File name:

e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0

Full analysis: https://app.any.run/tasks/a1fa6e1c-a83b-4810-943a-49dbafc880e7
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 01:00:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
remcos
rat
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

2B549FD8E930D9ADBFDC0B36C3B0586D

SHA1:

5AD735D2F1CC1BEEE07243F4403B90F9D3806269

SHA256:

E37BEC79CC507A86F38D7E5D426B30FA3773D8AD229CABB008A9B5AE6EA9F5E0

SSDEEP:

24576:g/sGxwijb7Igj5pHKHzc6wB08A9qD4y0Lj06tyK5LrTamrAEetZQ:g/bxwijb7nNpHKHzc6wB08A9u4y0Lj0M

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)
      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • Stempelkortenes.exe (PID: 5800)
      • Stempelkortenes.exe (PID: 680)

    • Changes the autorun value in the registry

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • Stempelkortenes.exe (PID: 680)

    • REMCOS mutex has been found

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • Stempelkortenes.exe (PID: 680)

    • REMCOS has been detected

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)
      • Stempelkortenes.exe (PID: 5800)

    • Drops 7-zip archiver for unpacking

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)

    • Executable content was dropped or overwritten

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)
      • Stempelkortenes.exe (PID: 5800)

    • The process creates files with name similar to system file names

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)
      • Stempelkortenes.exe (PID: 5800)

    • Application launched itself

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)
      • Stempelkortenes.exe (PID: 5800)

    • Reads security settings of Internet Explorer

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • Stempelkortenes.exe (PID: 680)

    • Connects to unusual port

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)

  • INFO

    • Reads the computer name

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)
      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • Stempelkortenes.exe (PID: 5800)
      • Stempelkortenes.exe (PID: 680)

    • Checks supported languages

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)
      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • Stempelkortenes.exe (PID: 5800)
      • Stempelkortenes.exe (PID: 680)

    • The sample compiled with english language support

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)

    • Creates files or folders in the user directory

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)
      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)

    • Create files in a temporary directory

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 4436)
      • Stempelkortenes.exe (PID: 5800)

    • Auto-launch of the file from Registry key

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • Stempelkortenes.exe (PID: 680)

    • Checks proxy server information

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • Stempelkortenes.exe (PID: 680)

    • Reads the machine GUID from the registry

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • Stempelkortenes.exe (PID: 680)

    • Manual execution by a user

      • Stempelkortenes.exe (PID: 5800)

    • Reads the software policy settings

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
      • slui.exe (PID: 7020)
      • Stempelkortenes.exe (PID: 680)

    • UPX packer has been detected

      • e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe (PID: 5112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:08 23:05:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 184832
UninitializedDataSize: 2048
EntryPoint: 0x358d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 24.9.0.0
ProductVersionNumber: 24.9.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: Igor Pavlov
FileDescription: 7-Zip Installer
FileVersion: 24.09.0.0
LegalCopyright: Copyright (c) 1999-2024 Igor Pavlov
LegalTrademarks: -
ProductName: 7-Zip
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe sppextcomobj.exe no specs slui.exe #REMCOS e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe stempelkortenes.exe #REMCOS stempelkortenes.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680C:\Users\admin\AppData\Local\Temp\Pizzabarerne\Stempelkortenes.exeC:\Users\admin\AppData\Local\Temp\Pizzabarerne\Stempelkortenes.exe
Stempelkortenes.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Installer
Exit code:
2
Version:
24.09.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\pizzabarerne\stempelkortenes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
2096C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2384C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4436"C:\Users\admin\AppData\Local\Temp\e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe" C:\Users\admin\AppData\Local\Temp\e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Installer
Exit code:
0
Version:
24.09.0.0
Modules
Images
c:\users\admin\appdata\local\temp\e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5112"C:\Users\admin\AppData\Local\Temp\e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe" C:\Users\admin\AppData\Local\Temp\e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe
e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Installer
Version:
24.09.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5800C:\Users\admin\AppData\Local\Temp\Pizzabarerne\Stempelkortenes.exeC:\Users\admin\AppData\Local\Temp\Pizzabarerne\Stempelkortenes.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Installer
Exit code:
0
Version:
24.09.0.0
Modules
Images
c:\users\admin\appdata\local\temp\pizzabarerne\stempelkortenes.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7020"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 411
Read events
1 851
Write events
560
Delete events
0

Modification events

(PID) Process:(4436) e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeKey:HKEY_CURRENT_USER\norss\antndelsens
Operation:writeName:Fllesrummet
Value:
35910E
(PID) Process:(5112) e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Armodets
Value:
C:\Users\admin\AppData\Local\Temp\Pizzabarerne\Stempelkortenes.exe
(PID) Process:(5800) Stempelkortenes.exeKey:HKEY_CURRENT_USER\norss\antndelsens
Operation:writeName:Fllesrummet
Value:
35910E
(PID) Process:(5112) e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YH4WGR
Operation:writeName:exepath
Value:
997AC34A204D7BF2A3F15D47792DBDDB75AE8292D825BAC87FA04B8200E631C271601A6E3AFC08D46DBCA83E313BA03CB78A2EE3A1EA315B4B91203BD2FA3B3AB7376739A3585D73FFB360550EE708F4241911F456C99827FA87A839BCA3730B32B4DC06564781D1CCEC07D0994DC196ECC54256AE78A0B886F2B5E5F9E79EE577387D98F021951FE6FD765BFC38FB62CA2D786769919D8907C6CC2B68B9A2A69862907A6D062B85E120E77487A05BF9D7CB19DE5C7AB7E7DB6AC8D96F3CDC39FE289FFA326891633703FDC093CC
(PID) Process:(5112) e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YH4WGR
Operation:writeName:licence
Value:
45EA32F1605AFD8229C79B27236F549A
(PID) Process:(5112) e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YH4WGR
Operation:writeName:time
Value:
(PID) Process:(5112) e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YH4WGR
Operation:writeName:UID
Value:
(PID) Process:(680) Stempelkortenes.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Armodets
Value:
C:\Users\admin\AppData\Local\Temp\Pizzabarerne\Stempelkortenes.exe
Executable files
2
Suspicious files
10
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Erhvervsledere\Smreolien.txttext
MD5:22CC5217B80A5B862C9B686055B96E24
SHA256:3594EF22AA077EEB70F58AABF26B679C2E1FFF8C5B2CF6D2979347F0D617D235
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Erhvervsledere\amaine.txttext
MD5:7A31750EC6109A699286097772E70B3C
SHA256:26D4BF837EFEFAF5754191229224513ED6EA740163BE4B0F494C1E7350FDFF89
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Pennyweights\prosophist.initext
MD5:FDC79E914B56B31EF736226D89BC28B5
SHA256:3D2790316F42195A1062E35F00DB3704A897C1D01B5FA72CE5225291412AA5A9
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Facetslebet\haandsbredderne.spebinary
MD5:C32EBAFD108B0927E916DF4E22702BDC
SHA256:5279BF98554B0356BD70F51AF7CF1C8674E53811AC8E82155DC11A4D9D5DEEDC
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Forskningscheferne.Unnbinary
MD5:886812E2D094695634F40176EA99432F
SHA256:18001FF1CF3D92B7E5589F46C5C79B60DC55DD88B68C21C4AA9458BF48D6A5D4
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Erhvervsledere\Pendelen81.initext
MD5:B6C05DE8D01FA6DED2464A832AE7165F
SHA256:6EBE5FD263E08014E0F858004F4DEF87B879584A99A3306CE9A4F1FCDA9380CF
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Minimeringens.Vanbinary
MD5:61A9FFD9BCD02332ABECD91E784CBB0F
SHA256:A1285D5F721FE54A89FF09133BD777DB59F4C04E23E7E1DEAB01B2B84104FAF4
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Facetslebet\indskydninger.initext
MD5:D4054A42C705A82D1ECC6531C747F07F
SHA256:88DFEADECF5D56BA8C8D5C9EEDE688C822DB089C3025D2D2089365731E086B63
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Erhvervsledere\Meteorologens.frkbinary
MD5:2227191A40E21E7117FB3967DCE25E70
SHA256:789D967119EF05CA7E591666F4BBEE6ECD9543326BC37F3175EFD56BC6F51791
4436e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Snappe\tilfldene\Facetslebet\fjernbetjeningsenhed.initext
MD5:BC451849132C86ABDE2C92099D0906AC
SHA256:89364B6AEAB2BE7E12346D03F5D481A0FF8DEC19AECF35C5B5C19683CFA80373
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
160
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5112
e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe
GET
301
45.139.11.193:80
http://www.khavar.com/GHDsdCBN124.bin
unknown
—
—
unknown
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5112
e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe
GET
200
18.66.147.103:80
http://e6.c.lencr.org/106.crl
unknown
—
—
whitelisted
680
Stempelkortenes.exe
GET
301
45.139.11.193:80
http://www.khavar.com/GHDsdCBN124.bin
unknown
—
—
unknown
5112
e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
3888
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3888
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.133
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.132
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
www.khavar.com
  • 45.139.11.193
unknown
x1.c.lencr.org
  • 23.209.209.135
whitelisted
e6.c.lencr.org
  • 18.66.147.103
  • 18.66.147.67
  • 18.66.147.114
  • 18.66.147.21
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
e37bec79cc507a86f38d7e5d426b30fa3773d8ad229cabb008a9b5ae6ea9f5e0