analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

netcut.exe

Full analysis: https://app.any.run/tasks/ad3574d7-a5ab-46ef-9b0d-fa43dcbee83b
Verdict: Malicious activity
Analysis date: February 04, 2024, 17:33:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

EFEB414AD2FC4C0A3D177502ED738262

SHA1:

CFBF3315C9679D522EC5FB4A1D55B3BBB97A9BE9

SHA256:

E855E1F8C66C2DB4C8F7261495C35AB81DC07E633F84E72EB26B44722D435C48

SSDEEP:

98304:4+cD4dnGwV6C6pVCOAowrb6kdI4EKMQxbWxITm2PHoPMPZj4vRyVI9ChnedRNw4S:SkFDfd2nGD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • netcut.exe (PID: 1392)
      • netcut.exe (PID: 2868)
      • netcut.tmp (PID: 3332)
      • WinPcap_4_1_3.exe (PID: 3636)

    • Creates a writable file in the system directory

      • WinPcap_4_1_3.exe (PID: 3636)
      • netcut_windows.exe (PID: 2536)

    • Starts NET.EXE for service management

      • net.exe (PID: 3788)
      • WinPcap_4_1_3.exe (PID: 3636)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • netcut.exe (PID: 1392)
      • netcut.exe (PID: 2868)
      • netcut.tmp (PID: 3332)
      • WinPcap_4_1_3.exe (PID: 3636)

    • Reads the Windows owner or organization settings

      • netcut.tmp (PID: 3332)

    • Process drops legitimate windows executable

      • netcut.tmp (PID: 3332)

    • The process drops C-runtime libraries

      • netcut.tmp (PID: 3332)

    • Starts SC.EXE for service management

      • netcut.tmp (PID: 3332)

    • Drops a system driver (possible attempt to evade defenses)

      • WinPcap_4_1_3.exe (PID: 3636)

    • Creates files in the driver directory

      • WinPcap_4_1_3.exe (PID: 3636)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • WinPcap_4_1_3.exe (PID: 3636)

    • Creates or modifies Windows services

      • WinPcap_4_1_3.exe (PID: 3636)

    • The process creates files with name similar to system file names

      • WinPcap_4_1_3.exe (PID: 3636)

    • Executes as Windows Service

      • aips.exe (PID: 2948)

    • Starts CMD.EXE for commands execution

      • aips.exe (PID: 2948)

    • Connects to unusual port

      • netcut_windows.exe (PID: 2536)
      • netcut_windows.exe (PID: 2284)

    • Reads the Internet Settings

      • netcut.tmp (PID: 1632)
      • sipnotify.exe (PID: 1832)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1832)
      • ctfmon.exe (PID: 1500)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1832)

  • INFO

    • Reads the computer name

      • netcut.tmp (PID: 1632)
      • netcut.tmp (PID: 3332)
      • WinPcap_4_1_3.exe (PID: 3636)
      • aips.exe (PID: 3880)
      • aips.exe (PID: 2948)
      • netcut_windows.exe (PID: 2536)
      • wmpnscfg.exe (PID: 3020)
      • netcut.exe (PID: 1392)
      • IMEKLMG.EXE (PID: 2060)
      • IMEKLMG.EXE (PID: 2052)
      • netcut_windows.exe (PID: 2284)
      • wmpnscfg.exe (PID: 2740)
      • wmpnscfg.exe (PID: 3092)
      • wmpnscfg.exe (PID: 2784)

    • Checks supported languages

      • netcut.tmp (PID: 1632)
      • netcut.exe (PID: 1392)
      • netcut.tmp (PID: 3332)
      • netcut.exe (PID: 2868)
      • WinPcap_4_1_3.exe (PID: 3636)
      • aips.exe (PID: 3880)
      • aips.exe (PID: 2948)
      • netcut_windows.exe (PID: 2536)
      • netcut_windows.exe (PID: 1220)
      • wmpnscfg.exe (PID: 3020)
      • IMEKLMG.EXE (PID: 2060)
      • IMEKLMG.EXE (PID: 2052)
      • netcut_windows.exe (PID: 2284)
      • netcut_windows.exe (PID: 2244)
      • wmpnscfg.exe (PID: 2740)
      • wmpnscfg.exe (PID: 2784)
      • wmpnscfg.exe (PID: 3092)

    • Create files in a temporary directory

      • netcut.exe (PID: 1392)
      • netcut.exe (PID: 2868)
      • WinPcap_4_1_3.exe (PID: 3636)

    • Creates files in the program directory

      • netcut.tmp (PID: 3332)
      • WinPcap_4_1_3.exe (PID: 3636)
      • netcut_windows.exe (PID: 2536)

    • Creates files or folders in the user directory

      • netcut.tmp (PID: 3332)

    • Reads Environment values

      • WinPcap_4_1_3.exe (PID: 3636)

    • Reads the machine GUID from the registry

      • netcut_windows.exe (PID: 2536)
      • aips.exe (PID: 2948)
      • netcut_windows.exe (PID: 2284)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3020)
      • IMEKLMG.EXE (PID: 2060)
      • IMEKLMG.EXE (PID: 2052)
      • wmpnscfg.exe (PID: 2740)
      • wmpnscfg.exe (PID: 2784)
      • wmpnscfg.exe (PID: 3092)
      • msedge.exe (PID: 3116)

    • Application launched itself

      • msedge.exe (PID: 3664)
      • msedge.exe (PID: 3116)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1832)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2060)
      • IMEKLMG.EXE (PID: 2052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

ProductVersion: 3.0.230
ProductName: netcut
OriginalFileName:
LegalCopyright:
FileVersion:
FileDescription: netcut Setup
CompanyName: arcai.com
Comments: This installation was built with Inno Setup.
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 6.1
ImageVersion: 6
OSVersion: 6.1
EntryPoint: 0xb5eec
UninitializedDataSize: -
InitializedDataSize: 133120
CodeSize: 741888
LinkerVersion: 2.25
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
TimeStamp: 2023:02:15 15:54:16+01:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
70
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start netcut.exe netcut.tmp no specs netcut.exe netcut.tmp sc.exe no specs winpcap_4_1_3.exe net.exe no specs net1.exe no specs aips.exe no specs aips.exe cmd.exe no specs netcut_windows.exe no specs netcut_windows.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs msedge.exe no specs msedge.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs cmd.exe no specs netcut_windows.exe no specs netcut_windows.exe wmpnscfg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1392"C:\Users\admin\AppData\Local\Temp\netcut.exe" C:\Users\admin\AppData\Local\Temp\netcut.exe
explorer.exe
User:
admin
Company:
arcai.com
Integrity Level:
MEDIUM
Description:
netcut Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\netcut.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1632"C:\Users\admin\AppData\Local\Temp\is-035FH.tmp\netcut.tmp" /SL5="$F0184,4289972,876032,C:\Users\admin\AppData\Local\Temp\netcut.exe" C:\Users\admin\AppData\Local\Temp\is-035FH.tmp\netcut.tmp—netcut.exe
User:
admin
Company:
arcai.com
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-035fh.tmp\netcut.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2868"C:\Users\admin\AppData\Local\Temp\netcut.exe" /SPAWNWND=$1201B4 /NOTIFYWND=$F0184 C:\Users\admin\AppData\Local\Temp\netcut.exe
netcut.tmp
User:
admin
Company:
arcai.com
Integrity Level:
HIGH
Description:
netcut Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\netcut.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3332"C:\Users\admin\AppData\Local\Temp\is-1B0QV.tmp\netcut.tmp" /SL5="$F0182,4289972,876032,C:\Users\admin\AppData\Local\Temp\netcut.exe" /SPAWNWND=$1201B4 /NOTIFYWND=$F0184 C:\Users\admin\AppData\Local\Temp\is-1B0QV.tmp\netcut.tmp
netcut.exe
User:
admin
Company:
arcai.com
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-1b0qv.tmp\netcut.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3600"C:\Windows\system32\sc.exe" stop aipsC:\Windows\System32\sc.exe—netcut.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3636"C:\Program Files\arcai.com\WinPcap_4_1_3.exe"C:\Program Files\arcai.com\WinPcap_4_1_3.exe
netcut.tmp
User:
admin
Company:
Riverbed Technology, Inc.
Integrity Level:
HIGH
Description:
WinPcap 4.1.3 installer
Exit code:
0
Version:
4.1.0.2980
Modules
Images
c:\program files\arcai.com\winpcap_4_1_3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3788net start npfC:\Windows\System32\net.exe—WinPcap_4_1_3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
3836C:\Windows\system32\net1 start npfC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
3880"C:\Program Files\arcai.com\aips.exe" installC:\Program Files\arcai.com\aips.exe—netcut.tmp
User:
admin
Company:
Arcai.com
Integrity Level:
HIGH
Description:
Arp Intelligent Protection Service
Exit code:
1
Version:
214
Modules
Images
c:\program files\arcai.com\aips.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
2948"C:\Program Files\arcai.com\aips.exe"C:\Program Files\arcai.com\aips.exe
services.exe
User:
SYSTEM
Company:
Arcai.com
Integrity Level:
SYSTEM
Description:
Arp Intelligent Protection Service
Exit code:
0
Version:
214
Modules
Images
c:\program files\arcai.com\aips.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
Total events
21 387
Read events
21 277
Write events
100
Delete events
10

Modification events

(PID) Process:(3636) WinPcap_4_1_3.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NPF
Operation:writeName:Start
Value:
3
(PID) Process:(3664) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3664) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3664) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3664) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3664) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(3664) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
1
(PID) Process:(3664) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(3664) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
6F4801F01D6B2F00
(PID) Process:(3664) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
1
Executable files
28
Suspicious files
314
Text files
96
Unknown types
0

Dropped files

PID
Process
Filename
Type
3332netcut.tmpC:\Program Files\arcai.com\aips.exeexecutable
MD5:B19EDF19BCA77740FDB145AA41D42108
SHA256:D4EE9F1EE0A8847428824C959FAC2293C59B2BE00B8A2439119C76626A128083
3332netcut.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\netcut\Uninstall netcut.lnkbinary
MD5:819741A2AC3FAAA1A81EFF754C4FAEBB
SHA256:19AB017EB1989C924C3B7FF601A8D7A1C77BC3C52EDB0A4BA44D4EE8875F3BEA
3332netcut.tmpC:\Program Files\arcai.com\is-LFG9U.tmpexecutable
MD5:E13D4C1A7CE887BE193792B3E0D7A8ED
SHA256:4C2F72778B7037AFA6ADB971E5B2342E226233E5D4F45643C956A406DACB6E6F
3332netcut.tmpC:\Program Files\arcai.com\netcut_windows.exeexecutable
MD5:E13D4C1A7CE887BE193792B3E0D7A8ED
SHA256:4C2F72778B7037AFA6ADB971E5B2342E226233E5D4F45643C956A406DACB6E6F
3332netcut.tmpC:\Program Files\arcai.com\unins000.exeexecutable
MD5:122DBB88E125AF378224FA35B809F610
SHA256:854F9FEFE68AA20CD30ACC06DDCDD950815FD05C0511DC031F5AEBFBCB35D9AA
3332netcut.tmpC:\Program Files\arcai.com\macdatatext
MD5:527FA19FEF2324A6FA9EBE504B13A957
SHA256:B4A61D49CB5140083D583278BF4E15E46FFE3BF0B916B89F0916C5374166D0E3
3332netcut.tmpC:\Program Files\arcai.com\favicon.icoimage
MD5:B3588FEF7797DA241ADCBF5938A6F75A
SHA256:D9C7D64C6A4E73166A35F2806DD5E71E728E982592A9BA497C90BD29B8E2FD7F
3332netcut.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\netcut\netcut.urltext
MD5:7B8FE523AF05D296AC62C8E4DE509400
SHA256:54E5D6D2F313BCFA7A6F9268DF376C32A607BF2C47168166A7255077EE3411B8
3332netcut.tmpC:\Program Files\arcai.com\is-APC5D.tmptext
MD5:527FA19FEF2324A6FA9EBE504B13A957
SHA256:B4A61D49CB5140083D583278BF4E15E46FFE3BF0B916B89F0916C5374166D0E3
3332netcut.tmpC:\Program Files\arcai.com\is-OA350.tmpexecutable
MD5:B19EDF19BCA77740FDB145AA41D42108
SHA256:D4EE9F1EE0A8847428824C959FAC2293C59B2BE00B8A2439119C76626A128083
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
192
DNS requests
337
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1832
sipnotify.exe
HEAD
200
23.192.244.236:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133515418033430000
unknown
—
—
unknown
1436
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3c365b25bcff6bc6
unknown
—
—
unknown
1120
aips.exe
GET
200
188.114.97.3:80
http://www.arcai.com/netCut/Update3.php?query=bmFtZT1uZXRjdXRfd2luZG93cy5leGU6dmVyc2lvbj0yMzA=
unknown
text
12 b
unknown
1164
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bfe4c887f6579d32
unknown
—
—
unknown
3116
msedge.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8f9492a906d64ce0
unknown
compressed
65.2 Kb
unknown
1436
svchost.exe
GET
200
88.221.110.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.11 Kb
unknown
2948
aips.exe
GET
200
188.114.97.3:80
http://www.arcai.com/netCut/Update3.php?query=bmFtZT1uZXRjdXRfd2luZG93cy5leGU6dmVyc2lvbj0yMzA=
unknown
text
12 b
unknown
1436
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
binary
814 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4008
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3664
msedge.exe
239.255.255.250:1900
—
—
—
unknown
4008
msedge.exe
188.114.97.3:443
www.arcai.com
CLOUDFLARENET
NL
unknown
2536
netcut_windows.exe
188.114.97.3:443
www.arcai.com
CLOUDFLARENET
NL
unknown
2536
netcut_windows.exe
172.105.129.132:443
load.arcai.com
Linode, LLC
US
unknown
4008
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4008
msedge.exe
66.102.1.84:443
accounts.google.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.arcai.com
  • 188.114.97.3
  • 188.114.96.3
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
load.arcai.com
  • 172.105.129.132
unknown
accounts.google.com
  • 66.102.1.84
shared
js.stripe.com
  • 151.101.0.176
  • 151.101.64.176
  • 151.101.128.176
  • 151.101.192.176
  • 65.9.95.108
  • 65.9.95.7
  • 65.9.95.127
  • 65.9.95.66
shared
fonts.googleapis.com
  • 216.58.206.42
whitelisted
maxcdn.bootstrapcdn.com
  • 104.18.10.207
  • 104.18.11.207
whitelisted
fonts.gstatic.com
  • 172.217.18.99
whitelisted
www.googletagmanager.com
  • 142.250.184.232
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
netcut.exe