File name:

1 (1466)

Full analysis: https://app.any.run/tasks/b13c0090-a6b1-4858-9328-84edd9f1e40d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 17:26:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ducdun
vilsel
stealer
upx
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 4 sections
MD5:

F73A992EAEA3E1594CED26118946FDE0

SHA1:

D3C9B3B28010FF6673C74927EA33458A49900AA7

SHA256:

D9A59C2F1E5B344C81F76C0E38E006DD7710F4E905D10C8F710D0809AE9E6FEE

SSDEEP:

6144:iRh/AfAGtUzbF68H3S8+b6uyptXIi9u/mp8saZHRD4v4M84Z9YkF/GeHNHyORQdB:a/AYGE68XS8+d8HamysaZHRD44M3ZzFK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DUCDUN mutex has been found

      • backup.exe (PID: 5280)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 1300)
      • backup.exe (PID: 7012)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 6456)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 1660)
      • backup.exe (PID: 1188)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 5892)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 5800)
      • 1 (1466).exe (PID: 6480)
      • 1 (1466).exe (PID: 8060)

    • DUCDUN has been detected (YARA)

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5280)

  • SUSPICIOUS

    • Starts itself from another location

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 1300)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 4980)

    • Executable content was dropped or overwritten

      • backup.exe (PID: 5072)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 1300)
      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 2904)
      • 1 (1466).exe (PID: 8060)

    • Creates file in the systems drive root

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5280)
      • 1 (1466).exe (PID: 8060)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 4892)

  • INFO

    • Checks supported languages

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5280)
      • backup.exe (PID: 1300)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 4652)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 7012)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 6456)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 1660)
      • backup.exe (PID: 1188)
      • backup.exe (PID: 2236)
      • backup.exe (PID: 5892)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 5800)
      • backup.exe (PID: 4692)
      • 1 (1466).exe (PID: 8060)
      • ShellExperienceHost.exe (PID: 4892)

    • The sample compiled with english language support

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 1300)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 4980)
      • 1 (1466).exe (PID: 8060)

    • Create files in a temporary directory

      • backup.exe (PID: 5280)
      • backup.exe (PID: 1300)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 7012)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 6456)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 1660)
      • backup.exe (PID: 1188)
      • backup.exe (PID: 5892)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 5800)
      • 1 (1466).exe (PID: 6480)
      • 1 (1466).exe (PID: 8060)

    • Reads the computer name

      • backup.exe (PID: 2236)
      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 4652)
      • 1 (1466).exe (PID: 8060)

    • UPX packer has been detected

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5280)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7600)
      • BackgroundTransferHost.exe (PID: 7928)
      • BackgroundTransferHost.exe (PID: 7256)
      • BackgroundTransferHost.exe (PID: 5216)
      • BackgroundTransferHost.exe (PID: 1096)
      • BackgroundTransferHost.exe (PID: 7804)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7804)
      • slui.exe (PID: 6872)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7804)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7804)

    • Manual execution by a user

      • 1 (1466).exe (PID: 8060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (56.4)
.exe | Win64 Executable (generic) (19)
.exe | UPX compressed Win32 Executable (18.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Generic Win/DOS Executable (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2004:11:28 04:02:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 16384
InitializedDataSize: 24576
UninitializedDataSize: 65536
EntryPoint: 0x14b70
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.57
ProductVersionNumber: 1.0.0.57
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: SBC
ProductName: Microsoft Windows
FileVersion: 1.00.0057
ProductVersion: 1.00.0057
InternalName: musicvn
OriginalFileName: musicvn.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
33
Malicious processes
19
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DUCDUN 1 (1466).exe #DUCDUN backup.exe no specs #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe no specs #DUCDUN backup.exe no specs backup.exe no specs #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe no specs #DUCDUN backup.exe #DUCDUN backup.exe no specs #DUCDUN backup.exe no specs backup.exe no specs #DUCDUN backup.exe no specs #DUCDUN backup.exe update.exe no specs #DUCDUN backup.exe no specs sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #DUCDUN 1 (1466).exe slui.exe no specs shellexperiencehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
864C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1096"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1188C:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\backup.exe C:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\C:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\diagnostics\winword\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1300C:\Users\admin\AppData\Local\Temp\acrobat_sbx\backup.exe C:\Users\admin\AppData\Local\Temp\acrobat_sbx\C:\Users\admin\AppData\Local\Temp\acrobat_sbx\backup.exe
1 (1466).exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\acrobat_sbx\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1660C:\Users\admin\AppData\Local\Temp\Diagnostics\OUTLOOK\backup.exe C:\Users\admin\AppData\Local\Temp\Diagnostics\OUTLOOK\C:\Users\admin\AppData\Local\Temp\Diagnostics\OUTLOOK\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\diagnostics\outlook\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2140C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\backup.exe C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\acrord32_super_sbx\adobe\acrobat\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2236C:\Users\admin\AppData\Local\Temp\Low\backup.exe C:\Users\admin\AppData\Local\Temp\Low\C:\Users\admin\AppData\Local\Temp\Low\backup.exe—1 (1466).exe
User:
admin
Company:
SBC
Integrity Level:
LOW
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\low\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2904C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\backup.exe C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\backup.exe
1 (1466).exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\rar$dra988.30171\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
3884C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\backup.exe C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\acrord32_super_sbx\adobe\acrobat\dc\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
3956C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\backup.exe C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\acrobat_sbx\adobe\acrobat\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
4 628
Read events
4 567
Write events
42
Delete events
19

Modification events

(PID) Process:(6480) 1 (1466).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(6480) 1 (1466).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(1300) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(1300) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(5280) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(5280) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(3956) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(3956) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(7012) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(7012) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
Executable files
22
Suspicious files
35
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
64801 (1466).exeC:\Users\admin\AppData\Local\Temp\backup.exeexecutable
MD5:598A5DC75E428D6D247CA71B8B928D78
SHA256:3725C705B17C0F647329FBC9118E69A4602BF9A20D43140BD89C24199C6B0007
64801 (1466).exeC:\Users\admin\AppData\Local\Temp\{9EE293E3-390D-48FF-A2D0-59F3E2EC8873}\backup.exeexecutable
MD5:598A5DC75E428D6D247CA71B8B928D78
SHA256:3725C705B17C0F647329FBC9118E69A4602BF9A20D43140BD89C24199C6B0007
4980backup.exeC:\Users\admin\AppData\Local\Temp\~DFD4572F1432599708.TMPbinary
MD5:6BEC94BD431F8B091BEFFFF87D00EA9E
SHA256:43BABDC142C273864EFDB5318EEC48FCAFF01083209A668BB462F6A12B51F870
5072backup.exeC:\Users\admin\AppData\Local\Temp\~DF5032F9E1097EEA85.TMPbinary
MD5:7101145337F50AD56D19C0DAF302896F
SHA256:7E9BB9D26D1F5E1A9CF7EC6E2098404F679379E889B29984860972C414AD27C7
1300backup.exeC:\Users\admin\AppData\Local\Temp\~DF445D12236A8D3AAE.TMPbinary
MD5:F0525528B6222FB59DC8361A0DF23674
SHA256:D62A4DE3CE1D0DC6D53A3017AC0F12413D2D9FE1765B7D882F10B01BA2A91468
64801 (1466).exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\backup.exeexecutable
MD5:598A5DC75E428D6D247CA71B8B928D78
SHA256:3725C705B17C0F647329FBC9118E69A4602BF9A20D43140BD89C24199C6B0007
3956backup.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\backup.exeexecutable
MD5:FD697F4D9E26834FD0D0E0B1DDFE9A24
SHA256:2A4CFB27B3908C6A82B82C593B56B8DF0FE084E0351793DCCE47A8053213D45D
3884backup.exeC:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\backup.exeexecutable
MD5:2C50547B77C02E49AB888B619DD2AD3F
SHA256:F372FBE6C189CDFAECDB7FC0866CEE4C6474C4730E475B02C9AFC4CC982E0A5E
1300backup.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\backup.exeexecutable
MD5:B7A3A198880453C4215DA2FE8954722C
SHA256:46A61855FFD2F25D04C4F1AF124F7C963392F8C519F21D8F52AF0D3886900AAA
1300backup.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\backup.exeexecutable
MD5:B7A3A198880453C4215DA2FE8954722C
SHA256:46A61855FFD2F25D04C4F1AF124F7C963392F8C519F21D8F52AF0D3886900AAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
7804
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
7776
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
920
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
7776
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
unknown
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown
920
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
unknown
920
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown
7804
BackgroundTransferHost.exe
104.126.37.161:443
www.bing.com
Akamai International B.V.
DE
unknown
7804
BackgroundTransferHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
unknown
google.com
  • 142.250.185.206
unknown
client.wns.windows.com
  • 20.197.71.89
unknown
login.live.com
  • 20.190.160.20
  • 40.126.32.68
  • 20.190.160.131
  • 40.126.32.74
  • 20.190.160.4
  • 40.126.32.140
  • 20.190.160.5
  • 20.190.160.130
unknown
ocsp.digicert.com
  • 184.30.131.245
unknown
arc.msn.com
  • 20.199.58.43
unknown
www.bing.com
  • 104.126.37.161
  • 104.126.37.176
  • 104.126.37.184
  • 104.126.37.128
  • 104.126.37.185
  • 104.126.37.186
  • 104.126.37.162
  • 104.126.37.178
  • 104.126.37.170
unknown
settings-win.data.microsoft.com
  • 51.104.136.2
unknown
slscr.update.microsoft.com
  • 52.149.20.212
unknown
www.microsoft.com
  • 184.30.21.171
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (1466)