File name:

update.exe

Full analysis: https://app.any.run/tasks/7ee53a14-3ff3-420e-b759-db200afb7680
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 25, 2025, 10:31:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
payload
redline
stealer
loader
python
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

A7ECC8DA87D167A82589F2B1D714D2CF

SHA1:

5DB6166D75B667E34CD98929E57DDA1AD006ACC5

SHA256:

DC7BC18FBBCD3FD1050CB479417A27974995D73A4EED13AD06DEDF7C9B262BFD

SSDEEP:

384:itOmlNMQF4WHKVaxWLgc0XAe76dLvAJcOsPDhxWBtIOcKQ6cWnWL3U:GjoWHK0QMOdYJcOIfD9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • update.exe (PID: 4668)
      • explorer.exe (PID: 4488)
      • msiexec.exe (PID: 6248)
      • temp_1239.exe (PID: 5192)

    • REDLINE mutex has been found

      • msiexec.exe (PID: 6248)
      • msiexec.exe (PID: 5776)

    • Actions looks like stealing of personal data

      • BC7D.tmp.svc.exe (PID: 6916)

    • Loads dropped or rewritten executable

      • SIHClient.exe (PID: 7040)
      • msiexec.exe (PID: 5776)
      • temp_1226.exe (PID: 4556)
      • backgroundTaskHost.exe (PID: 6168)
      • temp_1239.exe (PID: 5192)
      • msiexec.exe (PID: 6248)
      • conhost.exe (PID: 4708)
      • RuntimeBroker.exe (PID: 6520)
      • svchost.exe (PID: 7132)
      • svchost.exe (PID: 6468)
      • backgroundTaskHost.exe (PID: 4876)
      • MusNotificationUx.exe (PID: 6828)
      • BC7D.tmp.svc.exe (PID: 6916)
      • update.exe (PID: 4668)
      • temp_1226.exe (PID: 4392)
      • WaaSMedicAgent.exe (PID: 7164)
      • WmiPrvSE.exe (PID: 6972)
      • rundll32.exe (PID: 3420)
      • consent.exe (PID: 3724)
      • MusNotifyIcon.exe (PID: 5320)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • update.exe (PID: 4668)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)
      • temp_1226.exe (PID: 4392)

    • Reads security settings of Internet Explorer

      • update.exe (PID: 4668)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)

    • Executable content was dropped or overwritten

      • update.exe (PID: 4668)
      • explorer.exe (PID: 4488)
      • temp_1226.exe (PID: 4392)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)

    • Starts a Microsoft application from unusual location

      • update.exe (PID: 4668)
      • temp_1239.exe (PID: 5192)

    • Connects to the server without a host name

      • explorer.exe (PID: 4488)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)
      • msiexec.exe (PID: 5776)

    • Potential Corporate Privacy Violation

      • explorer.exe (PID: 4488)
      • BC7D.tmp.svc.exe (PID: 6916)

    • Process requests binary or script from the Internet

      • explorer.exe (PID: 4488)
      • BC7D.tmp.svc.exe (PID: 6916)

    • Found regular expressions for crypto-addresses (YARA)

      • msiexec.exe (PID: 6248)

    • The process drops C-runtime libraries

      • temp_1226.exe (PID: 4392)

    • Reads the date of Windows installation

      • BC7D.tmp.svc.exe (PID: 6916)

    • Process drops python dynamic module

      • temp_1226.exe (PID: 4392)

    • Loads Python modules

      • temp_1226.exe (PID: 4556)

    • Application launched itself

      • temp_1226.exe (PID: 4392)

  • INFO

    • The sample compiled with english language support

      • update.exe (PID: 4668)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1226.exe (PID: 4392)
      • temp_1239.exe (PID: 5192)

    • Reads the computer name

      • update.exe (PID: 4668)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1226.exe (PID: 4392)
      • temp_1239.exe (PID: 5192)

    • Creates files or folders in the user directory

      • update.exe (PID: 4668)
      • backgroundTaskHost.exe (PID: 6168)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)

    • Checks proxy server information

      • update.exe (PID: 4668)
      • explorer.exe (PID: 4488)
      • msiexec.exe (PID: 6248)
      • backgroundTaskHost.exe (PID: 4876)
      • BC7D.tmp.svc.exe (PID: 6916)
      • backgroundTaskHost.exe (PID: 6168)
      • temp_1239.exe (PID: 5192)
      • msiexec.exe (PID: 5776)

    • Checks supported languages

      • update.exe (PID: 4668)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1226.exe (PID: 4392)
      • temp_1226.exe (PID: 4556)
      • temp_1239.exe (PID: 5192)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4488)
      • msiexec.exe (PID: 6248)
      • backgroundTaskHost.exe (PID: 4876)
      • RuntimeBroker.exe (PID: 6520)
      • backgroundTaskHost.exe (PID: 6168)
      • msiexec.exe (PID: 5776)
      • Taskmgr.exe (PID: 3172)

    • Creates files in the program directory

      • svchost.exe (PID: 6468)
      • BC7D.tmp.svc.exe (PID: 6916)
      • MusNotificationUx.exe (PID: 6828)
      • MusNotifyIcon.exe (PID: 5320)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 6828)
      • WmiPrvSE.exe (PID: 6972)
      • MusNotifyIcon.exe (PID: 5320)

    • Reads the software policy settings

      • backgroundTaskHost.exe (PID: 6168)
      • SIHClient.exe (PID: 7040)
      • WaaSMedicAgent.exe (PID: 7164)
      • consent.exe (PID: 3724)

    • Create files in a temporary directory

      • BC7D.tmp.svc.exe (PID: 6916)
      • explorer.exe (PID: 4488)
      • temp_1226.exe (PID: 4392)

    • Process checks computer location settings

      • BC7D.tmp.svc.exe (PID: 6916)

    • Reads the machine GUID from the registry

      • temp_1226.exe (PID: 4556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:01:25 09:42:34+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 11
CodeSize: 14336
InitializedDataSize: 10752
UninitializedDataSize: -
EntryPoint: 0x3364
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.1
ProductVersionNumber: 2.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: System
FileVersion: 2.0.0.1
InternalName: Services.exe
LegalCopyright: Copyright (C) 2025
OriginalFileName: Services.exe
ProductName: Services
ProductVersion: 2.0.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
23
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start update.exe #REDLINE msiexec.exe explorer.exe bc7d.tmp.svc.exe temp_1226.exe temp_1239.exe #REDLINE msiexec.exe temp_1226.exe no specs conhost.exe no specs backgroundtaskhost.exe no specs backgroundtaskhost.exe svchost.exe no specs runtimebroker.exe no specs musnotificationux.exe no specs wmiprvse.exe no specs sihclient.exe svchost.exe no specs waasmedicagent.exe no specs musnotifyicon.exe no specs rundll32.exe no specs taskmgr.exe no specs consent.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
3060"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
3172"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
3420C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3724consent.exe 4200 316 0000024669031A10C:\Windows\System32\consent.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Consent UI for administrative applications
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\consent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
4392"C:\Users\admin\AppData\Local\Temp\temp_1226.exe" C:\Users\admin\AppData\Local\Temp\temp_1226.exe
BC7D.tmp.svc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\temp_1226.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4488C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\system32\ondemandconnroutehelper.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\wshbth.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\winrnr.dll
4556"C:\Users\admin\AppData\Local\Temp\temp_1226.exe" C:\Users\admin\AppData\Local\Temp\temp_1226.exe—temp_1226.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\temp_1226.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4668"C:\Users\admin\AppData\Local\Temp\update.exe" C:\Users\admin\AppData\Local\Temp\update.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System
Exit code:
0
Version:
2.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4708\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4876"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mcaC:\Windows\System32\backgroundTaskHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Background Task Host
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
38 923
Read events
38 520
Write events
376
Delete events
27

Modification events

(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F00620000000000000000000000010000000000000000000000
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:(default)
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(4668) update.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(6248) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:delete keyName:(default)
Value:
(PID) Process:(6248) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder
Operation:delete keyName:(default)
Value:
(PID) Process:(6248) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(4876) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(4876) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:writeName:CachedFeatureString
Value:
(PID) Process:(4876) backgroundTaskHost.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
000060519054146FDB01
(PID) Process:(4876) backgroundTaskHost.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
000060519054146FDB01
Executable files
57
Suspicious files
17
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Chrome_History.txt —
MD5:—
SHA256:—
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Chrome_Downloads.txt —
MD5:—
SHA256:—
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Edge_Downloads.txt —
MD5:—
SHA256:—
6828MusNotificationUx.exeC:\ProgramData\USOShared\Logs\User\NotificationUx.bc94bc32-92c7-43da-8509-82284eb8b933.1.etlbinary
MD5:7A787266F47DD44DD227E687804A9B0F
SHA256:F19FF760DC58F89D86B4E64AD54C9A33EBBC9E0291E3F0E072BDAECE12C01FE8
6168backgroundTaskHost.exeC:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:6CA16613D64F670C33718D2687D239B7
SHA256:D70FF1877CB9DDE142A9A5EAAF45580607F6707B07A54A7D156CFDA22C093E2A
6468svchost.exeC:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtagxml
MD5:CAB432C4918E1CFF493C9668B2338104
SHA256:2CE9E3A7CF26A6706D8078C732D8211AEB76E9FAA5C6D3A026E32B077EDF23DF
4488explorer.exeC:\Users\admin\AppData\Local\Temp\BC7D.tmp.svc.exeexecutable
MD5:E2B9936F5B41295BA4CA23AFAE692813
SHA256:2C74E012E213DC721370AEED8F4932E677F28A95B3DA7E3F94E74013F078F066
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\queue.sqlite3binary
MD5:814062819B4AEF158A726D9D50142008
SHA256:CA62AC5062DA0659D8E6FCA164A102D2D9F9EF8C4D461FCE5459560B4C30270E
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\filezilla.xmlxml
MD5:32F683306CE4FA78157113BB9EACB51D
SHA256:16283B36975456118FBAC2A0CB0AB466C2D26E2B396DD938CDF129F2D3224570
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\Screenshot.jpgbinary
MD5:823AEFDB5DAE7A62C4BA8B7C52B98062
SHA256:1551D1C6B76A6B7096A35046D5132539ED2977C47D49DD67017D4379D3209A69
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
43
DNS requests
19
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4488
explorer.exe
GET
200
185.81.68.156:80
http://185.81.68.156/bin/bot64.bin
unknown
—
—
unknown
6248
msiexec.exe
GET
200
185.81.68.156:80
http://185.81.68.156/bin/bot64.bin
unknown
—
—
unknown
4668
update.exe
GET
200
185.81.68.156:80
http://185.81.68.156/bin/bot64.bin
unknown
—
—
unknown
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/VzCAHn.php?2F33566DA0B91573532102
unknown
—
—
malicious
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/VzCAHn.php?2F33566DA0B91573532102
unknown
—
—
malicious
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/VzCAHn.php?2F33566DA0B91573532102
unknown
—
—
malicious
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
2.16.204.138:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2548
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4668
update.exe
185.81.68.156:80
—
Chang Way Technologies Co. Limited
RU
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.16.204.138
  • 2.16.204.161
  • 2.16.204.156
  • 2.16.204.141
  • 2.16.204.135
  • 2.16.204.148
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.37.237.227
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.134
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
4668
update.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] XORed Windows executable has been loaded
4668
update.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
4668
update.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
4488
explorer.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
4488
explorer.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] XORed Windows executable has been loaded
6248
msiexec.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
6248
msiexec.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] XORed Windows executable has been loaded
4488
explorer.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
4488
explorer.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4488
explorer.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
update.exe