| URL: | https://urldefense.proofpoint.com/v2/url?u=https-3A__greaterfreedom.org_share-2Dfile-2Dprocessed-2Dfor-2Ddxu_&d=DwMFAw&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=SuszL5EOSx7OXSc90z1As9vc8SdNJ9VAW0vbMxBtO0E&m=m0ICTPFBa-GnLUrGYGR8HZMTyddEJdhfonGU0CeMPs6jZ-3QXBRI8OAjrUBKx0vr&s=aQ52o86xjjg03RmjIE33_kd6AoJysaLd-LjXYA-pKkI&e= |
| Full analysis: | https://app.any.run/tasks/7c2d1848-de6c-431b-b8ec-9a868268c532 |
| Verdict: | Malicious activity |
| Analysis date: | May 10, 2025, 01:08:17 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| MD5: | 1588A7F0CBCAAAAEC1196D22FA0B4E15 |
| SHA1: | 857734A69E7EBA584883F58572F88BAADE5663DF |
| SHA256: | ED5404FB9ACE43B422FC3CE6F21C20D45B0CF19A2F27C0EB4CD20DC79EA9EC21 |
| SSDEEP: | 6:2UJNP1BZgtkAAaePSTA3KhAzWS9wM1sEkccywYbvUdacq63oGOaPTTAEpZOp:2UHP1fgtk5X5hT5AcZbvUsnSoOTTAV |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
148
Monitored processes
0
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
68
TCP/UDP connections
93
DNS requests
82
Threats
14
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 302 | 52.204.90.22:443 | https://urldefense.proofpoint.com/v2/url?u=https-3A__greaterfreedom.org_share-2Dfile-2Dprocessed-2Dfor-2Ddxu_&d=DwMFAw&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=SuszL5EOSx7OXSc90z1As9vc8SdNJ9VAW0vbMxBtO0E&m=m0ICTPFBa-GnLUrGYGR8HZMTyddEJdhfonGU0CeMPs6jZ-3QXBRI8OAjrUBKx0vr&s=aQ52o86xjjg03RmjIE33_kd6AoJysaLd-LjXYA-pKkI&e= | unknown | — | — | — |
3080 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4208 | svchost.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6344 | RUXIMICS.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3080 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4208 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 404 | 198.54.115.95:443 | https://greaterfreedom.org/favicon.ico | unknown | — | — | — |
— | — | GET | 200 | 142.250.185.100:443 | https://www.google.com/recaptcha/api.js | unknown | binary | 911 b | whitelisted |
— | — | GET | 200 | 2.23.227.208:443 | https://www.bing.com/bloomfilterfiles/ExpandedDomainsFilterGlobal.json | unknown | binary | 654 Kb | whitelisted |
— | — | GET | 200 | 216.58.206.35:443 | https://www.gstatic.com/recaptcha/releases/Hi8UmRMnhdOBM3IuViTkapUP/recaptcha__en.js | unknown | binary | 637 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
3080 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6344 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4208 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1396 | msedge.exe | 52.6.56.188:443 | urldefense.proofpoint.com | AMAZON-AES | US | whitelisted |
1396 | msedge.exe | 198.54.115.95:443 | greaterfreedom.org | NAMECHEAP-NET | US | unknown |
3080 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4208 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6344 | RUXIMICS.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1396 | msedge.exe | 172.217.16.132:443 | www.google.com | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
urldefense.proofpoint.com |
| whitelisted |
greaterfreedom.org |
| unknown |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.google.com |
| whitelisted |
www.bing.com |
| whitelisted |
xpaywalletcdn.azureedge.net |
| whitelisted |
www.gstatic.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |