URL:

https://bimvision.eu/?smd_process_download=1&download_id=10083

Full analysis: https://app.any.run/tasks/29c7940a-f0ef-4430-bb2d-73c11b9e7de9
Verdict: Malicious activity
Analysis date: March 13, 2024, 07:26:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F9423BF53D6C0CD1F0B2F03B50E8E6D0

SHA1:

22C9B8D3681316557855D3C13BC5A200154AE14D

SHA256:

F1141CDF50E67044E39B9CD85D9CA22D7C56487FE1D75648728F5E285083FEFE

SSDEEP:

3:N8HMTQNMVXgUDZUAi:2sTQ2VXRF+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BIMvision 2.27.7 Setup.exe (PID: 1928)
      • BIMvision 2.27.7 Setup.exe (PID: 1768)
      • BIMvision 2.27.7 Setup.tmp (PID: 2900)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BIMvision 2.27.7 Setup.exe (PID: 1928)
      • BIMvision 2.27.7 Setup.tmp (PID: 2900)
      • BIMvision 2.27.7 Setup.exe (PID: 1768)

    • Reads the Windows owner or organization settings

      • BIMvision 2.27.7 Setup.tmp (PID: 2900)

    • Reads the Internet Settings

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Non-standard symbols in registry

      • BIMvision 2.27.7 Setup.tmp (PID: 2900)

    • Reads Microsoft Outlook installation path

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Reads security settings of Internet Explorer

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Reads settings of System Certificates

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Checks Windows Trust Settings

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Reads Internet Explorer settings

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

  • INFO

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3972)

    • Checks supported languages

      • BIMvision 2.27.7 Setup.exe (PID: 1928)
      • BIMvision 2.27.7 Setup.tmp (PID: 3516)
      • BIMvision 2.27.7 Setup.exe (PID: 1768)
      • BIMvision 2.27.7 Setup.tmp (PID: 2900)
      • BIM_Vision.exe (PID: 2248)
      • update .NET plugin dependencies.exe (PID: 568)
      • BIM_Vision.exe (PID: 2308)
      • wmpnscfg.exe (PID: 3808)

    • Application launched itself

      • iexplore.exe (PID: 3668)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3972)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3668)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3668)

    • Reads the computer name

      • BIMvision 2.27.7 Setup.tmp (PID: 3516)
      • BIMvision 2.27.7 Setup.tmp (PID: 2900)
      • BIM_Vision.exe (PID: 2248)
      • wmpnscfg.exe (PID: 3808)
      • BIM_Vision.exe (PID: 2308)

    • Create files in a temporary directory

      • BIMvision 2.27.7 Setup.exe (PID: 1928)
      • BIMvision 2.27.7 Setup.exe (PID: 1768)
      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Creates files in the program directory

      • BIMvision 2.27.7 Setup.tmp (PID: 2900)
      • update .NET plugin dependencies.exe (PID: 568)
      • BIM_Vision.exe (PID: 2248)

    • Creates a software uninstall entry

      • BIMvision 2.27.7 Setup.tmp (PID: 2900)

    • Reads the machine GUID from the registry

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Checks proxy server information

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Reads the software policy settings

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Creates files or folders in the user directory

      • BIM_Vision.exe (PID: 2248)
      • BIM_Vision.exe (PID: 2308)

    • Manual execution by a user

      • BIM_Vision.exe (PID: 2308)
      • wmpnscfg.exe (PID: 3808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
10
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe bimvision 2.27.7 setup.exe bimvision 2.27.7 setup.tmp no specs bimvision 2.27.7 setup.exe bimvision 2.27.7 setup.tmp update .net plugin dependencies.exe no specs bim_vision.exe bim_vision.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
568"C:\Program Files\Datacomp\BIM Vision\update .NET plugin dependencies.exe"C:\Program Files\Datacomp\BIM Vision\update .NET plugin dependencies.exe—BIMvision 2.27.7 Setup.tmp
User:
admin
Company:
Datacomp Sp. z o.o.
Integrity Level:
HIGH
Description:
Update .NET plugin dependencies
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\datacomp\bim vision\update .net plugin dependencies.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
1768"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\BIMvision 2.27.7 Setup.exe" /SPAWNWND=$110196 /NOTIFYWND=$D025A C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\BIMvision 2.27.7 Setup.exe
BIMvision 2.27.7 Setup.tmp
User:
admin
Company:
Datacomp IT Sp. z o.o.
Integrity Level:
HIGH
Description:
BIMvision installer
Exit code:
0
Version:
{code:get_AppVersion
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\bimvision 2.27.7 setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1928"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\BIMvision 2.27.7 Setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\BIMvision 2.27.7 Setup.exe
iexplore.exe
User:
admin
Company:
Datacomp IT Sp. z o.o.
Integrity Level:
MEDIUM
Description:
BIMvision installer
Exit code:
0
Version:
{code:get_AppVersion
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\bimvision 2.27.7 setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2248"C:\Program Files\Datacomp\BIM Vision\bim_vision.exe"C:\Program Files\Datacomp\BIM Vision\BIM_Vision.exe
BIMvision 2.27.7 Setup.tmp
User:
admin
Company:
Datacomp IT Sp. z o.o.
Integrity Level:
MEDIUM
Description:
BIMvision - freeware IFC viewer
Exit code:
0
Version:
2.27.7.33305
Modules
Images
c:\program files\datacomp\bim vision\bim_vision.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
2308"C:\Program Files\Datacomp\BIM Vision\BIM_Vision.exe" C:\Program Files\Datacomp\BIM Vision\BIM_Vision.exe
explorer.exe
User:
admin
Company:
Datacomp IT Sp. z o.o.
Integrity Level:
MEDIUM
Description:
BIMvision - freeware IFC viewer
Exit code:
0
Version:
2.27.7.33305
Modules
Images
c:\program files\datacomp\bim vision\bim_vision.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
2900"C:\Users\admin\AppData\Local\Temp\is-NQ39D.tmp\BIMvision 2.27.7 Setup.tmp" /SL5="$180138,41089574,780800,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\BIMvision 2.27.7 Setup.exe" /SPAWNWND=$110196 /NOTIFYWND=$D025A C:\Users\admin\AppData\Local\Temp\is-NQ39D.tmp\BIMvision 2.27.7 Setup.tmp
BIMvision 2.27.7 Setup.exe
User:
admin
Company:
Datacomp IT Sp. z o.o.
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-nq39d.tmp\bimvision 2.27.7 setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3516"C:\Users\admin\AppData\Local\Temp\is-0N87G.tmp\BIMvision 2.27.7 Setup.tmp" /SL5="$D025A,41089574,780800,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\BIMvision 2.27.7 Setup.exe" C:\Users\admin\AppData\Local\Temp\is-0N87G.tmp\BIMvision 2.27.7 Setup.tmp—BIMvision 2.27.7 Setup.exe
User:
admin
Company:
Datacomp IT Sp. z o.o.
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-0n87g.tmp\bimvision 2.27.7 setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3668"C:\Program Files\Internet Explorer\iexplore.exe" "https://bimvision.eu/?smd_process_download=1&download_id=10083"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3808"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3972"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3668 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
29 528
Read events
29 199
Write events
243
Delete events
86

Modification events

(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31094039
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31094039
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
11
Suspicious files
84
Text files
89
Unknown types
17

Dropped files

PID
Process
Filename
Type
3668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:1ADDE420A24222836E9D1E2F97479FE5
SHA256:6A0EB7F3E78D7170A826623B1A1C7CA9FB62C3A8996A736DF87B48B5BBB999D5
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:D3B6CBEC346BF1819E241908CB932BC1
SHA256:E4485220DEC1267FD96715B5004544F14E2DE4AA313A3BFFAFCC8514968475E9
3972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\BIMvision%202.27.7%20Setup[1].exeexecutable
MD5:64C9B3EC63AABBC25F7664C17D4B02D2
SHA256:C77C385B746EC87A6D3D00E4419AD6F44DD4F2069F7A8B3D9C7D525E6289719F
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\04FC23A773A43B5EED263BBAF545D686_F4C70626E6C3D591CD167C9B95203B65binary
MD5:FAD7E20250510029CA79213AC4F134E0
SHA256:9CC4E0326140A986A03A19FBF5B86C637F3E55FED7026242FEDB9D994569CAFD
3668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:B4847C3050E5E738F309421F13E030C7
SHA256:1C1F40EC09590EE2F93B770706675A1657DC2556E9670D89E2288841A3CD812D
3668iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3668iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF181D8EC1DE5C5BFD.TMPbinary
MD5:C99C40109607831E54983108D92F8B06
SHA256:77B2D7CB11F5FB0C24AB5FF58537784017870352CFA8859D769828BE259C62FA
3668iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{05FD41FC-E10B-11EE-AE0A-12A9866C77DE}.datbinary
MD5:50A4E0CFD8A81945940933D467744B28
SHA256:52B4B4B4B5142B26F5A922A7BB53D0F3C516B913BFBDF64ADEC61B9BCE8F7BD2
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64697A0293662D543FD74BE71E66034Bbinary
MD5:A2D794E83BAFDA0E1E245E1EEB3739F6
SHA256:D0CD13DA3EF6C47FD5A10C8D7AA2FB00DA880481001DF658D9DB2E2900C923D9
3668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:42356DE1CFAE08BF35B3EA677CD06889
SHA256:DDCC907A01A049D7BF73724C0A90F6ED7DDBF58E2234C6F41716A5AAAF9FFAFE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
51
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3972
iexplore.exe
GET
304
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5b0325f31ae0f9b6
unknown
—
—
unknown
3972
iexplore.exe
GET
304
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1c38e09e3428bf6c
unknown
—
—
unknown
3972
iexplore.exe
GET
200
95.101.54.139:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMZM2g3fdrtRjGH%2BadZB64xxg%3D%3D
unknown
binary
503 b
unknown
3972
iexplore.exe
GET
200
2.17.22.194:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEQDQS2%2Fl3VvSIefHTPZGizFG
unknown
binary
1.54 Kb
unknown
3972
iexplore.exe
GET
200
2.17.22.194:80
http://subca.ocsp-certum.com/MFAwTjBMMEowSDAJBgUrDgMCGgUABBQcn6glOULIBQemtTWi1FD7IEbk4gQUVJndm%2F%2Fopw6jGZ1bvkJX3zD8jzICDzEdft3kkgIIu9he9yYrug%3D%3D
unknown
binary
1.55 Kb
unknown
3668
iexplore.exe
GET
304
2.22.242.113:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a973ebecfe8ccbeb
unknown
—
—
unknown
3668
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
3972
iexplore.exe
GET
200
2.17.22.154:80
http://h.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRLAbuY6AMy2ME5AnM9MlyLM4YhywQUPZG2zBF76%2BRmEazS0gfLqaSAczECEGmU4fHI1hR0%2BPBKiWYMVi8%3D
unknown
binary
1.46 Kb
unknown
3668
iexplore.exe
GET
304
2.22.242.113:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b0be6f4ad90be2e5
unknown
—
—
unknown
1080
svchost.exe
GET
200
2.16.100.177:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ae332821cb231d51
unknown
compressed
67.5 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
3972
iexplore.exe
188.210.221.85:443
bimvision.eu
Data Space Sp. z o.o.
PL
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3668
iexplore.exe
2.19.96.49:443
www.bing.com
Akamai International B.V.
DE
unknown
3972
iexplore.exe
2.19.126.137:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3972
iexplore.exe
92.123.17.153:80
x1.c.lencr.org
AKAMAI-AS
AT
unknown
3668
iexplore.exe
2.19.96.58:443
www.bing.com
Akamai International B.V.
DE
unknown
3668
iexplore.exe
2.22.242.107:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
bimvision.eu
  • 188.210.221.85
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.19.96.49
  • 2.19.96.58
  • 2.19.96.72
  • 2.19.96.35
  • 2.19.96.42
  • 2.19.96.41
  • 2.19.96.66
  • 2.19.96.67
  • 2.19.96.56
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
ctldl.windowsupdate.com
  • 2.19.126.137
  • 2.19.126.163
  • 2.22.242.107
  • 2.22.242.113
  • 2.22.242.130
  • 2.22.242.112
  • 2.22.242.123
  • 2.22.242.105
  • 2.22.242.115
  • 2.22.242.114
  • 2.22.242.131
  • 2.16.100.177
  • 88.221.110.66
  • 2.16.100.155
  • 2.16.100.138
  • 2.16.100.169
  • 2.16.100.152
  • 23.32.238.219
  • 23.32.238.203
  • 23.32.238.200
  • 23.32.238.201
  • 23.32.238.210
  • 23.32.238.217
  • 23.32.238.208
  • 23.32.238.216
  • 23.32.238.218
whitelisted
x1.c.lencr.org
  • 92.123.17.153
  • 104.76.201.34
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
store.bimvision.eu
  • 87.98.242.170
unknown
r3.o.lencr.org
  • 95.101.54.139
  • 95.101.54.216
  • 2.16.202.115
  • 95.101.54.121
  • 95.101.54.122
  • 95.101.54.137
  • 95.101.54.210
  • 95.101.54.145
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://bimvision.eu/?smd_process_download=1&download_id=10083