File name:

sh.ext.bin

Full analysis: https://app.any.run/tasks/10203db1-4fce-4616-aded-b088da81a591
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 10:48:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

06CD992D7E3A5334AD400EAA61C160AB

SHA1:

584A4C96687A73A4C4A04A16D1D9AA0A30AB8D5C

SHA256:

F86FB2936D6B0B2E6C84519734016EE8AE695457734194C6331F86D1962091DD

SSDEEP:

98304:Hf1Q+0MMreKeQjEwtp2QetcnxP/ky0ICwMCJWwUeFmZ4spGKXxtXn3pFUpOTkpWP:YLiPD8VJlMchS0G5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • sh.ext.bin.exe (PID: 4428)
      • DistriCompiler89.exe (PID: 4880)
      • DistriCompiler89.exe (PID: 5308)
      • DistriCompiler89.exe (PID: 900)
      • VirtuServer128.exe (PID: 2268)

    • Known privilege escalation attack

      • dllhost.exe (PID: 1676)

    • Actions looks like stealing of personal data

      • VirtuServer128.exe (PID: 2268)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • sh.ext.bin.exe (PID: 4428)
      • VirtuServer128.exe (PID: 2268)
      • MicrosoftEdgeUpdate.exe (PID: 3896)

    • Executable content was dropped or overwritten

      • sh.ext.bin.exe (PID: 4428)
      • DistriCompiler89.exe (PID: 4880)
      • DistriCompiler89.exe (PID: 5308)
      • DistriCompiler89.exe (PID: 900)
      • VirtuServer128.exe (PID: 2268)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5328)

    • Starts itself from another location

      • DistriCompiler89.exe (PID: 4880)

    • Drops 7-zip archiver for unpacking

      • DistriCompiler89.exe (PID: 5308)

    • Process drops legitimate windows executable

      • VirtuServer128.exe (PID: 2268)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5328)
      • MicrosoftEdgeUpdate.exe (PID: 3896)

    • Starts process via Powershell

      • powershell.exe (PID: 2656)

    • Starts POWERSHELL.EXE for commands execution

      • VirtuServer128.exe (PID: 2268)

    • There is functionality for taking screenshot (YARA)

      • DistriCompiler89.exe (PID: 900)

    • Connects to unusual port

      • VirtuServer128.exe (PID: 2268)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 3896)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 3896)

  • INFO

    • Reads the computer name

      • sh.ext.bin.exe (PID: 4428)
      • DistriCompiler89.exe (PID: 4880)
      • DistriCompiler89.exe (PID: 5308)
      • 7za.exe (PID: 6032)
      • DistriCompiler89.exe (PID: 900)
      • VirtuServer128.exe (PID: 2268)
      • 7za.exe (PID: 1096)
      • MicrosoftEdgeUpdate.exe (PID: 3896)

    • Checks supported languages

      • sh.ext.bin.exe (PID: 4428)
      • DistriCompiler89.exe (PID: 4880)
      • DistriCompiler89.exe (PID: 5308)
      • DistriCompiler89.exe (PID: 900)
      • VirtuServer128.exe (PID: 2268)
      • 7za.exe (PID: 6032)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5328)
      • 7za.exe (PID: 1096)
      • MicrosoftEdgeUpdate.exe (PID: 3896)

    • Process checks computer location settings

      • sh.ext.bin.exe (PID: 4428)
      • MicrosoftEdgeUpdate.exe (PID: 3896)

    • Creates files in the program directory

      • DistriCompiler89.exe (PID: 4880)
      • DistriCompiler89.exe (PID: 5308)
      • DistriCompiler89.exe (PID: 900)
      • VirtuServer128.exe (PID: 2268)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5328)

    • The sample compiled with english language support

      • DistriCompiler89.exe (PID: 5308)
      • DistriCompiler89.exe (PID: 900)
      • VirtuServer128.exe (PID: 2268)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5328)
      • MicrosoftEdgeUpdate.exe (PID: 3896)

    • Create files in a temporary directory

      • DistriCompiler89.exe (PID: 5308)
      • DistriCompiler89.exe (PID: 900)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 1676)

    • Checks transactions between databases Windows and Oracle

      • 7za.exe (PID: 6032)

    • Reads the machine GUID from the registry

      • 7za.exe (PID: 6032)
      • VirtuServer128.exe (PID: 2268)

    • Reads the software policy settings

      • VirtuServer128.exe (PID: 2268)
      • slui.exe (PID: 4488)
      • wermgr.exe (PID: 7156)
      • MicrosoftEdgeUpdate.exe (PID: 3896)
      • slui.exe (PID: 632)

    • Creates files or folders in the user directory

      • VirtuServer128.exe (PID: 2268)
      • wermgr.exe (PID: 7156)

    • Checks proxy server information

      • VirtuServer128.exe (PID: 2268)
      • MicrosoftEdgeUpdate.exe (PID: 3896)
      • wermgr.exe (PID: 7156)
      • slui.exe (PID: 632)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 3896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:06:27 07:06:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 70656
InitializedDataSize: 116736
UninitializedDataSize: -
EntryPoint: 0x11def
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.0.1795
ProductVersionNumber: 1.4.0.1795
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Oleg N. Scherbakov
FileDescription: 7z Setup SFX (x86)
FileVersion: 1.4.0.1795
InternalName: 7ZSfxMod
LegalCopyright: Copyright © 2005-2010 Oleg N. Scherbakov
OriginalFileName: 7ZSfxMod_x86.exe
PrivateBuild: June 27, 2010
ProductName: 7-Zip SFX
ProductVersion: 1.4.0.1795
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
18
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sh.ext.bin.exe districompiler89.exe districompiler89.exe sppextcomobj.exe no specs slui.exe 7za.exe no specs conhost.exe no specs CMSTPLUA districompiler89.exe virtuserver128.exe 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
632C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
900"C:\ProgramData\Iaclientv2\DistriCompiler89.exe" C:\ProgramData\Iaclientv2\DistriCompiler89.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\iaclientv2\districompiler89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
1096"C:\ProgramData\Iaclientv2\7za.exe" "C:\ProgramData\Iaclientv2\7za.exe" a -t7z "C:\Users\admin\AppData\Roaming\app.7z" C:C:\ProgramData\Iaclientv2\7za.exe—DistriCompiler89.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Modules
Images
c:\windows\system32\input.dll
c:\programdata\iaclientv2\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1676C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2268C:\ProgramData\VirtuServer128.exeC:\ProgramData\VirtuServer128.exe
DistriCompiler89.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe Updater Core Helper
Exit code:
0
Version:
9\,0\,0\,11
Modules
Images
c:\users\admin\appdata\local\temp\eea194.tmp
c:\programdata\virtuserver128.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2656powershell.exe -Command "Start-Process 'C:\ProgramData\MicrosoftEdgeWebview2Setup.exe' -ArgumentList '/silent','/install' -Wait"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—VirtuServer128.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3896"C:\Program Files (x86)\Microsoft\Temp\EU9613.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EU9613.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\program files (x86)\microsoft\temp\eu9613.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
4164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4428"C:\Users\admin\Desktop\sh.ext.bin.exe" C:\Users\admin\Desktop\sh.ext.bin.exe
explorer.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
MEDIUM
Description:
7z Setup SFX (x86)
Exit code:
0
Version:
1.4.0.1795
Modules
Images
c:\users\admin\desktop\sh.ext.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
10 359
Read events
10 322
Write events
35
Delete events
2

Modification events

(PID) Process:(2268) VirtuServer128.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2268) VirtuServer128.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2268) VirtuServer128.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3896) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(3896) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy
Operation:writeName:source
Value:
auto
(PID) Process:(3896) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{B2A37BF0-F1ED-47E2-9763-DFC5B154F4B9}
Operation:delete keyName:(default)
Value:
(PID) Process:(3896) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{B2A37BF0-F1ED-47E2-9763-DFC5B154F4B9}
Operation:writeName:PersistedPingString
Value:
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.195.25" shell_version="1.3.147.37" ismachine="1" sessionid="{9F4F4F1F-14AF-4E42-8814-8B4E3E3D67D4}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="otherinstallcmd" requestid="{B2A37BF0-F1ED-47E2-9763-DFC5B154F4B9}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64" product_type="48" is_wip="0" is_in_lockdown_mode="0"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag="&quot;r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=&quot;"/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.185.17" nextversion="1.3.195.25" lang="" brand="" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" system_uptime_ticks="10222898102" install_time_ms="359"/></app></request>
(PID) Process:(3896) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{B2A37BF0-F1ED-47E2-9763-DFC5B154F4B9}
Operation:writeName:PersistedPingTime
Value:
133920389889402784
(PID) Process:(3896) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{1c01ae34-0721-8a8d-03d1-a85c4f1c921b}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(3896) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{1c01ae34-0721-8a8d-03d1-a85c4f1c921b}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
Executable files
211
Suspicious files
22
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
900DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\EEA194.tmp —
MD5:—
SHA256:—
4428sh.ext.bin.exeC:\Users\admin\balata.appbinary
MD5:B91B05B3D67760A786C8B1EFC5955BC3
SHA256:3BF2616347DA3CF6440536EE343CA7B44811E9D5F7307CFEF9BE54714AB8AF00
2268VirtuServer128.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FAbinary
MD5:D488C367B91FED903FBF66FC3B20EF75
SHA256:4872ACBC331AF27803D7457B101BBA55B5E8507FC6F9418BF57E9755753795C4
4880DistriCompiler89.exeC:\ProgramData\Iaclientv2\balata.appbinary
MD5:B91B05B3D67760A786C8B1EFC5955BC3
SHA256:3BF2616347DA3CF6440536EE343CA7B44811E9D5F7307CFEF9BE54714AB8AF00
4428sh.ext.bin.exeC:\Users\admin\dx0.dllexecutable
MD5:693DFBB9B324E80B70660927CA1DEA69
SHA256:7C28D90E3484B566EE00ADAB4679A3D1C51F86F01560035D86C8F7788AC05234
2268VirtuServer128.exeC:\Users\admin\AppData\Roaming\AppState.jsonbinary
MD5:0C5756ACC918A8FD1B4ECC46B32E9F7F
SHA256:D22E33D806B0CDA914A89C2AB57BD0166E4BAC7E70896F5B5782E63881E09063
900DistriCompiler89.exeC:\ProgramData\VirtuServer128.exeexecutable
MD5:CAFB91BC6E31C95C284291A91EDB2092
SHA256:6BB6F8C92E6F5B1EDE9A1DE29730D7CE9338DB95AEB6CAF4E8782DDC086A0297
5308DistriCompiler89.exeC:\ProgramData\Iaclientv2\7za.exeexecutable
MD5:874D01860E2C726CF7D18E0054E30ACA
SHA256:EC835CBAAD5C14EF5ABCD659199C2027D2C05CEE852FB82018D9D065261F304F
4880DistriCompiler89.exeC:\ProgramData\Iaclientv2\IconX.dllexecutable
MD5:F36412FC804A3D4B2236B59195232B16
SHA256:AF51DE13B16EE6EA6E09E59C4B2B32CBBA200F4A47A558B48E879C63D1AB1164
5308DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\EABB8A3.tmpbinary
MD5:C46894DE86DEBF48464FB0B02A2570A7
SHA256:39F4360CFE7FCF08B4CFA867D872C50B76BDC5F3F4D294EFC6BBDD07608A3AB6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
32
DNS requests
24
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5024
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5024
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2268
VirtuServer128.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
—
—
whitelisted
2268
VirtuServer128.exe
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
—
—
unknown
7156
wermgr.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
  • 23.216.77.30
  • 23.216.77.22
  • 23.216.77.28
  • 23.216.77.26
  • 23.216.77.18
  • 23.216.77.29
  • 23.216.77.20
  • 23.216.77.16
  • 23.216.77.21
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.131
  • 20.190.159.2
  • 20.190.159.68
  • 20.190.159.128
  • 40.126.31.129
  • 20.190.159.73
  • 40.126.31.2
  • 20.190.160.3
  • 40.126.32.72
  • 20.190.160.128
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.2
  • 20.190.160.132
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
data-seed-prebsc-1-s1.binance.org
  • 3.33.196.84
  • 15.197.198.189
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
2268
VirtuServer128.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sh.ext.bin