File name:

RipBot264v1.26.0 test.txt

Full analysis: https://app.any.run/tasks/a14a392f-afe9-409d-9058-f6962a3c878c
Verdict: Malicious activity
Analysis date: January 27, 2024, 16:49:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: text/plain
File info: ASCII text, with no line terminators
MD5:

2693F68FEA5B9CD86DF884FABB12523C

SHA1:

A6B46668EBC7DDA8E975D800B26C179351D7A532

SHA256:

DFACD08D2362DDD17D97B2ED05448822462C636C72A99C5688FC27EA1DEA7E47

SSDEEP:

3:EKxTOBs:EMTr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • RipBot264.exe (PID: 3320)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • WinRAR.exe (PID: 3400)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3400)

    • Reads the Internet Settings

      • updater.exe (PID: 3604)
      • RipBot264.exe (PID: 3320)
      • updater.exe (PID: 3640)
      • RipBot264.exe (PID: 3092)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 3644)

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 3400)

    • The process checks if it is being run in the virtual environment

      • WinRAR.exe (PID: 3400)

    • Reads Internet Explorer settings

      • RipBot264.exe (PID: 3320)
      • RipBot264.exe (PID: 3092)

    • Reads Microsoft Outlook installation path

      • RipBot264.exe (PID: 3320)
      • RipBot264.exe (PID: 3092)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 2240)
      • WinRAR.exe (PID: 3400)
      • RipBot264.exe (PID: 3584)
      • WinRAR.exe (PID: 2688)
      • RipBot264.exe (PID: 3416)
      • RipBot264.exe (PID: 3960)
      • RipBot264.exe (PID: 3092)
      • updater.exe (PID: 1376)
      • msedge.exe (PID: 984)
      • EncodingClient.exe (PID: 3892)
      • updater.exe (PID: 1628)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2688)
      • xcopy.exe (PID: 3644)
      • WinRAR.exe (PID: 3400)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3400)
      • WinRAR.exe (PID: 2688)

    • Checks supported languages

      • RipBot264.exe (PID: 3584)
      • RipBot264.exe (PID: 3320)
      • updater.exe (PID: 3640)
      • updater.exe (PID: 3604)
      • RipBot264.exe (PID: 3092)
      • updater.exe (PID: 1628)
      • EncodingClient.exe (PID: 3892)

    • Reads the computer name

      • updater.exe (PID: 3604)
      • RipBot264.exe (PID: 3320)
      • updater.exe (PID: 3640)
      • RipBot264.exe (PID: 3092)
      • EncodingClient.exe (PID: 3892)

    • Creates files in the program directory

      • RipBot264.exe (PID: 3320)
      • xcopy.exe (PID: 3644)

    • Checks proxy server information

      • updater.exe (PID: 3640)
      • RipBot264.exe (PID: 3320)
      • RipBot264.exe (PID: 3092)

    • Create files in a temporary directory

      • updater.exe (PID: 3640)

    • Creates files or folders in the user directory

      • updater.exe (PID: 3640)
      • RipBot264.exe (PID: 3320)
      • RipBot264.exe (PID: 3092)

    • Reads the machine GUID from the registry

      • updater.exe (PID: 3640)
      • RipBot264.exe (PID: 3320)
      • RipBot264.exe (PID: 3092)

    • Application launched itself

      • msedge.exe (PID: 1796)
      • msedge.exe (PID: 984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
100
Monitored processes
38
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start notepad.exe no specs winrar.exe no specs winrar.exe winrar.exe ripbot264.exe no specs ripbot264.exe updater.exe no specs ripbot264.exe updater.exe xcopy.exe regsvr32.exe no specs ripbot264.exe no specs ripbot264.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs updater.exe no specs updater.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs encodingclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
984"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate https://github.com/AviSynth/AviSynthPlus/releasesC:\Program Files\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1376"C:\Users\admin\Desktop\RipBot264v1.26.0\updater.exe" C:\Users\admin\Desktop\RipBot264v1.26.0\updater.exe—explorer.exe
User:
admin
Company:
Atak_Snajpera
Integrity Level:
MEDIUM
Description:
RipBot264 Updater
Exit code:
3221226540
Version:
1.0.4.0
Modules
Images
c:\users\admin\desktop\ripbot264v1.26.0\updater.exe
c:\windows\system32\ntdll.dll
1484"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1536 --field-trial-handle=1316,i,11781941647065765224,1368217849909603784,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1556"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1316,i,11781941647065765224,1368217849909603784,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6411f598,0x6411f5a8,0x6411f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1628"C:\Users\admin\Desktop\RipBot264v1.26.0\updater.exe" C:\Users\admin\Desktop\RipBot264v1.26.0\updater.exe
explorer.exe
User:
admin
Company:
Atak_Snajpera
Integrity Level:
HIGH
Description:
RipBot264 Updater
Exit code:
0
Version:
1.0.4.0
Modules
Images
c:\users\admin\desktop\ripbot264v1.26.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
1748"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3808 --field-trial-handle=1316,i,11781941647065765224,1368217849909603784,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1796"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/AviSynth/AviSynthPlus/releasesC:\Program Files\Microsoft\Edge\Application\msedge.exe—RipBot264.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1904"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6411f598,0x6411f5a8,0x6411f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1936"C:\Windows\system32\NOTEPAD.EXE" "C:\Users\admin\Desktop\RipBot264v1.26.0 test.txt"C:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
30 268
Read events
30 155
Write events
112
Delete events
1

Modification events

(PID) Process:(2240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2240) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2688) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
254
Suspicious files
183
Text files
1 037
Unknown types
4

Dropped files

PID
Process
Filename
Type
2240WinRAR.exeC:\Users\admin\Desktop\RipBot264v1.26.0.7z —
MD5:—
SHA256:—
2688WinRAR.exeC:\Users\admin\Desktop\Profiles\avc\[BASE 3.0] iPOD Classic . Zune.txttext
MD5:84C151F069EFA6118C6D3CC44CC2C016
SHA256:CA3BC4EA5D348019589499D2E2D625CC277044F1766CA30E1F9860F4FBE26490
2688WinRAR.exeC:\Users\admin\Desktop\Job finished with error.cmdtext
MD5:091B30800E48407A763D389EDE02F085
SHA256:CEBE82A50548E79D5CB923462ABDA566BC0E45B0B4AA9575927F790A2D1F1D68
2688WinRAR.exeC:\Users\admin\Desktop\Profiles\avc\[BASE 1.3] Simple Mobile Device.txttext
MD5:E7D89A8924AE52E9A0831F2982651C75
SHA256:D639660F35C33EFE2C106080157A285AC220362DF0154DCD327687FB115E66FF
2688WinRAR.exeC:\Users\admin\Desktop\Job finished successfully.cmdtext
MD5:091B30800E48407A763D389EDE02F085
SHA256:CEBE82A50548E79D5CB923462ABDA566BC0E45B0B4AA9575927F790A2D1F1D68
2688WinRAR.exeC:\Users\admin\Desktop\Profiles\avc\[HIGH 4.0] FHD . Interlaced.txttext
MD5:271FCF7CFECEED9B5B21671DF678B424
SHA256:14BB20FCD460B8A45632DA31109E078799C560BA033F58F4C50F0FED72101A7C
2688WinRAR.exeC:\Users\admin\Desktop\Profiles\avc\[HIGH 4.0] FHD . Progressive.txttext
MD5:2FC5D4EBF55A81E67A988E0BD5137091
SHA256:44880A8340C58A91286362E5F2B2CA799B8C0462DE78EB00D0EAFD8031F9543A
2688WinRAR.exeC:\Users\admin\Desktop\RipBot264.initext
MD5:DF06011EE3C0E73EA4ABB1F049475620
SHA256:0D04619D31B48821969367191ED3EFB7E5FF06B4B436C101CE561FB28BB7D17D
2688WinRAR.exeC:\Users\admin\Desktop\Profiles\avc\[BASE 3.1] AppleTV.txttext
MD5:5BDC3A537B368D232530B4BB6A886DCE
SHA256:5A63F48B33447A5750EDA33E1454B5BEEBAF023CCE0EF11010F1B95656D315EC
2688WinRAR.exeC:\Users\admin\Desktop\Profiles\hevc\[MAIN x.x] 8bit . Progressive.txttext
MD5:81051BCC2CF1BEDF378224B0A93E2877
SHA256:7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
31
DNS requests
36
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3640
updater.exe
GET
200
213.112.19.103:80
http://forum.doom9.org/showthread.php?t=127611
unknown
html
18.6 Kb
unknown
3640
updater.exe
GET
200
37.187.156.46:80
http://atak-snajpera.5v.pl/ripbot264update/update.zip
unknown
compressed
2.64 Kb
unknown
3640
updater.exe
GET
200
37.187.156.46:80
http://atak-snajpera.5v.pl/ripbot264update/downloadposter.zip
unknown
compressed
2.63 Mb
unknown
3640
updater.exe
GET
200
37.187.156.46:80
http://atak-snajpera.5v.pl/ripbot264update/core.zip
unknown
compressed
3.32 Mb
unknown
3640
updater.exe
GET
200
37.187.156.46:80
http://atak-snajpera.5v.pl/ripbot264update/ffmpeg.zip
unknown
compressed
145 Mb
unknown
3320
RipBot264.exe
GET
200
37.187.156.46:80
http://atak-snajpera.5v.pl/ripbot264update/changelog.zip?fakevariable=2.3283064365387E-10
unknown
html
58.8 Kb
unknown
3640
updater.exe
GET
200
37.187.156.46:80
http://atak-snajpera.5v.pl/ripbot264update/mediainfo.zip
unknown
compressed
3.01 Mb
unknown
3640
updater.exe
GET
200
37.187.156.46:80
http://atak-snajpera.5v.pl/ripbot264update/mkvtoolnix.zip
unknown
compressed
63.7 Mb
unknown
3640
updater.exe
GET
200
37.187.156.46:80
http://atak-snajpera.5v.pl/ripbot264update/mpc.zip
unknown
compressed
26.0 Mb
unknown
3640
updater.exe
GET
200
37.187.156.46:80
http://atak-snajpera.5v.pl/ripbot264update/x265.zip
unknown
compressed
3.01 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3640
updater.exe
213.112.19.103:80
forum.doom9.org
Telenor Norge AS
SE
unknown
3640
updater.exe
37.187.156.46:80
atak-snajpera.5v.pl
OVH SAS
FR
unknown
3320
RipBot264.exe
37.187.156.46:80
atak-snajpera.5v.pl
OVH SAS
FR
unknown
3092
RipBot264.exe
37.187.156.46:80
atak-snajpera.5v.pl
OVH SAS
FR
unknown
2452
msedge.exe
140.82.121.3:443
github.com
GITHUB
US
unknown
2452
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2452
msedge.exe
20.166.151.106:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
forum.doom9.org
  • 213.112.19.103
unknown
atak-snajpera.5v.pl
  • 37.187.156.46
unknown
github.com
  • 140.82.121.3
shared
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.166.151.106
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
data-edge.smartscreen.microsoft.com
  • 4.175.88.233
whitelisted
github.githubassets.com
  • 185.199.110.154
  • 185.199.109.154
  • 185.199.111.154
  • 185.199.108.154
whitelisted
avatars.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
whitelisted
github-cloud.s3.amazonaws.com
  • 52.217.224.113
  • 16.182.36.9
  • 16.182.105.89
  • 52.217.11.12
  • 16.182.104.25
  • 3.5.6.179
  • 52.216.137.228
  • 52.216.209.105
shared

Threats

PID
Process
Class
Message
3640
updater.exe
Attempted Administrator Privilege Gain
AV EXPLOIT Potential ZIP file exploiting CVE-2023-36413
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RipBot264v1.26.0 test.txt