82CDAE124337107B58ED897A12DD61A5B15F
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\docs\CHANGELOG.mdtext
MD5:BF12F5A9106D1D10546E79B2119CB0A6
SHA256:DC5A413CA4C3243E3975F3EB212771C7E0A184BC72EA9BE2B418A66B63380AAF
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\LICENSEtext
MD5:1EBBD3E34237AF26DA5DC08A4E440464
SHA256:3972DC9744F6499F0F9B2DBF76696F2AE7AD8AF9B23DDE66D6AF86C9DFB36986
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\docs\USAGE.mdtext
MD5:57A12EF53546E1816CDF2CACFAAE0339
SHA256:CA6AAB41065EAA31CD9A44D86487AAE989B1F8AADEEBA2679B23C2C3537B1480
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\README_zh.mdtext
MD5:65A1B5BA7C32A85B418251D2F6A5E7A9
SHA256:A2B3C3E9DF4592FB92A0643D92A04346F81A9EDF975F92B7CF98100F87EB3F01
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\ibd2sql\__init__.pytext
MD5:8AB30A8A541A0F2852FF28F1299FDBF1
SHA256:75FF06C51CD5EC972DC4342F20D694C6ABE856E4BCF6E4006A5E3EDCAADDA7C0
6864WinRAR.exeC:\Users\admin\Desktop\ibd2sql-main\docs\INSTANT.mdtext
MD5:EB351FA94BA18D2765B11F58E020444A
SHA256:ADB95DB526BFF0936136C72A30D7D673645EB09769A836D8C3F9B1301DF51B0D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
137
DNS requests
143
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6692
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6588
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6420
msedge.exe
GET
304
2.16.241.15:80
http://apps.identrust.com/roots/dstrootcax3.p7c
unknown
—
—
whitelisted
6420
msedge.exe
GET
304
2.23.197.184:80
http://x1.i.lencr.org/
unknown
—
—
whitelisted
6420
msedge.exe
GET
304
2.23.197.184:80
http://r3.i.lencr.org/
unknown
—
—
whitelisted
1216
msedge.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3164
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5060
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6692
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6692
backgroundTaskHost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.2
  • 20.190.159.64
  • 20.190.159.0
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.209.182
  • 2.23.209.150
  • 2.23.209.158
  • 2.23.209.149
  • 2.23.209.177
  • 2.23.209.176
  • 2.23.209.187
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.173
  • 2.23.209.175
  • 2.23.209.143
  • 2.23.209.160
  • 2.23.209.141
  • 2.23.209.156
whitelisted
r.bing.com
  • 2.23.209.141
  • 2.23.209.158
  • 2.23.209.156
  • 2.23.209.149
  • 2.23.209.150
  • 2.23.209.160
  • 2.23.209.175
  • 2.23.209.173
  • 2.23.209.143
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.177
  • 2.23.209.176
whitelisted
th.bing.com
  • 2.23.209.135
  • 2.23.209.140
  • 2.23.209.150
  • 2.23.209.133
  • 2.23.209.130
  • 2.23.209.149
  • 2.23.209.141
  • 2.23.209.158
  • 2.23.209.176
whitelisted
browser.pipe.aria.microsoft.com
  • 20.189.173.26
whitelisted

Threats

PID
Process
Class
Message
6420
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6420
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
6420
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
6420
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6420
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6420
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6420
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6420
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ibd2sql-main.zip