File name:

utox_x86_64.exe

Full analysis: https://app.any.run/tasks/b19f28dd-b69b-4494-aa93-f75c95c38c13
Verdict: Malicious activity
Analysis date: January 29, 2025, 16:03:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 21 sections
MD5:

E9679980AA73CFC7CF00F3DA7949C661

SHA1:

53BA9E3A3A10AE0E72DF4B3632D8D4135EB540B6

SHA256:

D7BD224B2EF0014C679046C917BECFFACE5F5ABA2FBDB7DD3C17FE964C3CEE97

SSDEEP:

98304:uVS4lyfvsVqltyD5DhADNlXQ2orLmKeLDCVvANLA1pOuI8F7fqLmLhPR6x7:vkPD52

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • utox_x86_64.exe (PID: 2940)

    • Connects to unusual port

      • utox_x86_64.exe (PID: 2940)
      • qtox.exe (PID: 7972)

    • Uses ICACLS.EXE to modify access control lists

      • setup-qtox-x86_64-release.exe (PID: 7528)

    • Executable content was dropped or overwritten

      • setup-qtox-x86_64-release.exe (PID: 7528)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • setup-qtox-x86_64-release.exe (PID: 7528)

    • Creates a software uninstall entry

      • setup-qtox-x86_64-release.exe (PID: 7528)

  • INFO

    • The sample compiled with english language support

      • utox_x86_64.exe (PID: 2940)
      • firefox.exe (PID: 3544)
      • setup-qtox-x86_64-release.exe (PID: 7528)

    • Creates files or folders in the user directory

      • utox_x86_64.exe (PID: 2940)
      • qtox.exe (PID: 7972)

    • Manual execution by a user

      • firefox.exe (PID: 4716)
      • qtox.exe (PID: 7972)

    • Reads the computer name

      • utox_x86_64.exe (PID: 2940)
      • qtox.exe (PID: 7972)
      • setup-qtox-x86_64-release.exe (PID: 7528)

    • Application launched itself

      • firefox.exe (PID: 4716)
      • firefox.exe (PID: 3544)

    • Checks supported languages

      • utox_x86_64.exe (PID: 2940)
      • setup-qtox-x86_64-release.exe (PID: 7528)
      • qtox.exe (PID: 7972)

    • Reads the machine GUID from the registry

      • qtox.exe (PID: 7972)

    • Creates files in the program directory

      • setup-qtox-x86_64-release.exe (PID: 7528)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3544)

    • Create files in a temporary directory

      • setup-qtox-x86_64-release.exe (PID: 7528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.2)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2021:01:24 11:50:56+00:00
ImageFileCharacteristics: Executable, No line numbers, Large address aware
PEType: PE32+
LinkerVersion: 2.34
CodeSize: 2740224
InitializedDataSize: 3421696
UninitializedDataSize: 1439232
EntryPoint: 0x14b0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 0.18.1.0
ProductVersionNumber: 0.18.1.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: uTox
FileDescription: The lightweight Tox client
FileVersion: 0.18.1
InternalName: uTox
LegalCopyright: Copyleft 2021 uTox contributors. Some rights reserved.
OriginalFileName: uTox.exe
ProductName: uTox
ProductVersion: 0.18.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
23
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start utox_x86_64.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs setup-qtox-x86_64-release.exe no specs setup-qtox-x86_64-release.exe icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs qtox.exe firefox.exe no specs firefox.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
876"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2784 -childID 3 -isForBrowser -prefsHandle 5028 -prefMapHandle 5032 -prefsLen 31144 -prefMapSize 244583 -jsInitHandle 1532 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {979db468-4bab-4adc-b3f3-43eebe4c7c09} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 1ba58b33d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2940"C:\Users\admin\AppData\Local\Temp\utox_x86_64.exe" C:\Users\admin\AppData\Local\Temp\utox_x86_64.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\utox_x86_64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3544"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3584"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -childID 6 -isForBrowser -prefsHandle 5628 -prefMapHandle 4664 -prefsLen 31198 -prefMapSize 244583 -jsInitHandle 1532 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fea02434-e999-4948-83df-baf7885f51fb} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 1ba58d95150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3952"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5044 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 5056 -prefMapHandle 5052 -prefsLen 36588 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99af3516-934a-4d38-b8e2-4a8d35a3bde7} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 1ba57aecd10 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
3996"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4960 -childID 4 -isForBrowser -prefsHandle 4916 -prefMapHandle 5016 -prefsLen 31144 -prefMapSize 244583 -jsInitHandle 1532 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45be2ab5-aa4a-434f-ad3c-e4be457fd1e9} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 1ba58b33f50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4224"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5204 -childID 9 -isForBrowser -prefsHandle 5272 -prefMapHandle 4900 -prefsLen 32063 -prefMapSize 244583 -jsInitHandle 1532 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60aa826e-2514-457d-bdb5-d896101aafa0} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 1ba54720690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4520"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2152 -parentBuildID 20240213221259 -prefsHandle 2144 -prefMapHandle 2140 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b2354bd-29de-4919-9ddf-181f7aab9a7b} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 1ba41b82710 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
4536"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 5 -isForBrowser -prefsHandle 5148 -prefMapHandle 5140 -prefsLen 31144 -prefMapSize 244583 -jsInitHandle 1532 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93bdeeb6-9f68-41b7-b6f0-d238f1c0f3ec} 3544 "\\.\pipe\gecko-crash-server-pipe.3544" 1ba58e12150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
23 670
Read events
23 625
Write events
44
Delete events
1

Modification events

(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000E0000000300000000000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Operation:writeName:MRUListEx
Value:
040000000000000005000000020000000100000003000000FFFFFFFF
(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\Shell
Operation:writeName:SniffedFolderType
Value:
Documents
(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
105
(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
6F519A6700000000
(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:Mode
Value:
4
(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:LogicalViewMode
Value:
1
(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:FFlags
Value:
(PID) Process:(2940) utox_x86_64.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:IconSize
Value:
16
Executable files
118
Suspicious files
199
Text files
50
Unknown types
2

Dropped files

PID
Process
Filename
Type
3544firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3544firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3544firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:2C99A16AED3906D92FFE3EF1808E2753
SHA256:08412578CC3BB4922388F8FF8C23962F616B69A1588DA720ADE429129C73C452
3544firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3544firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3544firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.tmpbinary
MD5:F759EB25271E6A6F0A3500520813E5FE
SHA256:015E515D432DD64FDC9502ABE9C723EEF544E7AF11C36BDFE8B38412597CA1EC
3544firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.binbinary
MD5:697BF2874722C80290DA78CDFB507830
SHA256:E70E06AB0E4DC77E7ADB4C4F9BB7A4B49062308FC7468846EF47476CC178C76F
3544firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-child-current.binbinary
MD5:C95DDC2B1A525D1A243E4C294DA2F326
SHA256:3A5919E086BFB31E36110CF636D2D5109EB51F2C410B107F126126AB25D67363
3544firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
3544firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
376
DNS requests
171
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3928
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3928
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
2.16.241.8:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
142.250.186.35:80
http://o.pki.goog/s/wr3/jLM
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
2.16.241.8:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
142.250.186.35:80
http://o.pki.goog/wr2
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
2.16.168.8:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
2.16.168.8:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
142.250.186.35:80
http://o.pki.goog/wr2
unknown
—
—
whitelisted
3544
firefox.exe
POST
200
142.250.186.35:80
http://o.pki.goog/wr2
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
3928
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3928
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2940
utox_x86_64.exe
194.249.212.109:33445
—
—
—
unknown
—
—
255.255.255.255:33446
—
—
—
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.22
  • 20.190.160.14
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET INFO Tox Chat Domain in DNS Lookup (tox .chat)
2192
svchost.exe
Misc activity
ET INFO Tox Chat Domain in DNS Lookup (tox .chat)
2192
svchost.exe
Misc activity
ET INFO Tox Chat Domain in DNS Lookup (tox .chat)
2192
svchost.exe
Misc activity
ET INFO Tox Chat Domain in DNS Lookup (tox .chat)
3544
firefox.exe
Misc activity
ET INFO Observed Tox Chat Domain (tox .chat in TLS SNI)
3544
firefox.exe
Misc activity
ET INFO Observed Tox Chat Domain (tox .chat in TLS SNI)
7972
qtox.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 14
7972
qtox.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image Sharing Service (imgur.com)
Process
Message
setup-qtox-x86_64-release.exe
ExecShellAsUser: got desktop
setup-qtox-x86_64-release.exe
ExecShellAsUser: elevated process detected
setup-qtox-x86_64-release.exe
ExecShellAsUser: thread finished
setup-qtox-x86_64-release.exe
ExecShellAsUser: DLL_PROCESS_DETACH
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
utox_x86_64.exe