File name:

update.exe

Full analysis: https://app.any.run/tasks/7ee53a14-3ff3-420e-b759-db200afb7680
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 25, 2025, 10:31:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
payload
redline
stealer
loader
python
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

A7ECC8DA87D167A82589F2B1D714D2CF

SHA1:

5DB6166D75B667E34CD98929E57DDA1AD006ACC5

SHA256:

DC7BC18FBBCD3FD1050CB479417A27974995D73A4EED13AD06DEDF7C9B262BFD

SSDEEP:

384:itOmlNMQF4WHKVaxWLgc0XAe76dLvAJcOsPDhxWBtIOcKQ6cWnWL3U:GjoWHK0QMOdYJcOIfD9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • explorer.exe (PID: 4488)
      • msiexec.exe (PID: 6248)
      • temp_1239.exe (PID: 5192)
      • update.exe (PID: 4668)

    • Actions looks like stealing of personal data

      • BC7D.tmp.svc.exe (PID: 6916)

    • Loads dropped or rewritten executable

      • conhost.exe (PID: 4708)
      • SIHClient.exe (PID: 7040)
      • temp_1239.exe (PID: 5192)
      • msiexec.exe (PID: 6248)
      • backgroundTaskHost.exe (PID: 6168)
      • temp_1226.exe (PID: 4556)
      • svchost.exe (PID: 6468)
      • backgroundTaskHost.exe (PID: 4876)
      • msiexec.exe (PID: 5776)
      • svchost.exe (PID: 7132)
      • BC7D.tmp.svc.exe (PID: 6916)
      • update.exe (PID: 4668)
      • temp_1226.exe (PID: 4392)
      • WmiPrvSE.exe (PID: 6972)
      • WaaSMedicAgent.exe (PID: 7164)
      • MusNotifyIcon.exe (PID: 5320)
      • MusNotificationUx.exe (PID: 6828)
      • RuntimeBroker.exe (PID: 6520)
      • rundll32.exe (PID: 3420)
      • consent.exe (PID: 3724)

    • REDLINE mutex has been found

      • msiexec.exe (PID: 5776)
      • msiexec.exe (PID: 6248)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • update.exe (PID: 4668)
      • temp_1239.exe (PID: 5192)

    • Reads security settings of Internet Explorer

      • update.exe (PID: 4668)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)

    • Process drops legitimate windows executable

      • update.exe (PID: 4668)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1226.exe (PID: 4392)
      • temp_1239.exe (PID: 5192)

    • Process requests binary or script from the Internet

      • explorer.exe (PID: 4488)
      • BC7D.tmp.svc.exe (PID: 6916)

    • Connects to the server without a host name

      • explorer.exe (PID: 4488)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)
      • msiexec.exe (PID: 5776)

    • Potential Corporate Privacy Violation

      • explorer.exe (PID: 4488)
      • BC7D.tmp.svc.exe (PID: 6916)

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 4488)
      • temp_1226.exe (PID: 4392)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)
      • update.exe (PID: 4668)

    • Found regular expressions for crypto-addresses (YARA)

      • msiexec.exe (PID: 6248)

    • The process drops C-runtime libraries

      • temp_1226.exe (PID: 4392)

    • Process drops python dynamic module

      • temp_1226.exe (PID: 4392)

    • Reads the date of Windows installation

      • BC7D.tmp.svc.exe (PID: 6916)

    • Loads Python modules

      • temp_1226.exe (PID: 4556)

    • Application launched itself

      • temp_1226.exe (PID: 4392)

  • INFO

    • The sample compiled with english language support

      • update.exe (PID: 4668)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1226.exe (PID: 4392)
      • temp_1239.exe (PID: 5192)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4488)
      • RuntimeBroker.exe (PID: 6520)
      • msiexec.exe (PID: 6248)
      • backgroundTaskHost.exe (PID: 4876)
      • backgroundTaskHost.exe (PID: 6168)
      • msiexec.exe (PID: 5776)
      • Taskmgr.exe (PID: 3172)

    • Checks proxy server information

      • backgroundTaskHost.exe (PID: 4876)
      • msiexec.exe (PID: 6248)
      • backgroundTaskHost.exe (PID: 6168)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)
      • msiexec.exe (PID: 5776)
      • explorer.exe (PID: 4488)
      • update.exe (PID: 4668)

    • Creates files in the program directory

      • svchost.exe (PID: 6468)
      • MusNotificationUx.exe (PID: 6828)
      • BC7D.tmp.svc.exe (PID: 6916)
      • MusNotifyIcon.exe (PID: 5320)

    • Reads the computer name

      • update.exe (PID: 4668)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1226.exe (PID: 4392)
      • temp_1239.exe (PID: 5192)

    • Creates files or folders in the user directory

      • update.exe (PID: 4668)
      • backgroundTaskHost.exe (PID: 6168)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1239.exe (PID: 5192)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 6828)
      • WmiPrvSE.exe (PID: 6972)
      • MusNotifyIcon.exe (PID: 5320)

    • Create files in a temporary directory

      • explorer.exe (PID: 4488)
      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1226.exe (PID: 4392)

    • Checks supported languages

      • BC7D.tmp.svc.exe (PID: 6916)
      • temp_1226.exe (PID: 4392)
      • temp_1239.exe (PID: 5192)
      • temp_1226.exe (PID: 4556)
      • update.exe (PID: 4668)

    • Reads the software policy settings

      • backgroundTaskHost.exe (PID: 6168)
      • SIHClient.exe (PID: 7040)
      • WaaSMedicAgent.exe (PID: 7164)
      • consent.exe (PID: 3724)

    • Process checks computer location settings

      • BC7D.tmp.svc.exe (PID: 6916)

    • Reads the machine GUID from the registry

      • temp_1226.exe (PID: 4556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:01:25 09:42:34+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 11
CodeSize: 14336
InitializedDataSize: 10752
UninitializedDataSize: -
EntryPoint: 0x3364
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.1
ProductVersionNumber: 2.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: System
FileVersion: 2.0.0.1
InternalName: Services.exe
LegalCopyright: Copyright (C) 2025
OriginalFileName: Services.exe
ProductName: Services
ProductVersion: 2.0.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
23
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start update.exe #REDLINE msiexec.exe explorer.exe bc7d.tmp.svc.exe temp_1226.exe temp_1239.exe #REDLINE msiexec.exe temp_1226.exe no specs conhost.exe no specs backgroundtaskhost.exe no specs backgroundtaskhost.exe svchost.exe no specs runtimebroker.exe no specs musnotificationux.exe no specs wmiprvse.exe no specs sihclient.exe svchost.exe no specs waasmedicagent.exe no specs musnotifyicon.exe no specs rundll32.exe no specs taskmgr.exe no specs consent.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
3060"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
3172"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
3420C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3724consent.exe 4200 316 0000024669031A10C:\Windows\System32\consent.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Consent UI for administrative applications
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\consent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
4392"C:\Users\admin\AppData\Local\Temp\temp_1226.exe" C:\Users\admin\AppData\Local\Temp\temp_1226.exe
BC7D.tmp.svc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\temp_1226.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4488C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\system32\ondemandconnroutehelper.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\wshbth.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\winrnr.dll
4556"C:\Users\admin\AppData\Local\Temp\temp_1226.exe" C:\Users\admin\AppData\Local\Temp\temp_1226.exe—temp_1226.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\temp_1226.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4668"C:\Users\admin\AppData\Local\Temp\update.exe" C:\Users\admin\AppData\Local\Temp\update.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System
Exit code:
0
Version:
2.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4708\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4876"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mcaC:\Windows\System32\backgroundTaskHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Background Task Host
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
38 923
Read events
38 520
Write events
376
Delete events
27

Modification events

(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F00620000000000000000000000010000000000000000000000
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:(default)
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(4668) update.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(6248) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:delete keyName:(default)
Value:
(PID) Process:(6248) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder
Operation:delete keyName:(default)
Value:
(PID) Process:(6248) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(4876) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(4876) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:writeName:CachedFeatureString
Value:
(PID) Process:(4876) backgroundTaskHost.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
000060519054146FDB01
(PID) Process:(4876) backgroundTaskHost.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
000060519054146FDB01
Executable files
57
Suspicious files
17
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Chrome_History.txt —
MD5:—
SHA256:—
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Chrome_Downloads.txt —
MD5:—
SHA256:—
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\Browsers\Edge_Downloads.txt —
MD5:—
SHA256:—
4668update.exeC:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exeexecutable
MD5:A7ECC8DA87D167A82589F2B1D714D2CF
SHA256:DC7BC18FBBCD3FD1050CB479417A27974995D73A4EED13AD06DEDF7C9B262BFD
6468svchost.exeC:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtagxml
MD5:CAB432C4918E1CFF493C9668B2338104
SHA256:2CE9E3A7CF26A6706D8078C732D8211AEB76E9FAA5C6D3A026E32B077EDF23DF
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\Screenshot.jpgbinary
MD5:823AEFDB5DAE7A62C4BA8B7C52B98062
SHA256:1551D1C6B76A6B7096A35046D5132539ED2977C47D49DD67017D4379D3209A69
6168backgroundTaskHost.exeC:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\FTP Clients\FileZilla\layout.xmlxml
MD5:4526724CD149C14EF9D37D86F825B9F7
SHA256:138167D8F03D48E88DA0AEC3DF38F723BC1895822F75660CCCB5E994814BEE90
6916BC7D.tmp.svc.exeC:\ProgramData\6830FA554F652512029130\System_info.txttext
MD5:8547D3574421C8AA0C2D9F5F3B93C323
SHA256:F755E6BCC85909D76292EBFADD008FDB0B2D924FB18036A2041C663EC2E3E0D7
6168backgroundTaskHost.exeC:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:6CA16613D64F670C33718D2687D239B7
SHA256:D70FF1877CB9DDE142A9A5EAAF45580607F6707B07A54A7D156CFDA22C093E2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
43
DNS requests
19
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4488
explorer.exe
GET
200
185.81.68.156:80
http://185.81.68.156/bin/bot64.bin
unknown
—
—
unknown
6248
msiexec.exe
GET
200
185.81.68.156:80
http://185.81.68.156/bin/bot64.bin
unknown
—
—
unknown
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/VzCAHn.php?2F33566DA0B91573532102
unknown
—
—
malicious
4668
update.exe
GET
200
185.81.68.156:80
http://185.81.68.156/bin/bot64.bin
unknown
—
—
unknown
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/VzCAHn.php?2F33566DA0B91573532102
unknown
—
—
malicious
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/VzCAHn.php?2F33566DA0B91573532102
unknown
—
—
malicious
4488
explorer.exe
GET
200
185.81.68.147:80
http://185.81.68.147/svc.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
2.16.204.138:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2548
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4668
update.exe
185.81.68.156:80
—
Chang Way Technologies Co. Limited
RU
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.16.204.138
  • 2.16.204.161
  • 2.16.204.156
  • 2.16.204.141
  • 2.16.204.135
  • 2.16.204.148
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.37.237.227
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.134
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
4668
update.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] XORed Windows executable has been loaded
4668
update.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
4668
update.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
4488
explorer.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
4488
explorer.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] XORed Windows executable has been loaded
6248
msiexec.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
6248
msiexec.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] XORed Windows executable has been loaded
4488
explorer.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
4488
explorer.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4488
explorer.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
update.exe