File name:

1 (1466)

Full analysis: https://app.any.run/tasks/b13c0090-a6b1-4858-9328-84edd9f1e40d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 17:26:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ducdun
vilsel
stealer
upx
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 4 sections
MD5:

F73A992EAEA3E1594CED26118946FDE0

SHA1:

D3C9B3B28010FF6673C74927EA33458A49900AA7

SHA256:

D9A59C2F1E5B344C81F76C0E38E006DD7710F4E905D10C8F710D0809AE9E6FEE

SSDEEP:

6144:iRh/AfAGtUzbF68H3S8+b6uyptXIi9u/mp8saZHRD4v4M84Z9YkF/GeHNHyORQdB:a/AYGE68XS8+d8HamysaZHRD44M3ZzFK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DUCDUN mutex has been found

      • backup.exe (PID: 5280)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 7012)
      • backup.exe (PID: 1300)
      • backup.exe (PID: 6456)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 1660)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 5892)
      • backup.exe (PID: 1188)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 5800)
      • 1 (1466).exe (PID: 6480)
      • 1 (1466).exe (PID: 8060)

    • DUCDUN has been detected (YARA)

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5280)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • backup.exe (PID: 5072)
      • backup.exe (PID: 1300)
      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 3956)
      • 1 (1466).exe (PID: 8060)

    • Starts itself from another location

      • backup.exe (PID: 1300)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 6244)
      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 2904)

    • Creates file in the systems drive root

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5280)
      • 1 (1466).exe (PID: 8060)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 4892)

  • INFO

    • Create files in a temporary directory

      • backup.exe (PID: 5280)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 1300)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 7012)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 6456)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 1660)
      • backup.exe (PID: 1188)
      • backup.exe (PID: 5892)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 5800)
      • 1 (1466).exe (PID: 6480)
      • 1 (1466).exe (PID: 8060)

    • Checks supported languages

      • backup.exe (PID: 5280)
      • backup.exe (PID: 3956)
      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 7012)
      • backup.exe (PID: 4652)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 6456)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 1660)
      • backup.exe (PID: 2236)
      • backup.exe (PID: 5892)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 1188)
      • backup.exe (PID: 5800)
      • backup.exe (PID: 1300)
      • 1 (1466).exe (PID: 8060)
      • ShellExperienceHost.exe (PID: 4892)

    • The sample compiled with english language support

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5072)
      • backup.exe (PID: 3956)
      • backup.exe (PID: 4980)
      • backup.exe (PID: 2140)
      • backup.exe (PID: 3884)
      • backup.exe (PID: 4692)
      • backup.exe (PID: 6244)
      • backup.exe (PID: 2904)
      • backup.exe (PID: 1300)
      • 1 (1466).exe (PID: 8060)

    • Reads the computer name

      • backup.exe (PID: 4652)
      • backup.exe (PID: 2236)
      • 1 (1466).exe (PID: 6480)
      • 1 (1466).exe (PID: 8060)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7600)
      • BackgroundTransferHost.exe (PID: 7804)
      • BackgroundTransferHost.exe (PID: 7928)
      • BackgroundTransferHost.exe (PID: 7256)
      • BackgroundTransferHost.exe (PID: 5216)
      • BackgroundTransferHost.exe (PID: 1096)

    • UPX packer has been detected

      • 1 (1466).exe (PID: 6480)
      • backup.exe (PID: 5280)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7804)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7804)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7804)
      • slui.exe (PID: 6872)

    • Manual execution by a user

      • 1 (1466).exe (PID: 8060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (56.4)
.exe | Win64 Executable (generic) (19)
.exe | UPX compressed Win32 Executable (18.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Generic Win/DOS Executable (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2004:11:28 04:02:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 16384
InitializedDataSize: 24576
UninitializedDataSize: 65536
EntryPoint: 0x14b70
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.57
ProductVersionNumber: 1.0.0.57
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: SBC
ProductName: Microsoft Windows
FileVersion: 1.00.0057
ProductVersion: 1.00.0057
InternalName: musicvn
OriginalFileName: musicvn.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
33
Malicious processes
19
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DUCDUN 1 (1466).exe #DUCDUN backup.exe no specs #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe no specs #DUCDUN backup.exe no specs backup.exe no specs #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe #DUCDUN backup.exe no specs #DUCDUN backup.exe #DUCDUN backup.exe no specs #DUCDUN backup.exe no specs backup.exe no specs #DUCDUN backup.exe no specs #DUCDUN backup.exe update.exe no specs #DUCDUN backup.exe no specs sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #DUCDUN 1 (1466).exe slui.exe no specs shellexperiencehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
864C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1096"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1188C:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\backup.exe C:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\C:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\diagnostics\winword\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1300C:\Users\admin\AppData\Local\Temp\acrobat_sbx\backup.exe C:\Users\admin\AppData\Local\Temp\acrobat_sbx\C:\Users\admin\AppData\Local\Temp\acrobat_sbx\backup.exe
1 (1466).exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\acrobat_sbx\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1660C:\Users\admin\AppData\Local\Temp\Diagnostics\OUTLOOK\backup.exe C:\Users\admin\AppData\Local\Temp\Diagnostics\OUTLOOK\C:\Users\admin\AppData\Local\Temp\Diagnostics\OUTLOOK\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\diagnostics\outlook\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2140C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\backup.exe C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\acrord32_super_sbx\adobe\acrobat\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2236C:\Users\admin\AppData\Local\Temp\Low\backup.exe C:\Users\admin\AppData\Local\Temp\Low\C:\Users\admin\AppData\Local\Temp\Low\backup.exe—1 (1466).exe
User:
admin
Company:
SBC
Integrity Level:
LOW
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\low\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2904C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\backup.exe C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\backup.exe
1 (1466).exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\rar$dra988.30171\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
3884C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\backup.exe C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\acrord32_super_sbx\adobe\acrobat\dc\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
3956C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\backup.exe C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\backup.exe
backup.exe
User:
admin
Company:
SBC
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00.0057
Modules
Images
c:\users\admin\appdata\local\temp\acrobat_sbx\adobe\acrobat\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
4 628
Read events
4 567
Write events
42
Delete events
19

Modification events

(PID) Process:(6480) 1 (1466).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(6480) 1 (1466).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(1300) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(1300) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(5280) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(5280) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(3956) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(3956) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(7012) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(7012) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
Executable files
22
Suspicious files
35
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5072backup.exeC:\Users\admin\AppData\Local\Temp\~DF5032F9E1097EEA85.TMPbinary
MD5:7101145337F50AD56D19C0DAF302896F
SHA256:7E9BB9D26D1F5E1A9CF7EC6E2098404F679379E889B29984860972C414AD27C7
1300backup.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\backup.exeexecutable
MD5:B7A3A198880453C4215DA2FE8954722C
SHA256:46A61855FFD2F25D04C4F1AF124F7C963392F8C519F21D8F52AF0D3886900AAA
64801 (1466).exeC:\Users\admin\AppData\Local\Temp\backup.exeexecutable
MD5:598A5DC75E428D6D247CA71B8B928D78
SHA256:3725C705B17C0F647329FBC9118E69A4602BF9A20D43140BD89C24199C6B0007
4980backup.exeC:\Users\admin\AppData\Local\Temp\~DFD4572F1432599708.TMPbinary
MD5:6BEC94BD431F8B091BEFFFF87D00EA9E
SHA256:43BABDC142C273864EFDB5318EEC48FCAFF01083209A668BB462F6A12B51F870
64801 (1466).exeC:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\backup.exeexecutable
MD5:8446A2CC35EE6917F1D9830F6DD5CB4A
SHA256:AE14B699B57F43ADB5D715AB97AADBEAF03B59CACE88FDEB0153838779DC61BE
3956backup.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\backup.exeexecutable
MD5:FD697F4D9E26834FD0D0E0B1DDFE9A24
SHA256:2A4CFB27B3908C6A82B82C593B56B8DF0FE084E0351793DCCE47A8053213D45D
7012backup.exeC:\Users\admin\AppData\Local\Temp\~DF92D250FE3F578D4F.TMPbinary
MD5:9244AECE66393829E5697535F3B70C78
SHA256:28BEAA8DDA2BDA0FB3845D7DB67220BCFB85735D946E6553B4C455036B8E3672
2140backup.exeC:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\backup.exeexecutable
MD5:48DD7A9C993D4CEDCC111011B1050E99
SHA256:B2CA621B43D9C713B4404AB37B26494ABAAB91618DA976C46C6698DB0C3DB5E4
3956backup.exeC:\Users\admin\AppData\Local\Temp\~DF91CF5FFA6B9740B4.TMPbinary
MD5:DBF507CF6F92A1F047E4033C0666200B
SHA256:906E56BBFAA34CD89812CB6909580C29D513DC2F99A7B66699D980A2EA26BF3F
3884backup.exeC:\Users\admin\AppData\Local\Temp\~DFC80A18A881473F78.TMPbinary
MD5:FFA02ABC8FAA6D6F01E26BB968DDB87A
SHA256:4D43CCC6F567980F9CB5E39300BD58BD8B4C114A6A54AE454CED789A9EAF07CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
7804
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
7776
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
920
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
7776
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
unknown
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown
920
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
unknown
920
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown
7804
BackgroundTransferHost.exe
104.126.37.161:443
www.bing.com
Akamai International B.V.
DE
unknown
7804
BackgroundTransferHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
unknown
google.com
  • 142.250.185.206
unknown
client.wns.windows.com
  • 20.197.71.89
unknown
login.live.com
  • 20.190.160.20
  • 40.126.32.68
  • 20.190.160.131
  • 40.126.32.74
  • 20.190.160.4
  • 40.126.32.140
  • 20.190.160.5
  • 20.190.160.130
unknown
ocsp.digicert.com
  • 184.30.131.245
unknown
arc.msn.com
  • 20.199.58.43
unknown
www.bing.com
  • 104.126.37.161
  • 104.126.37.176
  • 104.126.37.184
  • 104.126.37.128
  • 104.126.37.185
  • 104.126.37.186
  • 104.126.37.162
  • 104.126.37.178
  • 104.126.37.170
unknown
settings-win.data.microsoft.com
  • 51.104.136.2
unknown
slscr.update.microsoft.com
  • 52.149.20.212
unknown
www.microsoft.com
  • 184.30.21.171
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (1466)