File name:

netlimiter-5.2.3.0.exe

Full analysis: https://app.any.run/tasks/94edebca-3e7b-49de-be56-cb48ad0f1278
Verdict: Malicious activity
Analysis date: April 25, 2023, 16:55:00
OS: Windows 11 Professional (build: 22000, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FF13E8453660E55BA3D7E0F8C9FAFB55

SHA1:

EACA693BE7AE78C66EFFF6BB3981FB4EBDBA83FF

SHA256:

E7FCB79E5CB4B83E985240D58EC0A9C723453709AFFE4B3B4AE19774376A3400

SSDEEP:

393216:aeKdJlB7RFoWCNw4Ik45sg3KPBlAIe1HWf:vK5SlNDIJ5soKJZX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VC_redist.x64.exe (PID: 3896)
      • netlimiter-5.2.3.0.exe (PID: 736)
      • VC_redist.x64.exe (PID: 2268)
      • VC_redist.x86.exe (PID: 3636)
      • VC_redist.x64.exe (PID: 1044)
      • VC_redist.x86.exe (PID: 5728)
      • netlimiter-5.2.3.0.exe (PID: 4976)
      • VC_redist.x86.exe (PID: 760)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • netlimiter-5.2.3.0.exe (PID: 736)

    • Reads the Windows owner or organization settings

      • netlimiter-5.2.3.0.exe (PID: 736)

    • Drops a file with too old compile date

      • netlimiter-5.2.3.0.exe (PID: 736)
      • netlimiter-5.2.3.0.exe (PID: 4976)

    • Reads security settings of Internet Explorer

      • netlimiter-5.2.3.0.exe (PID: 736)

    • Reads the date of Windows installation

      • netlimiter-5.2.3.0.exe (PID: 736)
      • VC_redist.x64.exe (PID: 2268)

    • Reads Internet Explorer settings

      • netlimiter-5.2.3.0.exe (PID: 736)

    • Reads the Internet Settings

      • netlimiter-5.2.3.0.exe (PID: 736)
      • VC_redist.x64.exe (PID: 2268)

    • Checks Windows Trust Settings

      • netlimiter-5.2.3.0.exe (PID: 736)

    • Executable content was dropped or overwritten

      • VC_redist.x64.exe (PID: 3896)
      • VC_redist.x64.exe (PID: 2268)
      • VC_redist.x64.exe (PID: 1044)
      • VC_redist.x86.exe (PID: 3636)
      • VC_redist.x86.exe (PID: 760)
      • netlimiter-5.2.3.0.exe (PID: 736)
      • VC_redist.x86.exe (PID: 5728)
      • netlimiter-5.2.3.0.exe (PID: 4976)

    • Process drops legitimate windows executable

      • VC_redist.x64.exe (PID: 3896)
      • VC_redist.x64.exe (PID: 2268)
      • netlimiter-5.2.3.0.exe (PID: 736)
      • VC_redist.x64.exe (PID: 1044)
      • VC_redist.x86.exe (PID: 760)
      • VC_redist.x86.exe (PID: 5728)
      • netlimiter-5.2.3.0.exe (PID: 4976)
      • VC_redist.x86.exe (PID: 3636)

    • Starts itself from another location

      • VC_redist.x64.exe (PID: 2268)
      • VC_redist.x86.exe (PID: 760)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5692)
      • NLSvc.exe (PID: 1984)

    • Searches for installed software

      • dllhost.exe (PID: 3680)

    • Application launched itself

      • netlimiter-5.2.3.0.exe (PID: 736)

    • Drops a system driver (possible attempt to evade defenses)

      • netlimiter-5.2.3.0.exe (PID: 736)

  • INFO

    • Checks supported languages

      • netlimiter-5.2.3.0.exe (PID: 736)
      • VC_redist.x64.exe (PID: 3896)
      • VC_redist.x64.exe (PID: 2268)
      • VC_redist.x64.exe (PID: 1044)

    • Checks proxy server information

      • netlimiter-5.2.3.0.exe (PID: 736)

    • Creates files or folders in the user directory

      • netlimiter-5.2.3.0.exe (PID: 736)

    • The process checks LSA protection

      • netlimiter-5.2.3.0.exe (PID: 736)
      • VC_redist.x64.exe (PID: 3896)
      • VC_redist.x64.exe (PID: 2268)
      • VC_redist.x64.exe (PID: 1044)
      • dllhost.exe (PID: 3680)
      • VSSVC.exe (PID: 5692)

    • Reads Environment values

      • netlimiter-5.2.3.0.exe (PID: 736)

    • Reads the computer name

      • netlimiter-5.2.3.0.exe (PID: 736)
      • VC_redist.x64.exe (PID: 2268)
      • VC_redist.x64.exe (PID: 1044)

    • Reads the machine GUID from the registry

      • netlimiter-5.2.3.0.exe (PID: 736)

    • Drops a file that was compiled in debug mode

      • VC_redist.x64.exe (PID: 3896)
      • VC_redist.x64.exe (PID: 2268)
      • VC_redist.x64.exe (PID: 1044)
      • VC_redist.x86.exe (PID: 3636)
      • VC_redist.x86.exe (PID: 760)
      • netlimiter-5.2.3.0.exe (PID: 4976)
      • netlimiter-5.2.3.0.exe (PID: 736)
      • VC_redist.x86.exe (PID: 5728)

    • Create files in a temporary directory

      • VC_redist.x64.exe (PID: 2268)
      • netlimiter-5.2.3.0.exe (PID: 736)

    • Manual execution by a user

      • NLClientApp.exe (PID: 8004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

ProductVersion: 5.2.3.0
ProductName: NetLimiter
OriginalFileName: netlimiter-5.2.3.0.exe
LegalCopyright: Copyright (C) 2023 Locktime Software
InternalName: netlimiter-5.2.3.0
FileVersion: 5.2.3.0
FileDescription: NetLimiter Installer
CompanyName: Locktime Software
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Dynamic link library
FileOS: Win32
FileFlags: Debug
FileFlagsMask: 0x003f
ProductVersionNumber: 5.2.3.0
FileVersionNumber: 5.2.3.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x1d0974
UninitializedDataSize: -
InitializedDataSize: 885760
CodeSize: 2450944
LinkerVersion: 14.34
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2022:12:14 13:40:00+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Dec-2022 13:40:00
Detected languages:
  • English - United States
Debug artifacts:
  • C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
CompanyName: Locktime Software
FileDescription: NetLimiter Installer
FileVersion: 5.2.3.0
InternalName: netlimiter-5.2.3.0
LegalCopyright: Copyright (C) 2023 Locktime Software
OriginalFileName: netlimiter-5.2.3.0.exe
ProductName: NetLimiter
ProductVersion: 5.2.3.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 14-Dec-2022 13:40:00
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x002565C6
0x00256600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45451
.rdata
0x00258000
0x0008B322
0x0008B400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.58989
.data
0x002E4000
0x0000CF40
0x00003A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.76189
.rsrc
0x002F1000
0x00021B88
0x00021C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.24098
.reloc
0x00313000
0x000279D0
0x00027A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.52162

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.18931
2063
Latin 1 / Western European
English - United States
RT_MANIFEST
2
1.58455
2216
Latin 1 / Western European
English - United States
RT_ICON
3
1.59297
5672
Latin 1 / Western European
English - United States
RT_ICON
4
3.54157
2440
Latin 1 / Western European
English - United States
RT_ICON
5
4.01317
1128
Latin 1 / Western European
English - United States
RT_ICON
9
3.29815
564
Latin 1 / Western European
English - United States
RT_STRING
10
3.15121
386
Latin 1 / Western European
English - United States
RT_STRING
11
2.24351
80
Latin 1 / Western European
English - United States
RT_STRING
12
2.49103
154
Latin 1 / Western European
English - United States
RT_STRING
13
3.27977
758
Latin 1 / Western European
English - United States
RT_STRING

Imports

KERNEL32.dll
msi.dll (delay-loaded)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
16
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start netlimiter-5.2.3.0.exe vc_redist.x64.exe vc_redist.x64.exe vc_redist.x64.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs vc_redist.x86.exe vc_redist.x86.exe vc_redist.x86.exe netlimiter-5.2.3.0.exe nlsvc.exe no specs nlclientapp.exe no specs nlsvcclicnncheck.exe no specs netlimiter-5.2.3.0.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\Users\admin\Desktop\netlimiter-5.2.3.0.exe" C:\Users\admin\Desktop\netlimiter-5.2.3.0.exe
explorer.exe
User:
admin
Company:
Locktime Software
Integrity Level:
HIGH
Description:
NetLimiter Installer
Exit code:
0
Version:
5.2.3.0
Modules
Images
c:\users\admin\desktop\netlimiter-5.2.3.0.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
760"C:\Windows\Temp\{2215FB21-C719-42E9-9599-3A2E70653909}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\admin\AppData\Roaming\Locktime Software\NetLimiter\prerequisites\A918597FE054CCCB65ABDBA0AD8F63C\VC_redist.x86.exe" -burn.filehandle.attached=572 -burn.filehandle.self=692 /qC:\Windows\Temp\{2215FB21-C719-42E9-9599-3A2E70653909}\.cr\VC_redist.x86.exe
VC_redist.x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.24.28127
Exit code:
0
Version:
14.24.28127.4
1044"C:\Windows\Temp\{5DFDAFF5-2957-4D10-BE38-61623AFC6EA3}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7AA60EF3-4B7E-4F67-ADC6-7708F0402E64} {458F8623-59BB-440E-955C-0F8D4DC83C05} 2268C:\Windows\Temp\{5DFDAFF5-2957-4D10-BE38-61623AFC6EA3}\.be\VC_redist.x64.exe
VC_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.24.28127
Exit code:
0
Version:
14.24.28127.4
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\temp\{5dfdaff5-2957-4d10-be38-61623afc6ea3}\.be\vc_redist.x64.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
1052"C:\Program Files\Locktime Software\NetLimiter\NLSvcCliCnnCheck.exe" 01a4eec6d7d847429ef1f5c91095f025C:\Program Files\Locktime Software\NetLimiter\NLSvcCliCnnCheck.exe—NLClientApp.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
1984"C:\Program Files\Locktime Software\NetLimiter\NLSvc.exe"C:\Program Files\Locktime Software\NetLimiter\NLSvc.exe—services.exe
User:
SYSTEM
Company:
Locktime Software
Integrity Level:
SYSTEM
Description:
NLSvc
Exit code:
0
Version:
5.2.3.0
2268"C:\Windows\Temp\{7758CD01-2E24-4DC0-A745-F34FC33BD892}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\admin\AppData\Roaming\Locktime Software\NetLimiter\prerequisites\C4FE6FD5B7C4D07B3A313E754A9A6A8\VC_redist.x64.exe" -burn.filehandle.attached=588 -burn.filehandle.self=500 /qC:\Windows\Temp\{7758CD01-2E24-4DC0-A745-F34FC33BD892}\.cr\VC_redist.x64.exe
VC_redist.x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.24.28127
Exit code:
0
Version:
14.24.28127.4
Modules
Images
c:\windows\temp\{7758cd01-2e24-4dc0-a745-f34fc33bd892}\.cr\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
2648\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
3636"C:\Users\admin\AppData\Roaming\Locktime Software\NetLimiter\prerequisites\A918597FE054CCCB65ABDBA0AD8F63C\VC_redist.x86.exe" /qC:\Users\admin\AppData\Roaming\Locktime Software\NetLimiter\prerequisites\A918597FE054CCCB65ABDBA0AD8F63C\VC_redist.x86.exe
netlimiter-5.2.3.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.24.28127
Exit code:
0
Version:
14.24.28127.4
3680C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
3896"C:\Users\admin\AppData\Roaming\Locktime Software\NetLimiter\prerequisites\C4FE6FD5B7C4D07B3A313E754A9A6A8\VC_redist.x64.exe" /qC:\Users\admin\AppData\Roaming\Locktime Software\NetLimiter\prerequisites\C4FE6FD5B7C4D07B3A313E754A9A6A8\VC_redist.x64.exe
netlimiter-5.2.3.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.24.28127
Exit code:
0
Version:
14.24.28127.4
Modules
Images
c:\users\admin\appdata\roaming\locktime software\netlimiter\prerequisites\c4fe6fd5b7c4d07b3a313e754a9a6a8\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
Total events
5 566
Read events
5 488
Write events
76
Delete events
2

Modification events

(PID) Process:(736) netlimiter-5.2.3.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Operation:writeName:Blob
Value:
0300000001000000140000004EFC31460C619ECAE59C1BCE2C008036D94C84B809000000010000000C000000300A06082B060105050703031D00000001000000100000005467B0ADDE8D858E30EE517B1A19ECD91400000001000000140000001F00BF46800AFC7839B7A5B443D95650BBCE963B53000000010000001F000000301D301B060567810C010330123010060A2B0601040182373C0101030200C06200000001000000200000007B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF860B000000010000004200000047006C006F00620061006C005300690067006E00200043006F006400650020005300690067006E0069006E006700200052006F006F00740020005200340035000000200000000100000076050000308205723082035AA00302010202107653FEAC75464893F5E5D74A483A4EF8300D06092A864886F70D01010C05003053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F7420523435301E170D3230303331383030303030305A170D3435303331383030303030305A3053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F742052343530820222300D06092A864886F70D01010105000382020F003082020A0282020100B62DC530DD7AE8AB903D0372B03A4B991661B2E5FFA5671D371CE57EEC9383AA84F5A3439B98458AB863575D9B00880425E9F868924B82D84BC94A03F3A87F6A8F8A6127BDA144D0FDF53F22C2A34F918DB305B22882915DFB5988050B9706C298F82CA73324EE503A41CCF0A0B07B1D4DD2A8583896E9DFF91B91BB8B102CD2C7431DA20974A180AF7BE6330A0C596B8EBCF4AB5A977B7FAE55FB84F080FE844CD7E2BABDC475A16FBD61107444B29807E274ABFF68DC6C263EE91FE5E00487AD30D30C8D037C55B816705C24782025EB676788ABBA4E34986B7011DE38CAD4BEA1C09CE1DF1E0201D83BE1674384B6CFFC74B72F84A3BFBA09373D676CB1455C1961AB4183F5AC1DEB770D464773CEBFBD9595ED9D2B8810FEFA58E8A757E1B3CFA85AE907259B12C49E80723D93DC8C94DF3B44E62680FCD2C303F08C0CD245D62EE78F989EE604EE426E677E42167162E704F960C664A1B69C81214E2BC66D689486C699747367317A91F2D48C796E7CA6BB7E466F4DC585122BCF9A224408A88537CE07615706171224C0C43173A1983557477E103A45D92DA4519098A9A00737C4651AAA1C6B1677F7A797EC3F1930996F31FBEA40B2E7D2C4FAC9D0F050767459FA8D6D1732BEF8E97E03F4E787759AD44A912C850313022B4280F2896A36CFC84CA0CE9EF8CB8DAD16A7D3DED59B18A7C6923AF18263F12E0E2464DF0203010001A3423040300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E041604141F00BF46800AFC7839B7A5B443D95650BBCE963B300D06092A864886F70D01010C050003820201005E2BBA749734445F764828408493EE016EE9A1B3D68025E67BE4BC09913D0FFC76ADD7D43020BB8F60D091D61CF29CEF781A2B943202C12496525202D0F3D1FCF29B396E99E11F8E43417D9A1E5BC95D9A84FC26E687F3747226ADA41BD93D3B6A52A03C091E2F1E7BB333B445C7F7ACB1AF9360AD76AEB8B21578EB836AEBFFDB46AB24E5EE02FA901F59C02F5DD6B75DA45C10B77253F8414ECCFA781A254ACAFE85624361C3B437AA81D2F4D63A0FBD8D597E3047DE2B6BE72150335FD4679BD4B8679F3C279903FF85438E7312CA20CDE861D5B166DC17D6396D0FDBCF2337A182894E1C6B3FD6A0CDAA079D3E4226AAD70CEEFA47BF1A527ED17581D3C98A62176D4F88A021A0263EAF6DD962301FE99828AE6E8DD58E4C726693808D2AE355C760679042565C22510FB3DC4E39EE4DDDD91D7810543B6ED0976F03B51EB22373C612B29A64D0FC958524A8FFDFA1B0DC9140AEDF0933ABB9DD92B7F1CC91743B69EB67971B90BFE7C7A06F71BB57BFB78F5AED7A406A16CD80842D2FE102D4249443B315FC0C2B1BFD716FFCCBBC75173A5E83D2C9B32F1BD59C8D7F54FE7E7EE456A387A79DE1595294418F6D5BBE86959AFF1A76DD40D2514A70B41F336323773FEC271E59E40887ED34824A0F3FFEA01DC1F56773458678F4AA29E92787C619DBC61314C33949874DA097E06513F59D7756E9DAB358C73AF2C0CD82
(PID) Process:(736) netlimiter-5.2.3.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Operation:writeName:Blob
Value:
0F0000000100000030000000C130BBA37B8B350E89FD5ED76B4F78777FEEE220D3B9E729042BEF6AF46E8E4C1B252E32B3080C681BC9A8A1AFDD0A3C0B000000010000004200000047006C006F00620061006C005300690067006E00200043006F006400650020005300690067006E0069006E006700200052006F006F007400200052003400350000006200000001000000200000007B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF8653000000010000001F000000301D301B060567810C010330123010060A2B0601040182373C0101030200C01400000001000000140000001F00BF46800AFC7839B7A5B443D95650BBCE963B1D00000001000000100000005467B0ADDE8D858E30EE517B1A19ECD909000000010000000C000000300A06082B060105050703030300000001000000140000004EFC31460C619ECAE59C1BCE2C008036D94C84B8200000000100000076050000308205723082035AA00302010202107653FEAC75464893F5E5D74A483A4EF8300D06092A864886F70D01010C05003053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F7420523435301E170D3230303331383030303030305A170D3435303331383030303030305A3053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F742052343530820222300D06092A864886F70D01010105000382020F003082020A0282020100B62DC530DD7AE8AB903D0372B03A4B991661B2E5FFA5671D371CE57EEC9383AA84F5A3439B98458AB863575D9B00880425E9F868924B82D84BC94A03F3A87F6A8F8A6127BDA144D0FDF53F22C2A34F918DB305B22882915DFB5988050B9706C298F82CA73324EE503A41CCF0A0B07B1D4DD2A8583896E9DFF91B91BB8B102CD2C7431DA20974A180AF7BE6330A0C596B8EBCF4AB5A977B7FAE55FB84F080FE844CD7E2BABDC475A16FBD61107444B29807E274ABFF68DC6C263EE91FE5E00487AD30D30C8D037C55B816705C24782025EB676788ABBA4E34986B7011DE38CAD4BEA1C09CE1DF1E0201D83BE1674384B6CFFC74B72F84A3BFBA09373D676CB1455C1961AB4183F5AC1DEB770D464773CEBFBD9595ED9D2B8810FEFA58E8A757E1B3CFA85AE907259B12C49E80723D93DC8C94DF3B44E62680FCD2C303F08C0CD245D62EE78F989EE604EE426E677E42167162E704F960C664A1B69C81214E2BC66D689486C699747367317A91F2D48C796E7CA6BB7E466F4DC585122BCF9A224408A88537CE07615706171224C0C43173A1983557477E103A45D92DA4519098A9A00737C4651AAA1C6B1677F7A797EC3F1930996F31FBEA40B2E7D2C4FAC9D0F050767459FA8D6D1732BEF8E97E03F4E787759AD44A912C850313022B4280F2896A36CFC84CA0CE9EF8CB8DAD16A7D3DED59B18A7C6923AF18263F12E0E2464DF0203010001A3423040300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E041604141F00BF46800AFC7839B7A5B443D95650BBCE963B300D06092A864886F70D01010C050003820201005E2BBA749734445F764828408493EE016EE9A1B3D68025E67BE4BC09913D0FFC76ADD7D43020BB8F60D091D61CF29CEF781A2B943202C12496525202D0F3D1FCF29B396E99E11F8E43417D9A1E5BC95D9A84FC26E687F3747226ADA41BD93D3B6A52A03C091E2F1E7BB333B445C7F7ACB1AF9360AD76AEB8B21578EB836AEBFFDB46AB24E5EE02FA901F59C02F5DD6B75DA45C10B77253F8414ECCFA781A254ACAFE85624361C3B437AA81D2F4D63A0FBD8D597E3047DE2B6BE72150335FD4679BD4B8679F3C279903FF85438E7312CA20CDE861D5B166DC17D6396D0FDBCF2337A182894E1C6B3FD6A0CDAA079D3E4226AAD70CEEFA47BF1A527ED17581D3C98A62176D4F88A021A0263EAF6DD962301FE99828AE6E8DD58E4C726693808D2AE355C760679042565C22510FB3DC4E39EE4DDDD91D7810543B6ED0976F03B51EB22373C612B29A64D0FC958524A8FFDFA1B0DC9140AEDF0933ABB9DD92B7F1CC91743B69EB67971B90BFE7C7A06F71BB57BFB78F5AED7A406A16CD80842D2FE102D4249443B315FC0C2B1BFD716FFCCBBC75173A5E83D2C9B32F1BD59C8D7F54FE7E7EE456A387A79DE1595294418F6D5BBE86959AFF1A76DD40D2514A70B41F336323773FEC271E59E40887ED34824A0F3FFEA01DC1F56773458678F4AA29E92787C619DBC61314C33949874DA097E06513F59D7756E9DAB358C73AF2C0CD82
(PID) Process:(736) netlimiter-5.2.3.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Operation:writeName:Blob
Value:
1900000001000000100000005D1B8FF2C30F63F5B536EDD400F7F9B40300000001000000140000004EFC31460C619ECAE59C1BCE2C008036D94C84B809000000010000000C000000300A06082B060105050703031D00000001000000100000005467B0ADDE8D858E30EE517B1A19ECD91400000001000000140000001F00BF46800AFC7839B7A5B443D95650BBCE963B53000000010000001F000000301D301B060567810C010330123010060A2B0601040182373C0101030200C06200000001000000200000007B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF860B000000010000004200000047006C006F00620061006C005300690067006E00200043006F006400650020005300690067006E0069006E006700200052006F006F007400200052003400350000000F0000000100000030000000C130BBA37B8B350E89FD5ED76B4F78777FEEE220D3B9E729042BEF6AF46E8E4C1B252E32B3080C681BC9A8A1AFDD0A3C200000000100000076050000308205723082035AA00302010202107653FEAC75464893F5E5D74A483A4EF8300D06092A864886F70D01010C05003053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F7420523435301E170D3230303331383030303030305A170D3435303331383030303030305A3053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F742052343530820222300D06092A864886F70D01010105000382020F003082020A0282020100B62DC530DD7AE8AB903D0372B03A4B991661B2E5FFA5671D371CE57EEC9383AA84F5A3439B98458AB863575D9B00880425E9F868924B82D84BC94A03F3A87F6A8F8A6127BDA144D0FDF53F22C2A34F918DB305B22882915DFB5988050B9706C298F82CA73324EE503A41CCF0A0B07B1D4DD2A8583896E9DFF91B91BB8B102CD2C7431DA20974A180AF7BE6330A0C596B8EBCF4AB5A977B7FAE55FB84F080FE844CD7E2BABDC475A16FBD61107444B29807E274ABFF68DC6C263EE91FE5E00487AD30D30C8D037C55B816705C24782025EB676788ABBA4E34986B7011DE38CAD4BEA1C09CE1DF1E0201D83BE1674384B6CFFC74B72F84A3BFBA09373D676CB1455C1961AB4183F5AC1DEB770D464773CEBFBD9595ED9D2B8810FEFA58E8A757E1B3CFA85AE907259B12C49E80723D93DC8C94DF3B44E62680FCD2C303F08C0CD245D62EE78F989EE604EE426E677E42167162E704F960C664A1B69C81214E2BC66D689486C699747367317A91F2D48C796E7CA6BB7E466F4DC585122BCF9A224408A88537CE07615706171224C0C43173A1983557477E103A45D92DA4519098A9A00737C4651AAA1C6B1677F7A797EC3F1930996F31FBEA40B2E7D2C4FAC9D0F050767459FA8D6D1732BEF8E97E03F4E787759AD44A912C850313022B4280F2896A36CFC84CA0CE9EF8CB8DAD16A7D3DED59B18A7C6923AF18263F12E0E2464DF0203010001A3423040300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E041604141F00BF46800AFC7839B7A5B443D95650BBCE963B300D06092A864886F70D01010C050003820201005E2BBA749734445F764828408493EE016EE9A1B3D68025E67BE4BC09913D0FFC76ADD7D43020BB8F60D091D61CF29CEF781A2B943202C12496525202D0F3D1FCF29B396E99E11F8E43417D9A1E5BC95D9A84FC26E687F3747226ADA41BD93D3B6A52A03C091E2F1E7BB333B445C7F7ACB1AF9360AD76AEB8B21578EB836AEBFFDB46AB24E5EE02FA901F59C02F5DD6B75DA45C10B77253F8414ECCFA781A254ACAFE85624361C3B437AA81D2F4D63A0FBD8D597E3047DE2B6BE72150335FD4679BD4B8679F3C279903FF85438E7312CA20CDE861D5B166DC17D6396D0FDBCF2337A182894E1C6B3FD6A0CDAA079D3E4226AAD70CEEFA47BF1A527ED17581D3C98A62176D4F88A021A0263EAF6DD962301FE99828AE6E8DD58E4C726693808D2AE355C760679042565C22510FB3DC4E39EE4DDDD91D7810543B6ED0976F03B51EB22373C612B29A64D0FC958524A8FFDFA1B0DC9140AEDF0933ABB9DD92B7F1CC91743B69EB67971B90BFE7C7A06F71BB57BFB78F5AED7A406A16CD80842D2FE102D4249443B315FC0C2B1BFD716FFCCBBC75173A5E83D2C9B32F1BD59C8D7F54FE7E7EE456A387A79DE1595294418F6D5BBE86959AFF1A76DD40D2514A70B41F336323773FEC271E59E40887ED34824A0F3FFEA01DC1F56773458678F4AA29E92787C619DBC61314C33949874DA097E06513F59D7756E9DAB358C73AF2C0CD82
(PID) Process:(736) netlimiter-5.2.3.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8
Operation:writeName:Blob
Value:
040000000100000010000000E94FB54871208C00DF70F708AC47085B0F0000000100000030000000C130BBA37B8B350E89FD5ED76B4F78777FEEE220D3B9E729042BEF6AF46E8E4C1B252E32B3080C681BC9A8A1AFDD0A3C0B000000010000004200000047006C006F00620061006C005300690067006E00200043006F006400650020005300690067006E0069006E006700200052006F006F007400200052003400350000006200000001000000200000007B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF8653000000010000001F000000301D301B060567810C010330123010060A2B0601040182373C0101030200C01400000001000000140000001F00BF46800AFC7839B7A5B443D95650BBCE963B1D00000001000000100000005467B0ADDE8D858E30EE517B1A19ECD909000000010000000C000000300A06082B060105050703030300000001000000140000004EFC31460C619ECAE59C1BCE2C008036D94C84B81900000001000000100000005D1B8FF2C30F63F5B536EDD400F7F9B4200000000100000076050000308205723082035AA00302010202107653FEAC75464893F5E5D74A483A4EF8300D06092A864886F70D01010C05003053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F7420523435301E170D3230303331383030303030305A170D3435303331383030303030305A3053310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E762D73613129302706035504031320476C6F62616C5369676E20436F6465205369676E696E6720526F6F742052343530820222300D06092A864886F70D01010105000382020F003082020A0282020100B62DC530DD7AE8AB903D0372B03A4B991661B2E5FFA5671D371CE57EEC9383AA84F5A3439B98458AB863575D9B00880425E9F868924B82D84BC94A03F3A87F6A8F8A6127BDA144D0FDF53F22C2A34F918DB305B22882915DFB5988050B9706C298F82CA73324EE503A41CCF0A0B07B1D4DD2A8583896E9DFF91B91BB8B102CD2C7431DA20974A180AF7BE6330A0C596B8EBCF4AB5A977B7FAE55FB84F080FE844CD7E2BABDC475A16FBD61107444B29807E274ABFF68DC6C263EE91FE5E00487AD30D30C8D037C55B816705C24782025EB676788ABBA4E34986B7011DE38CAD4BEA1C09CE1DF1E0201D83BE1674384B6CFFC74B72F84A3BFBA09373D676CB1455C1961AB4183F5AC1DEB770D464773CEBFBD9595ED9D2B8810FEFA58E8A757E1B3CFA85AE907259B12C49E80723D93DC8C94DF3B44E62680FCD2C303F08C0CD245D62EE78F989EE604EE426E677E42167162E704F960C664A1B69C81214E2BC66D689486C699747367317A91F2D48C796E7CA6BB7E466F4DC585122BCF9A224408A88537CE07615706171224C0C43173A1983557477E103A45D92DA4519098A9A00737C4651AAA1C6B1677F7A797EC3F1930996F31FBEA40B2E7D2C4FAC9D0F050767459FA8D6D1732BEF8E97E03F4E787759AD44A912C850313022B4280F2896A36CFC84CA0CE9EF8CB8DAD16A7D3DED59B18A7C6923AF18263F12E0E2464DF0203010001A3423040300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E041604141F00BF46800AFC7839B7A5B443D95650BBCE963B300D06092A864886F70D01010C050003820201005E2BBA749734445F764828408493EE016EE9A1B3D68025E67BE4BC09913D0FFC76ADD7D43020BB8F60D091D61CF29CEF781A2B943202C12496525202D0F3D1FCF29B396E99E11F8E43417D9A1E5BC95D9A84FC26E687F3747226ADA41BD93D3B6A52A03C091E2F1E7BB333B445C7F7ACB1AF9360AD76AEB8B21578EB836AEBFFDB46AB24E5EE02FA901F59C02F5DD6B75DA45C10B77253F8414ECCFA781A254ACAFE85624361C3B437AA81D2F4D63A0FBD8D597E3047DE2B6BE72150335FD4679BD4B8679F3C279903FF85438E7312CA20CDE861D5B166DC17D6396D0FDBCF2337A182894E1C6B3FD6A0CDAA079D3E4226AAD70CEEFA47BF1A527ED17581D3C98A62176D4F88A021A0263EAF6DD962301FE99828AE6E8DD58E4C726693808D2AE355C760679042565C22510FB3DC4E39EE4DDDD91D7810543B6ED0976F03B51EB22373C612B29A64D0FC958524A8FFDFA1B0DC9140AEDF0933ABB9DD92B7F1CC91743B69EB67971B90BFE7C7A06F71BB57BFB78F5AED7A406A16CD80842D2FE102D4249443B315FC0C2B1BFD716FFCCBBC75173A5E83D2C9B32F1BD59C8D7F54FE7E7EE456A387A79DE1595294418F6D5BBE86959AFF1A76DD40D2514A70B41F336323773FEC271E59E40887ED34824A0F3FFEA01DC1F56773458678F4AA29E92787C619DBC61314C33949874DA097E06513F59D7756E9DAB358C73AF2C0CD82
(PID) Process:(736) netlimiter-5.2.3.0.exeKey:HKEY_CURRENT_USER\Software\AiTemp
Operation:delete keyName:(default)
Value:
(PID) Process:(736) netlimiter-5.2.3.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(736) netlimiter-5.2.3.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(736) netlimiter-5.2.3.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(736) netlimiter-5.2.3.0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2268) VC_redist.x64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
713
Suspicious files
28
Text files
297
Unknown types
14

Dropped files

PID
Process
Filename
Type
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\Local\Temp\{F70C1CBE-B979-47C1-A9B7-67A2A32251EE}\holder0.aiph —
MD5:—
SHA256:—
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_736\installlogoiconimage
MD5:488C247C4D7482E34D4576C44CEE79E0
SHA256:EB276449EB326A407CE055001607F212FFCAEF01B5F849BB50A606BD9CD177A6
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:A31A92F772FA75AA5119172E3F2119BC
SHA256:2FBD75A5876393ECAA8843333E9A5100D907B7EF78128CA892022ECB66A97B55
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_736\frame_bottom_left.bmpimage
MD5:1FB3755FE9676FCA35B8D3C6A8E80B45
SHA256:384EBD5800BECADF3BD9014686E6CC09344F75CE426E966D788EB5473B28AA21
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Eder
MD5:8DF36F18551FFA96581DF6CB95590575
SHA256:8BE855C624B7AA2B085BEDB982117CB328711355DB5C8CACAD2E30592CF78CC7
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\Local\Temp\{F70C1CBE-B979-47C1-A9B7-67A2A32251EE}\32251EE\netlimiter-5.2.3.0.msiexecutable
MD5:450C9FAA07F86859085A8553B3BB0556
SHA256:1EDDF7E6BDC5930FE2E40C5E6D4F9279CC248B6E2E8B8D774B00DA0A893838C2
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\Local\Temp\MSIAFBD.tmpexecutable
MD5:DB7612F0FD6408D664185CFC81BEF0CB
SHA256:E9E426B679B3EFB233F03C696E997E2DA3402F16A321E954B54454317FCEB240
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\Local\Temp\{F70C1CBE-B979-47C1-A9B7-67A2A32251EE}\32251EE\netlimiter-5.2.3.0.x64.msiexecutable
MD5:1C6B6F491D4C4843BE522F2C64619FB9
SHA256:28F87797ED2E0D8D947BFB426C2CAB7D1D20894EA7E091BE1F413CD7ED37FEBD
736netlimiter-5.2.3.0.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_736\metrorunapplicationbuttonimage
MD5:49AD8E9164FD6FACB8A8BFD6F62972B8
SHA256:914A0241A557591DFDCF3ED1EF0E557CEB153F32C716C53D13342DC5318BBB79
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
13
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1480
svchost.exe
GET
200
13.107.4.52:80
http://www.msftconnecttest.com/connecttest.txt
US
text
22 b
whitelisted
736
netlimiter-5.2.3.0.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDEX685ZejurnNJyDZQ%3D%3D
US
der
1.65 Kb
whitelisted
4624
msiexec.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
—
—
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
US
der
1.67 Kb
whitelisted
4388
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
—
—
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDEX685ZejurnNJyDZQ%3D%3D
US
der
1.65 Kb
whitelisted
736
netlimiter-5.2.3.0.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
US
der
1.67 Kb
whitelisted
736
netlimiter-5.2.3.0.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5fe63a1ed5382a54
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
13.107.4.52:80
www.msftconnecttest.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
736
netlimiter-5.2.3.0.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
736
netlimiter-5.2.3.0.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
4388
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4388
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4624
msiexec.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4624
msiexec.exe
68.232.34.200:443
download.visualstudio.microsoft.com
EDGECAST
US
whitelisted
—
—
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
—
—
2.19.229.151:443
fs.microsoft.com
AKAMAI-AS
FR
suspicious

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
download.visualstudio.microsoft.com
  • 68.232.34.200
whitelisted
www.msftconnecttest.com
  • 13.107.4.52
whitelisted
time.windows.com
  • 20.101.57.9
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
fs.microsoft.com
  • 2.19.229.151
whitelisted

Threats

PID
Process
Class
Message
1480
svchost.exe
Misc activity
ET INFO Microsoft Connection Test
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
netlimiter-5.2.3.0.exe