URL:

https://www.iteptest.com/test_new_look_lockdown

Full analysis: https://app.any.run/tasks/272b4a90-7c0f-4638-b204-ed22c29f655c
Verdict: Malicious activity
Analysis date: December 19, 2024, 12:00:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-scr
Indicators:
MD5:

687CF297448DBF1381C77932FB7EEE44

SHA1:

08819FDE8271706CDCFAE7816AE341AC01DA9E06

SHA256:

D451B89BCC713ECF46ED749721977FBF1BEB2F51DF67023132FC2B6F9B2A90B9

SSDEEP:

3:N8DSL/RAWLdIb90S6pJKGWn:2OL/mMdIb9lt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • LockDownBrowserOEMSetup.exe (PID: 7892)
      • LockDownBrowserOEMSetup.exe (PID: 2136)
      • LockDownBrowserOEMSetup.exe (PID: 4872)
      • LockDownBrowserOEMSetup.exe (PID: 5696)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1612)

    • Searches for installed software

      • dllhost.exe (PID: 7184)
      • LockDownBrowserOEMSetup.exe (PID: 5696)

    • Process drops legitimate windows executable

      • LockDownBrowserOEMSetup.exe (PID: 2136)

    • Creates a software uninstall entry

      • LockDownBrowserOEMSetup.exe (PID: 2136)

  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 7292)
      • LockDownBrowserOEMSetup.exe (PID: 2136)
      • ISBEW64.exe (PID: 8180)
      • ISBEW64.exe (PID: 7464)
      • ISBEW64.exe (PID: 7092)
      • LockDownBrowserOEMSetup.exe (PID: 4872)
      • ISBEW64.exe (PID: 7324)
      • LockDownBrowserOEMSetup.exe (PID: 5696)
      • ISBEW64.exe (PID: 1216)
      • ISBEW64.exe (PID: 7024)
      • ISBEW64.exe (PID: 7388)
      • ISBEW64.exe (PID: 6940)
      • ISBEW64.exe (PID: 7084)

    • Reads the computer name

      • identity_helper.exe (PID: 7292)
      • LockDownBrowserOEMSetup.exe (PID: 2136)
      • ISBEW64.exe (PID: 7324)
      • ISBEW64.exe (PID: 7092)
      • ISBEW64.exe (PID: 7464)
      • ISBEW64.exe (PID: 8180)
      • ISBEW64.exe (PID: 7024)
      • ISBEW64.exe (PID: 6940)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6396)
      • msedge.exe (PID: 7752)
      • firefox.exe (PID: 7368)

    • Reads Environment values

      • identity_helper.exe (PID: 7292)

    • The process uses the downloaded file

      • msedge.exe (PID: 7504)
      • msedge.exe (PID: 6396)

    • The sample compiled with english language support

      • msedge.exe (PID: 7752)
      • LockDownBrowserOEMSetup.exe (PID: 7892)
      • LockDownBrowserOEMSetup.exe (PID: 2136)
      • LockDownBrowserOEMSetup.exe (PID: 5696)
      • LockDownBrowserOEMSetup.exe (PID: 4872)
      • firefox.exe (PID: 7368)

    • Create files in a temporary directory

      • LockDownBrowserOEMSetup.exe (PID: 7892)
      • LockDownBrowserOEMSetup.exe (PID: 2136)
      • LockDownBrowserOEMSetup.exe (PID: 5696)
      • LockDownBrowserOEMSetup.exe (PID: 4872)

    • Application launched itself

      • msedge.exe (PID: 6396)
      • firefox.exe (PID: 7548)
      • firefox.exe (PID: 7880)
      • firefox.exe (PID: 7412)
      • firefox.exe (PID: 7368)

    • Manual execution by a user

      • Taskmgr.exe (PID: 5776)
      • LockDownBrowserOEMSetup.exe (PID: 4872)
      • Taskmgr.exe (PID: 3544)
      • LockDownBrowserOEMSetup.exe (PID: 4648)
      • firefox.exe (PID: 7548)

    • Manages system restore points

      • SrTasks.exe (PID: 3824)

    • Creates files in the program directory

      • LockDownBrowserOEMSetup.exe (PID: 2136)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 3544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
248
Monitored processes
111
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs lockdownbrowseroemsetup.exe no specs msedge.exe lockdownbrowseroemsetup.exe lockdownbrowseroemsetup.exe isbew64.exe no specs msedge.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs SPPSurrogate no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs isbew64.exe no specs msedge.exe no specs msedge.exe no specs SPPSurrogate no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs taskmgr.exe no specs taskmgr.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs lockdownbrowseroemsetup.exe no specs lockdownbrowseroemsetup.exe lockdownbrowseroemsetup.exe isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs isbew64.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6624 --field-trial-handle=2316,i,2262394028761376075,14275791248264699833,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
236"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5960 --field-trial-handle=2316,i,2262394028761376075,14275791248264699833,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7404 --field-trial-handle=2316,i,2262394028761376075,14275791248264699833,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
716"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5044 -childID 5 -isForBrowser -prefsHandle 4788 -prefMapHandle 4728 -prefsLen 29030 -prefMapSize 240426 -jsInitHandle 1216 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdf07c77-c2ee-4822-bd62-432a2b05f43f} 7368 "\\.\pipe\gecko-crash-server-pipe.7368" 1f69d5064d0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6816 --field-trial-handle=2316,i,2262394028761376075,14275791248264699833,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1112 --field-trial-handle=2316,i,2262394028761376075,14275791248264699833,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
776"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4496 -parentBuildID 20240213221259 -prefsHandle 4488 -prefMapHandle 4480 -prefsLen 24770 -prefMapSize 240426 -appDir "C:\Program Files\Mozilla Firefox\browser" - {569fcc9f-07db-440b-b326-5793faab27b6} 7368 "\\.\pipe\gecko-crash-server-pipe.7368" 1f69b0a3210 rddC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
1216C:\Users\admin\AppData\Local\Temp\{D1035F3B-A5F0-421A-A2A7-74B9355D544F}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C916A95-606F-4E33-9550-EB7D37C96C6B}C:\Users\admin\AppData\Local\Temp\{D1035F3B-A5F0-421A-A2A7-74B9355D544F}\ISBEW64.exe—LockDownBrowserOEMSetup.exe
User:
admin
Company:
Flexera
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
28.0.700
Modules
Images
c:\users\admin\appdata\local\temp\{d1035f3b-a5f0-421a-a2a7-74b9355d544f}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1296"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5988 --field-trial-handle=2316,i,2262394028761376075,14275791248264699833,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1520"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1756 -parentBuildID 20240213221259 -prefsHandle 1676 -prefMapHandle 1664 -prefsLen 19989 -prefMapSize 240426 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40b92491-7186-47c7-bbdf-cddbf827c6db} 7368 "\\.\pipe\gecko-crash-server-pipe.7368" 1f6937ccb10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140_1.dll
Total events
36 062
Read events
35 794
Write events
238
Delete events
30

Modification events

(PID) Process:(5404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5404) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(6396) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
214A549134882F00
(PID) Process:(6396) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\589950
Operation:writeName:WindowTabManagerFileMappingId
Value:
{7D07E894-DC8D-44E3-A501-462A33F83918}
(PID) Process:(6396) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\589950
Operation:writeName:WindowTabManagerFileMappingId
Value:
{9533EE4C-74B9-4607-8B2C-F6919DCC93D3}
(PID) Process:(6396) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
Executable files
64
Suspicious files
1 022
Text files
239
Unknown types
9

Dropped files

PID
Process
Filename
Type
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF135bcf.TMP —
MD5:—
SHA256:—
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF135bcf.TMP —
MD5:—
SHA256:—
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF135bee.TMP —
MD5:—
SHA256:—
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF135bee.TMP —
MD5:—
SHA256:—
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF135bee.TMP —
MD5:—
SHA256:—
6396msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
111
TCP/UDP connections
245
DNS requests
242
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
640
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
640
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7596
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7596
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7316
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c269ced-c74b-4e70-9b58-6e7999b292c0?P1=1734856690&P2=404&P3=2&P4=AomkszOJXA4T4LOTHChIL94foFEyr%2bXDnGSlg3Bdz7ZEMc%2bZuSmHxZM16qG2FwjtaAqGMwthLl7qO2Vc1Y%2fLSw%3d%3d
unknown
—
—
whitelisted
6276
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
640
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
unknown
640
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.209.133:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6396
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.23.209.133
  • 2.23.209.141
  • 2.23.209.137
  • 2.23.209.150
  • 2.23.209.148
  • 2.23.209.143
  • 2.23.209.140
  • 2.23.209.149
  • 2.23.209.144
  • 2.23.209.177
  • 2.23.209.183
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.175
  • 2.23.209.186
  • 2.23.209.181
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.160
  • 2.23.209.161
  • 2.23.209.158
  • 2.23.209.135
  • 2.23.209.193
  • 104.126.37.139
  • 104.126.37.137
  • 104.126.37.153
  • 104.126.37.146
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.130
  • 104.126.37.161
  • 104.126.37.136
  • 104.126.37.160
  • 104.126.37.138
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.iteptest.com
  • 3.208.48.141
  • 54.236.139.252
  • 184.28.89.167
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.44
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.iteptest.com/test_new_look_lockdown