File name:

sh.ext.bin

Full analysis: https://app.any.run/tasks/0fb79375-996f-421e-b1b2-9400b3b80f33
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 11:12:25
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
arch-scr
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

06CD992D7E3A5334AD400EAA61C160AB

SHA1:

584A4C96687A73A4C4A04A16D1D9AA0A30AB8D5C

SHA256:

F86FB2936D6B0B2E6C84519734016EE8AE695457734194C6331F86D1962091DD

SSDEEP:

98304:Hf1Q+0MMreKeQjEwtp2QetcnxP/ky0ICwMCJWwUeFmZ4spGKXxtXn3pFUpOTkpWP:YLiPD8VJlMchS0G5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • DistriCompiler89.exe (PID: 7448)
      • sh.ext.bin.exe (PID: 7320)
      • DistriCompiler89.exe (PID: 7508)
      • VirtuServer128.exe (PID: 2320)
      • DistriCompiler89.exe (PID: 8088)
      • DistriCompiler89.exe (PID: 6988)
      • VirtuServer128.exe (PID: 1064)

    • Known privilege escalation attack

      • dllhost.exe (PID: 8040)

    • Actions looks like stealing of personal data

      • VirtuServer128.exe (PID: 2320)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sh.ext.bin.exe (PID: 7320)
      • DistriCompiler89.exe (PID: 7448)
      • DistriCompiler89.exe (PID: 7508)
      • DistriCompiler89.exe (PID: 8088)
      • VirtuServer128.exe (PID: 2320)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1052)
      • DistriCompiler89.exe (PID: 4144)
      • VirtuServer128.exe (PID: 1064)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5004)

    • Reads security settings of Internet Explorer

      • sh.ext.bin.exe (PID: 7320)
      • VirtuServer128.exe (PID: 2320)
      • MicrosoftEdgeUpdate.exe (PID: 3180)

    • Starts itself from another location

      • DistriCompiler89.exe (PID: 7448)

    • Drops 7-zip archiver for unpacking

      • DistriCompiler89.exe (PID: 7508)
      • DistriCompiler89.exe (PID: 4144)

    • There is functionality for taking screenshot (YARA)

      • DistriCompiler89.exe (PID: 8088)

    • Connects to unusual port

      • VirtuServer128.exe (PID: 2320)
      • VirtuServer128.exe (PID: 1064)

    • Process drops legitimate windows executable

      • VirtuServer128.exe (PID: 2320)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1052)
      • MicrosoftEdgeUpdate.exe (PID: 3180)
      • VirtuServer128.exe (PID: 1064)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5004)
      • MicrosoftEdgeUpdate.exe (PID: 6020)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 3180)

    • Starts process via Powershell

      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 2328)

    • Starts POWERSHELL.EXE for commands execution

      • VirtuServer128.exe (PID: 2320)
      • VirtuServer128.exe (PID: 1064)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 3180)
      • MicrosoftEdgeUpdate.exe (PID: 6020)

  • INFO

    • Reads the computer name

      • sh.ext.bin.exe (PID: 7320)
      • 7za.exe (PID: 7872)
      • DistriCompiler89.exe (PID: 7448)
      • DistriCompiler89.exe (PID: 7508)
      • VirtuServer128.exe (PID: 2320)
      • 7za.exe (PID: 7240)
      • DistriCompiler89.exe (PID: 8088)
      • MicrosoftEdgeUpdate.exe (PID: 3180)

    • Process checks computer location settings

      • sh.ext.bin.exe (PID: 7320)
      • MicrosoftEdgeUpdate.exe (PID: 3180)

    • Checks supported languages

      • DistriCompiler89.exe (PID: 7448)
      • sh.ext.bin.exe (PID: 7320)
      • DistriCompiler89.exe (PID: 7508)
      • DistriCompiler89.exe (PID: 8088)
      • VirtuServer128.exe (PID: 2320)
      • 7za.exe (PID: 7240)
      • 7za.exe (PID: 7872)
      • MicrosoftEdgeUpdate.exe (PID: 3180)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1052)
      • DistriCompiler89.exe (PID: 4144)

    • Creates files in the program directory

      • DistriCompiler89.exe (PID: 7448)
      • DistriCompiler89.exe (PID: 7508)
      • DistriCompiler89.exe (PID: 8088)
      • VirtuServer128.exe (PID: 2320)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1052)

    • The sample compiled with english language support

      • DistriCompiler89.exe (PID: 7508)
      • DistriCompiler89.exe (PID: 8088)
      • VirtuServer128.exe (PID: 2320)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1052)
      • MicrosoftEdgeUpdate.exe (PID: 3180)
      • DistriCompiler89.exe (PID: 4144)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5004)
      • MicrosoftEdgeUpdate.exe (PID: 6020)
      • VirtuServer128.exe (PID: 1064)

    • Create files in a temporary directory

      • DistriCompiler89.exe (PID: 7508)
      • DistriCompiler89.exe (PID: 8088)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 8040)

    • Reads the machine GUID from the registry

      • 7za.exe (PID: 7872)
      • VirtuServer128.exe (PID: 2320)

    • Checks transactions between databases Windows and Oracle

      • 7za.exe (PID: 7872)

    • Creates files or folders in the user directory

      • VirtuServer128.exe (PID: 2320)
      • wermgr.exe (PID: 2692)

    • Checks proxy server information

      • VirtuServer128.exe (PID: 2320)
      • MicrosoftEdgeUpdate.exe (PID: 3180)
      • wermgr.exe (PID: 2692)

    • Reads the software policy settings

      • VirtuServer128.exe (PID: 2320)
      • MicrosoftEdgeUpdate.exe (PID: 3180)
      • slui.exe (PID: 7404)
      • wermgr.exe (PID: 2692)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 3180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:06:27 07:06:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 70656
InitializedDataSize: 116736
UninitializedDataSize: -
EntryPoint: 0x11def
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.0.1795
ProductVersionNumber: 1.4.0.1795
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Oleg N. Scherbakov
FileDescription: 7z Setup SFX (x86)
FileVersion: 1.4.0.1795
InternalName: 7ZSfxMod
LegalCopyright: Copyright © 2005-2010 Oleg N. Scherbakov
OriginalFileName: 7ZSfxMod_x86.exe
PrivateBuild: June 27, 2010
ProductName: 7-Zip SFX
ProductVersion: 1.4.0.1795
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
303
Monitored processes
30
Malicious processes
12
Suspicious processes
1

Behavior graph

Click at the process to see the details
start sh.ext.bin.exe sppextcomobj.exe no specs slui.exe districompiler89.exe districompiler89.exe 7za.exe no specs conhost.exe no specs CMSTPLUA districompiler89.exe virtuserver128.exe 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe slui.exe no specs districompiler89.exe no specs 7za.exe no specs conhost.exe no specs districompiler89.exe no specs virtuserver128.exe 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
768"C:\ProgramData\Iaclientv2\7za.exe" "C:\ProgramData\Iaclientv2\7za.exe" a -t7z "C:\Users\admin\AppData\Roaming\app.7z" C:C:\ProgramData\Iaclientv2\7za.exe—DistriCompiler89.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Modules
Images
c:\windows\system32\input.dll
c:\programdata\iaclientv2\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\ProgramData\MicrosoftEdgeWebview2Setup.exe" /silent /install C:\ProgramData\MicrosoftEdgeWebview2Setup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\programdata\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1064C:\ProgramData\VirtuServer128.exeC:\ProgramData\VirtuServer128.exe
DistriCompiler89.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe Updater Core Helper
Version:
9\,0\,0\,11
Modules
Images
c:\users\admin\appdata\local\temp\aaec302.tmp
c:\programdata\virtuserver128.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
2320C:\ProgramData\VirtuServer128.exeC:\ProgramData\VirtuServer128.exe
DistriCompiler89.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe Updater Core Helper
Exit code:
0
Version:
9\,0\,0\,11
Modules
Images
c:\users\admin\appdata\local\temp\ef5e56.tmp
c:\programdata\virtuserver128.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2328powershell.exe -Command "Start-Process 'C:\ProgramData\MicrosoftEdgeWebview2Setup.exe' -ArgumentList '/silent','/install' -Wait"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—VirtuServer128.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
2692"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "3180" "2040" "1764" "2044" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3180"C:\Program Files (x86)\Microsoft\Temp\EUA361.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EUA361.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\program files (x86)\microsoft\temp\eua361.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
3752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4144"C:\ProgramData\Iaclientv2\DistriCompiler89.exe"C:\ProgramData\Iaclientv2\DistriCompiler89.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\syswow64\winmm.dll
c:\programdata\iaclientv2\dx0.dll
c:\programdata\iaclientv2\iconx.dll
c:\windows\syswow64\version.dll
c:\windows\syswow64\wininet.dll
c:\windows\syswow64\imm32.dll
c:\windows\syswow64\input.dll
c:\windows\syswow64\userenv.dll
c:\windows\syswow64\ntdll.dll
c:\windows\syswow64\d3d9.dll
Total events
18 289
Read events
18 194
Write events
90
Delete events
5

Modification events

(PID) Process:(2320) VirtuServer128.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2320) VirtuServer128.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2320) VirtuServer128.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3180) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(3180) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy
Operation:writeName:source
Value:
auto
(PID) Process:(3180) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{C4D97617-5A39-428B-B454-C3C3766531D5}
Operation:delete keyName:(default)
Value:
(PID) Process:(3180) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{1384b9e2-242e-ed35-29c0-05469d61b656}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(3180) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{1384b9e2-242e-ed35-29c0-05469d61b656}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(2692) wermgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
DEC0296800000000
(PID) Process:(2692) wermgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
C1AD110000000000
Executable files
316
Suspicious files
133
Text files
164
Unknown types
4

Dropped files

PID
Process
Filename
Type
8088DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\EF5E56.tmp —
MD5:—
SHA256:—
2320VirtuServer128.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FAbinary
MD5:7F90353C6E99087A48515BD8AE6E0CFD
SHA256:5B8024586C45C90A7B405F2555BCFBF0F7BE6E41A610935DC84CFA2A7AB8C4BB
2320VirtuServer128.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_E3BCE1D686FE24B9CEE4139A6CF71A98binary
MD5:701D95C740D9E40FB29692FCAC742F29
SHA256:AFBB60D2D98A73C788E60123E1C0A96D77F5CC61FE7680F47DB3F01139641EAE
2320VirtuServer128.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_E3BCE1D686FE24B9CEE4139A6CF71A98binary
MD5:59EC60970848B1C6EAC4DEC391E9776C
SHA256:8E70C0C4EAF83CEF1019E18E4AE0751CD8562C08D1ECAAFCE21ECD9F83B7E45D
7320sh.ext.bin.exeC:\Users\admin\DirectGUI.dllexecutable
MD5:DBB97D5BA941838BB34FF9F98BD47B6C
SHA256:D121A42FC56B92CD0B8AEDE3C0A268BEC534293F87DA0C774CF78CA557D3E1AD
2320VirtuServer128.exeC:\Users\admin\AppData\Roaming\AppState.jsonbinary
MD5:0C5756ACC918A8FD1B4ECC46B32E9F7F
SHA256:D22E33D806B0CDA914A89C2AB57BD0166E4BAC7E70896F5B5782E63881E09063
7508DistriCompiler89.exeC:\ProgramData\Iaclientv2\7za.exeexecutable
MD5:874D01860E2C726CF7D18E0054E30ACA
SHA256:EC835CBAAD5C14EF5ABCD659199C2027D2C05CEE852FB82018D9D065261F304F
7448DistriCompiler89.exeC:\ProgramData\Iaclientv2\IconX.dllexecutable
MD5:F36412FC804A3D4B2236B59195232B16
SHA256:AF51DE13B16EE6EA6E09E59C4B2B32CBBA200F4A47A558B48E879C63D1AB1164
7448DistriCompiler89.exeC:\ProgramData\Iaclientv2\balata.appbinary
MD5:B91B05B3D67760A786C8B1EFC5955BC3
SHA256:3BF2616347DA3CF6440536EE343CA7B44811E9D5F7307CFEF9BE54714AB8AF00
7508DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\EB9C8EF.tmpbinary
MD5:5AC03F8D20A9B2400C45C3A11F85DF52
SHA256:3303192A3C491411FDE73640373A9D59A57AFD0D3D5268DD8641E52DCCF193BD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
84
DNS requests
45
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6148
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2320
VirtuServer128.exe
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
—
—
unknown
2320
VirtuServer128.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
—
—
whitelisted
6148
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2692
wermgr.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.10:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.10
  • 23.216.77.41
  • 23.216.77.5
  • 23.216.77.39
  • 23.216.77.9
  • 23.216.77.43
  • 23.216.77.38
  • 23.216.77.6
  • 23.216.77.11
  • 23.216.77.28
  • 23.216.77.21
  • 23.216.77.36
  • 23.216.77.22
  • 23.216.77.32
  • 23.216.77.19
  • 23.216.77.26
  • 23.216.77.31
  • 23.216.77.29
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.131
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.130
  • 40.126.31.128
  • 20.190.159.64
  • 40.126.31.69
  • 40.126.31.2
  • 20.190.160.5
  • 40.126.32.72
  • 20.190.160.128
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.133
  • 40.126.32.76
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
data-seed-prebsc-1-s1.binance.org
  • 15.197.198.189
  • 3.33.196.84
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
2320
VirtuServer128.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
2176
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
1064
VirtuServer128.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sh.ext.bin