File name:

DNGuard HVM Professional Edition 3.97.exe

Full analysis: https://app.any.run/tasks/e569c6cf-c162-409a-b94f-ae18ae20483e
Verdict: Malicious activity
Analysis date: August 24, 2024, 17:26:21
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D6CF15E2ED014E5AA953F57668F46286

SHA1:

15BA31693B5322169C75C1C64D0F6544A98416AE

SHA256:

E21DA42F447449E3CA87B7C10CECCA6080CA3833EACAFF8C411C6A17C18EEF25

SSDEEP:

24576:6OZE0N7Zvukw6CbMusC82cUYv1KoRSMfLklfUZ/hGrEHXlNeUpbi9kNY2ET474Ey:6wE0FZvub6CbMusC82cUYv1KoRSMfLk5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • sitool.exe (PID: 6256)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • DNGuard HVM Professional Edition 3.97.exe (PID: 6584)
      • DNGuard HVM Professional Edition 3.97.exe (PID: 6696)
      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6728)
      • 7za.exe (PID: 6504)

    • Drops the executable file immediately after the start

      • DNGuard HVM Professional Edition 3.97.exe (PID: 6584)
      • DNGuard HVM Professional Edition 3.97.exe (PID: 6696)
      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6728)
      • 7za.exe (PID: 6504)

    • Reads security settings of Internet Explorer

      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6604)

    • Reads the date of Windows installation

      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6604)

    • Reads the Windows owner or organization settings

      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6728)

    • Drops 7-zip archiver for unpacking

      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6728)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6368)

    • Creates file in the systems drive root

      • explorer.exe (PID: 6656)

  • INFO

    • Checks supported languages

      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6604)
      • DNGuard HVM Professional Edition 3.97.exe (PID: 6584)
      • DNGuard HVM Professional Edition 3.97.exe (PID: 6696)
      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6728)
      • 7za.exe (PID: 6520)
      • 7za.exe (PID: 6504)
      • 7za.exe (PID: 6200)
      • sitool.exe (PID: 6256)

    • Create files in a temporary directory

      • DNGuard HVM Professional Edition 3.97.exe (PID: 6584)
      • DNGuard HVM Professional Edition 3.97.exe (PID: 6696)
      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6728)
      • 7za.exe (PID: 6504)
      • 7za.exe (PID: 6200)
      • 7za.exe (PID: 6520)

    • Reads the computer name

      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6604)
      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6728)
      • sitool.exe (PID: 6256)

    • Process checks computer location settings

      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6604)

    • Creates files or folders in the user directory

      • DNGuard HVM Professional Edition 3.97.tmp (PID: 6728)
      • sitool.exe (PID: 6256)

    • Manual execution by a user

      • notepad.exe (PID: 2252)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 2252)
      • explorer.exe (PID: 6656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 13:27:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 43.83.0.0
ProductVersionNumber: 43.83.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription:
FileVersion: 43.83
LegalCopyright:
ProductName:
ProductVersion: 43.83
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
19
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dnguard hvm professional edition 3.97.exe dnguard hvm professional edition 3.97.tmp no specs dnguard hvm professional edition 3.97.exe dnguard hvm professional edition 3.97.tmp 7za.exe no specs conhost.exe no specs 7za.exe conhost.exe no specs 7za.exe no specs conhost.exe no specs sitool.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs explorer.exe no specs explorer.exe no specs rundll32.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2252"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\DNGuard HVM Professional Edition 3.97\license.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5476\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6200"C:\Users\admin\AppData\Local\Temp\is-9KSK1.tmp\7za.exe" x "C:\Users\admin\AppData\Local\Temp\is-9KSK1.tmp\misc.res" -p"b1lig@n_vl"C:\Users\admin\AppData\Local\Temp\is-9KSK1.tmp\7za.exe—DNGuard HVM Professional Edition 3.97.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
4.65
Modules
Images
c:\users\admin\appdata\local\temp\is-9ksk1.tmp\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6256"C:\Users\admin\AppData\Roaming\SysInfoTool\sitool.exe" -cr -tu 4C:\Users\admin\AppData\Roaming\SysInfoTool\sitool.exe—DNGuard HVM Professional Edition 3.97.tmp
User:
admin
Integrity Level:
HIGH
Description:
Client System Info
Exit code:
0
Version:
2.0.102.92
Modules
Images
c:\users\admin\appdata\roaming\sysinfotool\sitool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6344\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6368"C:\WINDOWS\system32\schtasks.exe" /Delete /tn "Microsoft\Windows\Windows Error Reporting\SystemInfoTool" /fC:\Windows\SysWOW64\schtasks.exe—sitool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6408"C:\WINDOWS\system32\schtasks.exe" /Create /f /XML "C:\Users\admin\AppData\Roaming\SysInfoTool\data.xml" /tn "Microsoft\Windows\Windows Error Reporting\SystemInfoTool"C:\Windows\SysWOW64\schtasks.exe—sitool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6432"explorer.exe" "C:\Users\admin\Desktop\DNGuard HVM Professional Edition 3.97"C:\Windows\SysWOW64\explorer.exe—DNGuard HVM Professional Edition 3.97.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
Total events
15 002
Read events
14 933
Write events
62
Delete events
7

Modification events

(PID) Process:(6728) DNGuard HVM Professional Edition 3.97.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
481A000066D99EC04AF6DA01
(PID) Process:(6728) DNGuard HVM Professional Edition 3.97.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
0893C0C566979A8824A4787B28F99D6334C3593C93DF676A8480398F3A730681
(PID) Process:(6728) DNGuard HVM Professional Edition 3.97.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6656) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(6656) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
0400000000000000030000000E0000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(6656) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0
Operation:writeName:MRUListEx
Value:
0400000006000000010000000500000008000000020000000C0000000B0000000A00000009000000070000000000000003000000FFFFFFFF
(PID) Process:(6656) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar
Operation:writeName:Locked
Value:
1
(PID) Process:(6656) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon
Operation:writeName:MinimizedStateTabletModeOff
Value:
0
(PID) Process:(6656) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon
Operation:writeName:QatItems
Value:
3C7369713A637573746F6D554920786D6C6E733A7369713D22687474703A2F2F736368656D61732E6D6963726F736F66742E636F6D2F77696E646F77732F323030392F726962626F6E2F716174223E3C7369713A726962626F6E206D696E696D697A65643D2266616C7365223E3C7369713A71617420706F736974696F6E3D2230223E3C7369713A736861726564436F6E74726F6C733E3C7369713A636F6E74726F6C206964513D227369713A3136313238222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3136313239222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333532222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333834222076697369626C653D22747275652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333336222076697369626C653D22747275652220617267756D656E743D223022202F3E3C7369713A636F6E74726F6C206964513D227369713A3132333537222076697369626C653D2266616C73652220617267756D656E743D223022202F3E3C2F7369713A736861726564436F6E74726F6C733E3C2F7369713A7161743E3C2F7369713A726962626F6E3E3C2F7369713A637573746F6D55493E
(PID) Process:(6656) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Operation:writeName:ITBar7Layout
Value:
13000000000000000000000020000000100000000000000001000000010700005E01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
6
Suspicious files
3
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6728DNGuard HVM Professional Edition 3.97.tmpC:\Users\admin\AppData\Local\Temp\{4BBA8527-5964-4D89-A296-E7F2CE455CF1}\is-4N77A.tmp —
MD5:—
SHA256:—
6728DNGuard HVM Professional Edition 3.97.tmpC:\Users\admin\AppData\Local\Temp\{4BBA8527-5964-4D89-A296-E7F2CE455CF1}\license.txt —
MD5:—
SHA256:—
6728DNGuard HVM Professional Edition 3.97.tmpC:\Users\admin\AppData\Local\Temp\is-9KSK1.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6696DNGuard HVM Professional Edition 3.97.exeC:\Users\admin\AppData\Local\Temp\is-RHMUV.tmp\DNGuard HVM Professional Edition 3.97.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
65047za.exeC:\Users\admin\AppData\Local\Temp\is-9KSK1.tmp\form.exeexecutable
MD5:EBFF870D8736DB4C73B573C0E2322433
SHA256:359676E879639C145AA4CFD2A86AD548FE22E75CFC0B8166C84DF150A1B638BD
6728DNGuard HVM Professional Edition 3.97.tmpC:\Users\admin\Desktop\DNGuard HVM Professional Edition 3.97\license.txttext
MD5:C4D7198F4E0BA936865CCC2E32FB1E9D
SHA256:72676D05DEF5C7DE2A3BFFC30EE52A1FA82A8D342736F2FA7C653B1FB174EA78
62007za.exeC:\Users\admin\AppData\Local\Temp\is-9KSK1.tmp\misc.xmlxml
MD5:D54DA888E3C5FD5BA749EC296E0C0FD9
SHA256:EC58F7E5FE7C18248BF4B987DD3D16A8A67508EAE035DF5A25F2643E0E53BEBF
6728DNGuard HVM Professional Edition 3.97.tmpC:\Users\admin\AppData\Roaming\SysInfoTool\sitool.exeexecutable
MD5:EBFF870D8736DB4C73B573C0E2322433
SHA256:359676E879639C145AA4CFD2A86AD548FE22E75CFC0B8166C84DF150A1B638BD
6728DNGuard HVM Professional Edition 3.97.tmpC:\Users\admin\AppData\Local\Temp\is-9KSK1.tmp\7za.exeexecutable
MD5:E92604E043F51C604B6D1AC3BCD3A202
SHA256:FA252E501332B7486A972E7E471CF6915DAA681AF35C6AA102213921093EB2A3
6728DNGuard HVM Professional Edition 3.97.tmpC:\Users\admin\AppData\Local\Temp\is-9KSK1.tmp\misc.rescompressed
MD5:4276E4182A04700263891F395FD74B65
SHA256:436DB65389AFD9020211E47F28A090AB12A5D0E2AF5961BB6C491074F73E30D6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
40
DNS requests
24
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1172
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6728
DNGuard HVM Professional Edition 3.97.tmp
POST
200
216.58.206.46:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6728
DNGuard HVM Professional Edition 3.97.tmp
GET
200
188.114.97.3:80
http://avkit.org/home/getchannel
unknown
—
—
whitelisted
6728
DNGuard HVM Professional Edition 3.97.tmp
POST
200
216.58.206.46:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
6240
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1568
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5292
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6728
DNGuard HVM Professional Edition 3.97.tmp
216.58.206.46:80
www.google-analytics.com
GOOGLE
US
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
204.79.197.222:443
fp.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6728
DNGuard HVM Professional Edition 3.97.tmp
188.114.97.3:80
avkit.org
CLOUDFLARENET
NL
unknown
5336
SearchApp.exe
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.78
whitelisted
www.google-analytics.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
avkit.org
  • 188.114.97.3
  • 188.114.96.3
malicious
www.bing.com
  • 104.126.37.155
  • 104.126.37.186
  • 104.126.37.153
  • 104.126.37.171
  • 104.126.37.123
  • 104.126.37.162
  • 104.126.37.161
  • 104.126.37.184
  • 104.126.37.146
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.45
whitelisted
spo-ring.msedge.net
  • 13.107.138.254
  • 13.107.136.254
whitelisted

Threats

PID
Process
Class
Message
6728
DNGuard HVM Professional Edition 3.97.tmp
Unknown Traffic
ET HUNTING Suspicious Empty User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DNGuard HVM Professional Edition 3.97.exe