File name:

71.exe

Full analysis: https://app.any.run/tasks/0e8bdbdf-4777-4159-b9a6-ec4d84800dab
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 06:10:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

82B7C7CC8062670F599CB984DD85492D

SHA1:

990A3BB7CD646B5CD57A096DA21C5881FE015DB0

SHA256:

DAD9DD7F3852729E23DD68C1B7F4DBDEB433A1F1561D8D57F78AE4FC8AF87DB2

SSDEEP:

12288:p2uUCPo8e7ZkrWme2r91GQu8zh+jUzlPCpi:p2uUGo8e7h2rbGQv0Upapi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 1280)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 6404)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 5812)
      • iexplore.exe (PID: 2096)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 2340)
      • iexplore.exe (PID: 4284)

    • Connects to the CnC server

      • iexplore.exe (PID: 1280)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 6404)
      • iexplore.exe (PID: 2096)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 5812)
      • iexplore.exe (PID: 2340)
      • iexplore.exe (PID: 4284)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 1280)
      • iexplore.exe (PID: 6752)
      • iexplore.exe (PID: 6404)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 2340)
      • iexplore.exe (PID: 5812)
      • iexplore.exe (PID: 2096)
      • iexplore.exe (PID: 4284)

  • INFO

    • The sample compiled with english language support

      • 71.exe (PID: 5256)

    • Checks supported languages

      • 71.exe (PID: 5256)
      • ielowutil.exe (PID: 6244)

    • Reads the computer name

      • 71.exe (PID: 5256)
      • ielowutil.exe (PID: 6244)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 976)

    • Reads the software policy settings

      • slui.exe (PID: 496)
      • slui.exe (PID: 6852)

    • Checks proxy server information

      • slui.exe (PID: 6852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:08:30 09:55:31+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 261632
InitializedDataSize: 193536
UninitializedDataSize: -
EntryPoint: 0x17d80
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.5.87.22
ProductVersionNumber: 1.5.87.22
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Smellalways CellTrust
FileDescription: ShopWell
OriginalFileName: Win.exe
FileVersion: 1.5.87.22
LegalCopyright: Copyright (c) 2004-2017, Smellalways CellTrust
InternalName: ShopWell
ProductVersion: 1.5.87.22
ProductName: ShopWell
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
30
Malicious processes
14
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 71.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
456"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
496"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
664"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
976"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1280"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:976 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2096"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:208 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2104"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2108"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:664 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
47 259
Read events
46 968
Write events
241
Delete events
50

Modification events

(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{EFA31E8F-093F-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MAO Settings
Operation:writeName:DiscardLoadTimes
Value:
DB847CA30259DA01
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(976) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
Executable files
0
Suspicious files
50
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
976iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD0CC2B1074B8D14F.TMPbinary
MD5:1EA06959AF0DE871EFB439874658B525
SHA256:A7690AA4CB0BC2C327F76D390E0B765268881BA4DBD9F07346ECDC4CBC974D6E
5740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{08E2A07F-0940-11F0-B4ED-18F7786F96EE}.datbinary
MD5:CA065E29AF015473C93548018CD53657
SHA256:AD0DB05BE29D3C5899F99179E0E9D28FE9AEE2C6D45333633ED91A0A3EBFD952
5740iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF990B3B435E155F30.TMPbinary
MD5:FBBC62CAE726094912AB7C0CF29FCF86
SHA256:874567F86C3D7CF667F563BFD0C3E004FE4DE97AD20714DEA4C4CBF9F6E4FAA2
1280iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:96006FF404E82A48E7D3C85F24E6CA33
SHA256:E2ED441A2605F699AE0430245FF8EDAE3CFEEDD8D80FBC0A6A510FCDD3E1C6BD
1280iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
976iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC9A52E311BA239DF.TMPbinary
MD5:25D3066861D3AF7568BA125537FE03AD
SHA256:0953921CCB57A7EDB4DD4BD8EAD1AFE10FBA54E43B03BA3929850F9EDED0E9D1
976iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{EFA31E8F-093F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:43B1B1763ED3071F82BBFEB14FC54D06
SHA256:83FFF9AA5FBC0ACA294B2A955F2C1EB81056D57F17837956A938ABB977AD6E9F
6972iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3F2D53608E76E523.TMPbinary
MD5:65A0D4CFC1AE7C469B21AA48BDE84A06
SHA256:9AD910A3CA95A3F0B6CA1A972595B40763256700463EA466F55132E5993D6DC7
6972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{15DBCC53-0940-11F0-B4ED-18F7786F96EE}.datbinary
MD5:65925D4619139ED2D01A4DB09647B241
SHA256:72EAD9C3A4E865A699C31341C14A8E8DBEFF95D23EEFD888324D092B061D1E28
5740iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE03388C4FFDA53CC.TMPbinary
MD5:9B02622A3D4B33ED5C5F5AF78C535947
SHA256:DF26E2A0707A6BDA0957DEE106D9D7B6AA51F828247BE5E34E84909B748850A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
89
DNS requests
30
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1280
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/NMb_2BZbhD8jbAYrDjf/aK66mk9CmwdvIyoxwK7Ade/4nOqjzeYp0BmH/WznoXHa4/upca4vp9s3StLa_2BEiEvDf/WDRJHsL5vh/SRpidOKC5LOGWLgw3/K8dHaFgcsyWJ/n1GVoWV_2Bj/zhlepvpKnBV59avVCtE_2F/S.avi
unknown
—
—
whitelisted
6752
iexplore.exe
GET
404
49.13.77.253:80
http://zuoashlyc.com/images/aKSWVlYp7wXHZahrP_2FXV6/3zNvGV7d_2/Fkk2F55q8Q8NYancw/knJ_2FLjX_2B/ByKkarGE_2F/HYkF5jcjtDQUGH/6CDqxMn41Mn5psggobi4d/d_2FLyLRleZyOMu7/1DNg8i8VJJG3PzQ/F4pQp_2BNiEps8Rq_2/B3Zmeark/u.avi
unknown
—
—
malicious
2096
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/91uDZpP3U/W1wM1x8Rx7EsSm4pSKQk/kY02rzYprOtIP3D7e_2/FI_2FjLnx0kAs6UfP6NeMJ/Z4FzMYlFQukae/cmPd_2Fa/i5E_2Bj8T_2FAkc90DO0Xvq/R_2Bw7k1TC/yhPxAwpF4BgE10PJV/yO0u7we4REc1/NHAXOw6mBNB/nroq5IjZhOs/i2uocGTs.avi
unknown
—
—
whitelisted
3020
iexplore.exe
GET
404
49.13.77.253:80
http://zuoashlyc.com/images/XTuQl0jAMf/8W69b0ARy_2BTp5lU/3iCEmzk_2FZ9/p1xsufYZafs/pDzXQv7Y3YZwWs/76PBf9NR_2BtooBsMwUcF/FjSAhXyLjo8ocgcI/U1hGZKl15abLEuM/PdIXQRuTj_2F4bsSxU/oueyl2JEQ/evcIyIyf6/RzSeRT.avi
unknown
—
—
malicious
3020
iexplore.exe
GET
404
49.13.77.253:80
http://rreynold77.club/images/EhlzrKeaUnEuz/r0LwIoBh/ngqb4HnyqDMgvIZLFom8_2B/SfExRSDiOL/Kp0NrQ_2FnjCUt9zx/DatZnfRGlVPn/6ZSVdsBQtKv/hXXlTNW12eaOFk/gQ6TcoXmxDEpZv67BHmPX/FSYo6KOV_2BQrL88/604CjF_2F/_2FUJP.avi
unknown
—
—
malicious
5812
iexplore.exe
GET
404
49.13.77.253:80
http://x4fwben.xyz/images/Royb7LWvuaHlv4OwQL/1GlYgmyAT/WZ7g5yjRA4dM1ib5yfV6/e01Zl0X7QY1lK29k6xg/5B_2BRdONYwVr4wRqYOszb/QMqYuecAwSFvT/gxCa_2BP/NMev3Ryf0YF5UHE2PMpoRza/L72kJBe0uw/i1_2BxVp2wo/5VQ.avi
unknown
—
—
malicious
2340
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/vRY0sGI1z_2F/GIprw9ltie_/2Fch9DR2aa5tWt/VUO6yPJ0Ed7z79rbAJJ5e/DbIFnoQMjw4VZIv9/fSUJViIvGaTURAO/asPRM_2FvtdGAYYdT9/ve6_2FyfF/zeBzAcjWhsYrozfLVjoQ/6tCGp1NLWckdcGzej86/6CMhm6mzFgFqyy6eWzKNfm/AV.avi
unknown
—
—
whitelisted
2108
iexplore.exe
GET
404
49.13.77.253:80
http://rreynold77.club/images/ZPGgdo0FF/A0nLPQeNytQbkD82btpw/qnyN9dEogeGHhfwGpeb/AZoxPYzXpnUtdn_2Bo6Qiw/rpwcE6DKin8Mk/Vs7KGhHO/wC13eHqPhAZmwsylOQTid3W/e46lW41wUG/hlNIHq2nZRrHLPbjG/98wRuuInHn/o.avi
unknown
—
—
unknown
4284
iexplore.exe
GET
404
49.13.77.253:80
http://zuoashlyc.com/images/zceQgCFaQJ_2B0fh/nhD_2FRQgBSozEC/l8PwG2yNCRWKRA_2F3/akasfKA52/YYII_2B_2FJ02Nc9dSOi/Ny4SCkp1gbgb90O_2FD/WOKp596Vdzht7qo_2FFSFV/hJalTeCqCpuTz/HyKgtfGn/hihjOAENjJcy7hyIZhOjZP2/D.avi
unknown
—
—
malicious
6404
iexplore.exe
GET
404
49.13.77.253:80
http://x4fwben.xyz/images/NRnBtMrCRyCAlNnR/oC2WcNXwoWdJR08/jlH_2F65xrVM_2F4NO/mJZD4pFu1/giyiht_2BejOZjEhJg8i/fiHUznjLsxWCtAFRdU_/2BpL_2FdHG68EYDPKEkCWe/y6jiCyEAcoLRU/zAEgw5Jy/TvDFEa_2B_2B_2FdeGYHncb/jEc.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1280
iexplore.exe
216.58.206.46:80
google.com
GOOGLE
US
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.46
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.0
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.131
  • 20.190.159.71
  • 40.126.31.2
whitelisted
arc.msn.com
  • 20.31.169.57
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
  • 2603:1030:800:5::bfee:a08d
whitelisted
198.187.3.20.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
1280
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6752
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6752
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6404
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6404
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
3020
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
3020
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2096
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
2096
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
3020
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
71.exe