File name:

71.exe

Full analysis: https://app.any.run/tasks/0e8bdbdf-4777-4159-b9a6-ec4d84800dab
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 06:10:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

82B7C7CC8062670F599CB984DD85492D

SHA1:

990A3BB7CD646B5CD57A096DA21C5881FE015DB0

SHA256:

DAD9DD7F3852729E23DD68C1B7F4DBDEB433A1F1561D8D57F78AE4FC8AF87DB2

SSDEEP:

12288:p2uUCPo8e7ZkrWme2r91GQu8zh+jUzlPCpi:p2uUGo8e7h2rbGQv0Upapi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 1280)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 6404)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 2096)
      • iexplore.exe (PID: 4284)
      • iexplore.exe (PID: 5812)
      • iexplore.exe (PID: 2340)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 1280)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 6404)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 2096)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 4284)
      • iexplore.exe (PID: 2340)
      • iexplore.exe (PID: 5812)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 1280)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 6404)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 2096)
      • iexplore.exe (PID: 5812)
      • iexplore.exe (PID: 2340)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 4284)

  • INFO

    • Checks supported languages

      • 71.exe (PID: 5256)
      • ielowutil.exe (PID: 6244)

    • The sample compiled with english language support

      • 71.exe (PID: 5256)

    • Reads the computer name

      • 71.exe (PID: 5256)
      • ielowutil.exe (PID: 6244)

    • Reads the software policy settings

      • slui.exe (PID: 496)
      • slui.exe (PID: 6852)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 976)

    • Checks proxy server information

      • slui.exe (PID: 6852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:08:30 09:55:31+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 261632
InitializedDataSize: 193536
UninitializedDataSize: -
EntryPoint: 0x17d80
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.5.87.22
ProductVersionNumber: 1.5.87.22
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Smellalways CellTrust
FileDescription: ShopWell
OriginalFileName: Win.exe
FileVersion: 1.5.87.22
LegalCopyright: Copyright (c) 2004-2017, Smellalways CellTrust
InternalName: ShopWell
ProductVersion: 1.5.87.22
ProductName: ShopWell
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
30
Malicious processes
14
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 71.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
456"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
496"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
664"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
976"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1280"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:976 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2096"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:208 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2104"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2108"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:664 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
47 259
Read events
46 968
Write events
241
Delete events
50

Modification events

(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{EFA31E8F-093F-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MAO Settings
Operation:writeName:DiscardLoadTimes
Value:
DB847CA30259DA01
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
Executable files
0
Suspicious files
50
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1280iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
976iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{EFA31E91-093F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:351749EB68CB44E173CF1F180339BA60
SHA256:5541C2F402956C393D111232895F0F22503926F2840BDA768D138569961D5982
5740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{08E2A07F-0940-11F0-B4ED-18F7786F96EE}.datbinary
MD5:CA065E29AF015473C93548018CD53657
SHA256:AD0DB05BE29D3C5899F99179E0E9D28FE9AEE2C6D45333633ED91A0A3EBFD952
5740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{08E2A081-0940-11F0-B4ED-18F7786F96EE}.datbinary
MD5:7F7EB7CC3D535C0F74671397DCF2FF7B
SHA256:CA3E50BEF6981D5BFD9B12BFF115E79081E243CD036B5C5B7F0E2B88B6A93F0D
5740iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE03388C4FFDA53CC.TMPbinary
MD5:9B02622A3D4B33ED5C5F5AF78C535947
SHA256:DF26E2A0707A6BDA0957DEE106D9D7B6AA51F828247BE5E34E84909B748850A5
6972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{15DBCC53-0940-11F0-B4ED-18F7786F96EE}.datbinary
MD5:65925D4619139ED2D01A4DB09647B241
SHA256:72EAD9C3A4E865A699C31341C14A8E8DBEFF95D23EEFD888324D092B061D1E28
6760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{22D75201-0940-11F0-B4ED-18F7786F96EE}.datbinary
MD5:6BEECF747170964280E4EFD74B91A059
SHA256:4B4139C95647CEDD8FA089E9EA7C343E7BA1A7729662BA78AAE9915A47A6FF41
6760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{22D751FF-0940-11F0-B4ED-18F7786F96EE}.datbinary
MD5:A530246F64DAC9E9D50E8413E71885B1
SHA256:FA200C2D627E389E81446699B524762D64AC219C2C22AA1CD3E46EC747824EB6
6972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{15DBCC51-0940-11F0-B4ED-18F7786F96EE}.datbinary
MD5:EF25B764D2265FC30DDEA3F4E1A9E7D6
SHA256:817232792CFEF1938B0DCA4E88956E5FFADB6B59B43233C6808E3F7110B9BA1E
208iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF4BAF7E0FA669A609.TMPbinary
MD5:50D75DA867CF58C2FC73330BE6FA6133
SHA256:3D276D5BB97DBF38CE5FE8A658334AFD88914AF54AC1516F4DEFB8121D76B91E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
89
DNS requests
30
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1280
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/NMb_2BZbhD8jbAYrDjf/aK66mk9CmwdvIyoxwK7Ade/4nOqjzeYp0BmH/WznoXHa4/upca4vp9s3StLa_2BEiEvDf/WDRJHsL5vh/SRpidOKC5LOGWLgw3/K8dHaFgcsyWJ/n1GVoWV_2Bj/zhlepvpKnBV59avVCtE_2F/S.avi
unknown
—
—
whitelisted
6752
iexplore.exe
GET
404
49.13.77.253:80
http://zuoashlyc.com/images/aKSWVlYp7wXHZahrP_2FXV6/3zNvGV7d_2/Fkk2F55q8Q8NYancw/knJ_2FLjX_2B/ByKkarGE_2F/HYkF5jcjtDQUGH/6CDqxMn41Mn5psggobi4d/d_2FLyLRleZyOMu7/1DNg8i8VJJG3PzQ/F4pQp_2BNiEps8Rq_2/B3Zmeark/u.avi
unknown
—
—
malicious
6404
iexplore.exe
GET
404
49.13.77.253:80
http://x4fwben.xyz/images/NRnBtMrCRyCAlNnR/oC2WcNXwoWdJR08/jlH_2F65xrVM_2F4NO/mJZD4pFu1/giyiht_2BejOZjEhJg8i/fiHUznjLsxWCtAFRdU_/2BpL_2FdHG68EYDPKEkCWe/y6jiCyEAcoLRU/zAEgw5Jy/TvDFEa_2B_2B_2FdeGYHncb/jEc.avi
unknown
—
—
malicious
3020
iexplore.exe
GET
404
49.13.77.253:80
http://rreynold77.club/images/EhlzrKeaUnEuz/r0LwIoBh/ngqb4HnyqDMgvIZLFom8_2B/SfExRSDiOL/Kp0NrQ_2FnjCUt9zx/DatZnfRGlVPn/6ZSVdsBQtKv/hXXlTNW12eaOFk/gQ6TcoXmxDEpZv67BHmPX/FSYo6KOV_2BQrL88/604CjF_2F/_2FUJP.avi
unknown
—
—
malicious
2096
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/91uDZpP3U/W1wM1x8Rx7EsSm4pSKQk/kY02rzYprOtIP3D7e_2/FI_2FjLnx0kAs6UfP6NeMJ/Z4FzMYlFQukae/cmPd_2Fa/i5E_2Bj8T_2FAkc90DO0Xvq/R_2Bw7k1TC/yhPxAwpF4BgE10PJV/yO0u7we4REc1/NHAXOw6mBNB/nroq5IjZhOs/i2uocGTs.avi
unknown
—
—
whitelisted
5812
iexplore.exe
GET
404
49.13.77.253:80
http://x4fwben.xyz/images/Royb7LWvuaHlv4OwQL/1GlYgmyAT/WZ7g5yjRA4dM1ib5yfV6/e01Zl0X7QY1lK29k6xg/5B_2BRdONYwVr4wRqYOszb/QMqYuecAwSFvT/gxCa_2BP/NMev3Ryf0YF5UHE2PMpoRza/L72kJBe0uw/i1_2BxVp2wo/5VQ.avi
unknown
—
—
malicious
3020
iexplore.exe
GET
404
49.13.77.253:80
http://zuoashlyc.com/images/XTuQl0jAMf/8W69b0ARy_2BTp5lU/3iCEmzk_2FZ9/p1xsufYZafs/pDzXQv7Y3YZwWs/76PBf9NR_2BtooBsMwUcF/FjSAhXyLjo8ocgcI/U1hGZKl15abLEuM/PdIXQRuTj_2F4bsSxU/oueyl2JEQ/evcIyIyf6/RzSeRT.avi
unknown
—
—
malicious
2340
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/vRY0sGI1z_2F/GIprw9ltie_/2Fch9DR2aa5tWt/VUO6yPJ0Ed7z79rbAJJ5e/DbIFnoQMjw4VZIv9/fSUJViIvGaTURAO/asPRM_2FvtdGAYYdT9/ve6_2FyfF/zeBzAcjWhsYrozfLVjoQ/6tCGp1NLWckdcGzej86/6CMhm6mzFgFqyy6eWzKNfm/AV.avi
unknown
—
—
whitelisted
2108
iexplore.exe
GET
404
49.13.77.253:80
http://rreynold77.club/images/ZPGgdo0FF/A0nLPQeNytQbkD82btpw/qnyN9dEogeGHhfwGpeb/AZoxPYzXpnUtdn_2Bo6Qiw/rpwcE6DKin8Mk/Vs7KGhHO/wC13eHqPhAZmwsylOQTid3W/e46lW41wUG/hlNIHq2nZRrHLPbjG/98wRuuInHn/o.avi
unknown
—
—
unknown
4284
iexplore.exe
GET
404
49.13.77.253:80
http://zuoashlyc.com/images/zceQgCFaQJ_2B0fh/nhD_2FRQgBSozEC/l8PwG2yNCRWKRA_2F3/akasfKA52/YYII_2B_2FJ02Nc9dSOi/Ny4SCkp1gbgb90O_2FD/WOKp596Vdzht7qo_2FFSFV/hJalTeCqCpuTz/HyKgtfGn/hihjOAENjJcy7hyIZhOjZP2/D.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1280
iexplore.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.46
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.0
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.131
  • 20.190.159.71
  • 40.126.31.2
whitelisted
arc.msn.com
  • 20.31.169.57
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
  • 2603:1030:800:5::bfee:a08d
whitelisted
198.187.3.20.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
1280
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6752
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6752
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6404
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6404
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
3020
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
3020
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2096
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
2096
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
3020
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
71.exe