File name:

4.exe

Full analysis: https://app.any.run/tasks/12997012-6aca-4dc4-b1d5-aeb78d59f1af
Verdict: Malicious activity
Analysis date: February 16, 2025, 17:39:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

502117E1DE51E528EC8165773F56E717

SHA1:

40561926A9B979B7C21EB6F3388CC660FF9BABF5

SHA256:

D51FF16D8A29EDA56B63973206EF45CA498211AD0E0764053081980D54B6BD38

SSDEEP:

98304:jnm6UhDl6/koQwCE8t8ETSlFA51ubJ2Dum/x2vX3NVDJm013I7bCQqozefr/i8fz:vjHfJ8KwVH3TEKfld6Su

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • DriverSetup.exe (PID: 6800)
      • DriverSetup.exe (PID: 6596)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 4.exe (PID: 6412)
      • drvinst.exe (PID: 7112)
      • drvinst.exe (PID: 6280)
      • devsetup64.exe (PID: 6824)

    • Executable content was dropped or overwritten

      • 4.exe (PID: 6412)
      • drvinst.exe (PID: 6924)
      • drvinst.exe (PID: 6984)
      • devsetup64.exe (PID: 6824)
      • drvinst.exe (PID: 7044)
      • drvinst.exe (PID: 7080)
      • drvinst.exe (PID: 7016)
      • drvinst.exe (PID: 7112)
      • drvinst.exe (PID: 6280)
      • drvinst.exe (PID: 444)
      • drvinst.exe (PID: 6204)

    • Reads security settings of Internet Explorer

      • 4.exe (PID: 6412)

    • Drops a system driver (possible attempt to evade defenses)

      • 4.exe (PID: 6412)
      • drvinst.exe (PID: 6924)
      • drvinst.exe (PID: 6984)
      • drvinst.exe (PID: 7044)
      • drvinst.exe (PID: 7016)
      • drvinst.exe (PID: 7080)
      • drvinst.exe (PID: 444)
      • drvinst.exe (PID: 6204)
      • devsetup64.exe (PID: 6824)

    • Creates files in the driver directory

      • drvinst.exe (PID: 6924)
      • drvinst.exe (PID: 6984)
      • drvinst.exe (PID: 7044)
      • drvinst.exe (PID: 7016)
      • drvinst.exe (PID: 7080)
      • drvinst.exe (PID: 7112)
      • drvinst.exe (PID: 6280)
      • drvinst.exe (PID: 6568)
      • drvinst.exe (PID: 6204)
      • drvinst.exe (PID: 444)
      • devsetup64.exe (PID: 6824)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 6924)
      • drvinst.exe (PID: 7044)
      • drvinst.exe (PID: 6984)
      • drvinst.exe (PID: 7016)
      • drvinst.exe (PID: 7080)
      • drvinst.exe (PID: 7112)
      • drvinst.exe (PID: 6280)
      • drvinst.exe (PID: 6568)
      • drvinst.exe (PID: 6204)
      • drvinst.exe (PID: 444)

    • There is functionality for taking screenshot (YARA)

      • 4.exe (PID: 6412)

    • Creates or modifies Windows services

      • devsetup64.exe (PID: 6824)

  • INFO

    • Reads the computer name

      • 4.exe (PID: 6412)
      • devsetup64.exe (PID: 6824)
      • drvinst.exe (PID: 6924)
      • drvinst.exe (PID: 7016)
      • drvinst.exe (PID: 7044)
      • drvinst.exe (PID: 6984)
      • drvinst.exe (PID: 7080)
      • drvinst.exe (PID: 7112)
      • drvinst.exe (PID: 6280)
      • drvinst.exe (PID: 444)
      • drvinst.exe (PID: 6204)
      • drvinst.exe (PID: 6568)
      • DriverSetup.exe (PID: 6800)

    • Create files in a temporary directory

      • 4.exe (PID: 6412)
      • devsetup64.exe (PID: 6824)

    • The sample compiled with chinese language support

      • 4.exe (PID: 6412)

    • The sample compiled with english language support

      • 4.exe (PID: 6412)
      • drvinst.exe (PID: 7112)
      • devsetup64.exe (PID: 6824)
      • drvinst.exe (PID: 6280)
      • drvinst.exe (PID: 6204)

    • Process checks computer location settings

      • 4.exe (PID: 6412)

    • Checks supported languages

      • 4.exe (PID: 6412)
      • DriverSetup.exe (PID: 6800)
      • devsetup64.exe (PID: 6824)
      • drvinst.exe (PID: 6924)
      • drvinst.exe (PID: 6984)
      • drvinst.exe (PID: 7044)
      • drvinst.exe (PID: 7080)
      • drvinst.exe (PID: 7016)
      • drvinst.exe (PID: 6568)
      • drvinst.exe (PID: 7112)
      • drvinst.exe (PID: 6280)
      • drvinst.exe (PID: 444)
      • drvinst.exe (PID: 6204)

    • Reads CPU info

      • devsetup64.exe (PID: 6824)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 6924)
      • drvinst.exe (PID: 6984)
      • drvinst.exe (PID: 7044)
      • drvinst.exe (PID: 7016)
      • drvinst.exe (PID: 7080)
      • drvinst.exe (PID: 7112)
      • drvinst.exe (PID: 6280)
      • drvinst.exe (PID: 6568)
      • drvinst.exe (PID: 444)
      • drvinst.exe (PID: 6204)

    • Reads the software policy settings

      • drvinst.exe (PID: 6924)
      • drvinst.exe (PID: 6984)
      • drvinst.exe (PID: 7016)
      • drvinst.exe (PID: 7044)
      • drvinst.exe (PID: 7080)
      • drvinst.exe (PID: 7112)
      • drvinst.exe (PID: 6568)
      • drvinst.exe (PID: 6280)
      • drvinst.exe (PID: 444)
      • drvinst.exe (PID: 6204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:08:11 13:54:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 188928
InitializedDataSize: 83456
UninitializedDataSize: -
EntryPoint: 0x1cec9
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
14
Malicious processes
13
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 4.exe driversetup.exe no specs driversetup.exe devsetup64.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe drvinst.exe no specs drvinst.exe drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
444DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{19cb4342-7b67-2d4a-8066-88c2ccb0d81b}\hw_usbvcom.inf" "9" "40f19cedf" "000000000000022C" "WinSta0\Default" "0000000000000228" "208" "C:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6204DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{ceccd953-233d-594e-b164-072b97732c98}\ew_usbccgpfilter.inf" "9" "43fb94187" "0000000000000238" "WinSta0\Default" "0000000000000234" "208" "C:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6280DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{add2e9fb-7d99-c94a-bc39-563918604874}\hw_gohdb.inf" "9" "43b3eccaf" "0000000000000204" "WinSta0\Default" "0000000000000210" "208" "C:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6412"C:\Users\admin\Desktop\4.exe" C:\Users\admin\Desktop\4.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\version.dll
6568DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{e5886815-60cc-db41-90e8-fb6bea974d12}\cdc-acm.inf" "9" "4e2e9b6a7" "0000000000000208" "WinSta0\Default" "0000000000000224" "208" "C:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6596"C:\Users\admin\AppData\Local\Temp\RarSFX0\DriverSetup.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\DriverSetup.exe—4.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\driversetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6800"C:\Users\admin\AppData\Local\Temp\RarSFX0\DriverSetup.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\DriverSetup.exe
4.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\driversetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6824 /install /debugC:\Users\admin\AppData\Local\Temp\RarSFX0\devsetup64.exe
DriverSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Huawei(R) DevSetup Version 1.03.01.00 for Windows XP, Vista, Win7.
Exit code:
0
Version:
1.03.01.00
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\devsetup64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6924DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{22358449-da1e-964c-9d31-d2d77b5b1489}\hw_usbdev.inf" "9" "40aa5d6b7" "00000000000001D8" "WinSta0\Default" "00000000000001EC" "208" "C:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6984DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{abc15ee1-2178-3049-8662-b1c5833b1fb3}\diagswitchdrv.inf" "9" "4e8d9997f" "00000000000001EC" "WinSta0\Default" "00000000000001E4" "208" "C:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
31 697
Read events
31 300
Write events
388
Delete events
9

Modification events

(PID) Process:(6800) DriverSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant
Operation:writeName:ExecutablesToExclude
Value:
C:\Users\admin\AppData\Local\Temp\RarSFX0\DriverSetup.exe
(PID) Process:(6824) devsetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Huawei technologies\CurrentHandSetProductLineDriver
Operation:delete keyName:(default)
Value:
(PID) Process:(6824) devsetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Huawei technologies\CurrentHandSetProductLineDriver
Operation:writeName:MajorVersion
Value:
201
(PID) Process:(6824) devsetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Huawei technologies\CurrentHandSetProductLineDriver
Operation:writeName:MinorVersion
Value:
2
(PID) Process:(6824) devsetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Huawei technologies\CurrentHandSetProductLineDriver
Operation:writeName:Customization
Value:
0
(PID) Process:(6824) devsetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Huawei technologies\CurrentHandSetProductLineDriver\SysInfo\hw_quusbmdm.sys
Operation:writeName:MajorVersion
Value:
2067
(PID) Process:(6824) devsetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Huawei technologies\CurrentHandSetProductLineDriver\SysInfo\hw_quusbmdm.sys
Operation:writeName:MinorVersion
Value:
25
(PID) Process:(6824) devsetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Huawei technologies\CurrentHandSetProductLineDriver\InfInfo\hw_qumdm.inf
Operation:writeName:MajorVersion
Value:
2067
(PID) Process:(6824) devsetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Huawei technologies\CurrentHandSetProductLineDriver\InfInfo\hw_qumdm.inf
Operation:writeName:MinorVersion
Value:
25
(PID) Process:(6824) devsetup64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HWHandSet
Operation:delete valueName:QCDriverResident
Value:
Executable files
83
Suspicious files
114
Text files
6
Unknown types
19

Dropped files

PID
Process
Filename
Type
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\install.xmltext
MD5:5C3447227277362D74CBD2AF3240AABD
SHA256:A16E1AED7A61362FC27499D4EEE1089BB454C9538CA3519B971E6F4F04A53923
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64\cdc-acm.infbinary
MD5:CD434B795E352ADD89C25AA81D07C202
SHA256:6AA19CADCA06A860E541A704E2FC3E2E2BD02514E2C1EB11F1EB4F99697C0A75
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64\androidwinusb.catbinary
MD5:B6FEA7C03FEA019DFC6420178BF3ACEE
SHA256:B3EECCF25AE9A5CE10D92454B631238DC5CA52096EA1E6E844302D5FF847E438
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64\diagswitchdrv.infbinary
MD5:660ED8B2DA6803F10CFBB94DB000EB19
SHA256:27E651D140FB94A0326AC5529CC1F111B936B8A21FE68111DBACD1DCE1ABDDB4
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64\ew_usbccgpfilter.infbinary
MD5:1A38511B68AACD7BBD10FF07E8C2C56A
SHA256:19B66E6AA92A664A9194062C04E5D30C061DD0FBDBD5C5AE56110479E8B5DAA6
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64\ew_ccgpfilter.catbinary
MD5:203EDB1AE45A44CEDD648BB8CE43569A
SHA256:56750B8BA28C52C40ACAAE10E4BC19BC36FE2C757DD405F3151732D7B8051A4A
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64\hw_ctrlfakedev.sysexecutable
MD5:7CC36B492E83CE13389CF1266FE11554
SHA256:245F02BEF8FD506784BC24A3C2F10E54569D05BC71E2C6D3960BC10E39B02380
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64\hw_ctrlfakedev.infbinary
MD5:B79596869E5D81F8B09E7C67568D0B64
SHA256:7FE2B2A050FCA349848D27197C45395E5F2D744A2AFB927BBEF1547CF95738FB
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64\hw_ctrlfakedeva64.catcat
MD5:557019C1B43EA7641E389705774A3CCD
SHA256:15C4CFE4AF81C5443B2BAB1834535AB1032BD6810496052D45B044999721EB76
64124.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Driver\X64\diagswitchdrv.sysexecutable
MD5:FA62B2F7094AB0EC0FA912F788961EFC
SHA256:29F22A4295516622F0ABE5B33091560C49E9A5F28D30647DBF8D26DC91CFA334
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
34
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
svchost.exe
GET
200
23.48.23.162:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3040
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
104.75.232.13:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6904
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6904
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5788
backgroundTaskHost.exe
GET
200
104.75.232.13:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
92.123.104.59:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3040
svchost.exe
23.48.23.162:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3040
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5096
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3040
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
92.123.104.59:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
www.bing.com
  • 92.123.104.59
  • 92.123.104.32
  • 92.123.104.38
  • 92.123.104.62
  • 92.123.104.33
  • 92.123.104.28
whitelisted
ocsp.digicert.com
  • 23.54.109.203
  • 104.75.232.13
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.48.23.162
  • 23.48.23.167
  • 23.48.23.183
  • 23.48.23.169
  • 23.48.23.180
  • 23.48.23.161
  • 23.48.23.158
  • 23.48.23.166
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.160.65
  • 40.126.32.138
  • 20.190.160.131
  • 20.190.160.67
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.14
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info