File name:

sh.ext.bin

Full analysis: https://app.any.run/tasks/7003b411-1574-4c9b-93f7-fda693d62971
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 15:41:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

06CD992D7E3A5334AD400EAA61C160AB

SHA1:

584A4C96687A73A4C4A04A16D1D9AA0A30AB8D5C

SHA256:

F86FB2936D6B0B2E6C84519734016EE8AE695457734194C6331F86D1962091DD

SSDEEP:

98304:Hf1Q+0MMreKeQjEwtp2QetcnxP/ky0ICwMCJWwUeFmZ4spGKXxtXn3pFUpOTkpWP:YLiPD8VJlMchS0G5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • DistriCompiler89.exe (PID: 7664)
      • DistriCompiler89.exe (PID: 7684)
      • DistriCompiler89.exe (PID: 4208)
      • VirtuServer128.exe (PID: 7012)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7352)

    • Actions looks like stealing of personal data

      • VirtuServer128.exe (PID: 7012)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • sh.ext.bin.exe (PID: 7608)
      • VirtuServer128.exe (PID: 7012)
      • MicrosoftEdgeUpdate.exe (PID: 7184)

    • Executable content was dropped or overwritten

      • sh.ext.bin.exe (PID: 7608)
      • DistriCompiler89.exe (PID: 7664)
      • DistriCompiler89.exe (PID: 7684)
      • DistriCompiler89.exe (PID: 4208)
      • VirtuServer128.exe (PID: 7012)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7172)

    • Starts itself from another location

      • DistriCompiler89.exe (PID: 7664)

    • Drops 7-zip archiver for unpacking

      • DistriCompiler89.exe (PID: 7684)

    • There is functionality for taking screenshot (YARA)

      • DistriCompiler89.exe (PID: 4208)

    • Connects to unusual port

      • VirtuServer128.exe (PID: 7012)

    • Process drops legitimate windows executable

      • VirtuServer128.exe (PID: 7012)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7172)
      • MicrosoftEdgeUpdate.exe (PID: 7184)

    • Starts process via Powershell

      • powershell.exe (PID: 6184)

    • Starts POWERSHELL.EXE for commands execution

      • VirtuServer128.exe (PID: 7012)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 7184)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 7184)

  • INFO

    • Reads the computer name

      • sh.ext.bin.exe (PID: 7608)
      • DistriCompiler89.exe (PID: 7664)
      • DistriCompiler89.exe (PID: 7684)
      • DistriCompiler89.exe (PID: 4208)
      • VirtuServer128.exe (PID: 7012)
      • 7za.exe (PID: 1280)
      • 7za.exe (PID: 7976)
      • MicrosoftEdgeUpdate.exe (PID: 7184)

    • Checks supported languages

      • sh.ext.bin.exe (PID: 7608)
      • DistriCompiler89.exe (PID: 7664)
      • DistriCompiler89.exe (PID: 7684)
      • 7za.exe (PID: 7976)
      • DistriCompiler89.exe (PID: 4208)
      • 7za.exe (PID: 1280)
      • VirtuServer128.exe (PID: 7012)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7172)
      • MicrosoftEdgeUpdate.exe (PID: 7184)

    • Process checks computer location settings

      • sh.ext.bin.exe (PID: 7608)
      • MicrosoftEdgeUpdate.exe (PID: 7184)

    • Creates files in the program directory

      • DistriCompiler89.exe (PID: 7664)
      • DistriCompiler89.exe (PID: 7684)
      • DistriCompiler89.exe (PID: 4208)
      • VirtuServer128.exe (PID: 7012)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7172)

    • The sample compiled with english language support

      • DistriCompiler89.exe (PID: 7684)
      • DistriCompiler89.exe (PID: 4208)
      • VirtuServer128.exe (PID: 7012)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7172)
      • MicrosoftEdgeUpdate.exe (PID: 7184)

    • Create files in a temporary directory

      • DistriCompiler89.exe (PID: 7684)
      • DistriCompiler89.exe (PID: 4208)

    • Reads the machine GUID from the registry

      • 7za.exe (PID: 7976)
      • VirtuServer128.exe (PID: 7012)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7352)

    • Checks transactions between databases Windows and Oracle

      • 7za.exe (PID: 7976)

    • Reads the software policy settings

      • VirtuServer128.exe (PID: 7012)
      • MicrosoftEdgeUpdate.exe (PID: 7184)
      • slui.exe (PID: 7712)
      • wermgr.exe (PID: 7600)

    • Creates files or folders in the user directory

      • VirtuServer128.exe (PID: 7012)
      • wermgr.exe (PID: 7600)

    • Checks proxy server information

      • VirtuServer128.exe (PID: 7012)
      • MicrosoftEdgeUpdate.exe (PID: 7184)
      • wermgr.exe (PID: 7600)
      • slui.exe (PID: 7712)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 7184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:06:27 07:06:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 70656
InitializedDataSize: 116736
UninitializedDataSize: -
EntryPoint: 0x11def
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.0.1795
ProductVersionNumber: 1.4.0.1795
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Oleg N. Scherbakov
FileDescription: 7z Setup SFX (x86)
FileVersion: 1.4.0.1795
InternalName: 7ZSfxMod
LegalCopyright: Copyright © 2005-2010 Oleg N. Scherbakov
OriginalFileName: 7ZSfxMod_x86.exe
PrivateBuild: June 27, 2010
ProductName: 7-Zip SFX
ProductVersion: 1.4.0.1795
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
16
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sh.ext.bin.exe districompiler89.exe districompiler89.exe 7za.exe no specs conhost.exe no specs CMSTPLUA districompiler89.exe virtuserver128.exe 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1280"C:\ProgramData\Iaclientv2\7za.exe" "C:\ProgramData\Iaclientv2\7za.exe" a -t7z "C:\Users\admin\AppData\Roaming\app.7z" C:C:\ProgramData\Iaclientv2\7za.exe—DistriCompiler89.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Modules
Images
c:\windows\system32\input.dll
c:\programdata\iaclientv2\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4208"C:\ProgramData\Iaclientv2\DistriCompiler89.exe" C:\ProgramData\Iaclientv2\DistriCompiler89.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\iaclientv2\districompiler89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
5416\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6184powershell.exe -Command "Start-Process 'C:\ProgramData\MicrosoftEdgeWebview2Setup.exe' -ArgumentList '/silent','/install' -Wait"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—VirtuServer128.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7012C:\ProgramData\VirtuServer128.exeC:\ProgramData\VirtuServer128.exe
DistriCompiler89.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe Updater Core Helper
Exit code:
0
Version:
9\,0\,0\,11
Modules
Images
c:\users\admin\appdata\local\temp\ef18e7.tmp
c:\programdata\virtuserver128.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7172"C:\ProgramData\MicrosoftEdgeWebview2Setup.exe" /silent /install C:\ProgramData\MicrosoftEdgeWebview2Setup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\programdata\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7184"C:\Program Files (x86)\Microsoft\Temp\EU9519.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EU9519.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\program files (x86)\microsoft\temp\eu9519.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
7352C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
7600"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "7184" "2044" "2004" "1932" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
9 889
Read events
9 852
Write events
35
Delete events
2

Modification events

(PID) Process:(7012) VirtuServer128.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7012) VirtuServer128.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7012) VirtuServer128.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7184) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(7184) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{816E5B0B-C5C2-449D-8FF4-0EF320124904}
Operation:writeName:PersistedPingString
Value:
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.195.25" shell_version="1.3.147.37" ismachine="1" sessionid="{6BD9B919-885B-4A50-9C45-3D97A3F4EA01}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="otherinstallcmd" requestid="{816E5B0B-C5C2-449D-8FF4-0EF320124904}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64" product_type="48" is_wip="0" is_in_lockdown_mode="0"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag="&quot;r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=&quot;"/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.185.17" nextversion="1.3.195.25" lang="" brand="" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" system_uptime_ticks="10224316124" install_time_ms="297"/></app></request>
(PID) Process:(7184) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{816E5B0B-C5C2-449D-8FF4-0EF320124904}
Operation:writeName:PersistedPingTime
Value:
133917973348439373
(PID) Process:(7184) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy
Operation:writeName:source
Value:
auto
(PID) Process:(7184) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{816E5B0B-C5C2-449D-8FF4-0EF320124904}
Operation:delete keyName:(default)
Value:
(PID) Process:(7184) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{267960ed-8416-6f2c-7d0f-c40fafc489f1}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(7184) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{267960ed-8416-6f2c-7d0f-c40fafc489f1}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
Executable files
211
Suspicious files
22
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
4208DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\EF18E7.tmp —
MD5:—
SHA256:—
7664DistriCompiler89.exeC:\ProgramData\Iaclientv2\DistriCompiler89.exeexecutable
MD5:9E90C7BA64A66D9AB4703AF006540193
SHA256:A519304C3BBA23EAE2045A85E01AAE44E6556B2F787966654B7209DB13CFA0C4
7608sh.ext.bin.exeC:\Users\admin\DistriCompiler89.exeexecutable
MD5:9E90C7BA64A66D9AB4703AF006540193
SHA256:A519304C3BBA23EAE2045A85E01AAE44E6556B2F787966654B7209DB13CFA0C4
7608sh.ext.bin.exeC:\Users\admin\balata.appbinary
MD5:B91B05B3D67760A786C8B1EFC5955BC3
SHA256:3BF2616347DA3CF6440536EE343CA7B44811E9D5F7307CFEF9BE54714AB8AF00
7664DistriCompiler89.exeC:\ProgramData\Iaclientv2\DirectGUI.dllexecutable
MD5:DBB97D5BA941838BB34FF9F98BD47B6C
SHA256:D121A42FC56B92CD0B8AEDE3C0A268BEC534293F87DA0C774CF78CA557D3E1AD
7664DistriCompiler89.exeC:\ProgramData\Iaclientv2\dx0.dllexecutable
MD5:693DFBB9B324E80B70660927CA1DEA69
SHA256:7C28D90E3484B566EE00ADAB4679A3D1C51F86F01560035D86C8F7788AC05234
7684DistriCompiler89.exeC:\ProgramData\Iaclientv2\7za.exeexecutable
MD5:874D01860E2C726CF7D18E0054E30ACA
SHA256:EC835CBAAD5C14EF5ABCD659199C2027D2C05CEE852FB82018D9D065261F304F
7684DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\EBECE8D.tmpbinary
MD5:35844FE703F6E70C902949DE80EF0F35
SHA256:D27A8DED1CFE97B923669600E1D22A89185D382071C73A1BE7E68F116952A6D2
7608sh.ext.bin.exeC:\Users\admin\DirectGUI.dllexecutable
MD5:DBB97D5BA941838BB34FF9F98BD47B6C
SHA256:D121A42FC56B92CD0B8AEDE3C0A268BEC534293F87DA0C774CF78CA557D3E1AD
7608sh.ext.bin.exeC:\Users\admin\IconX.dllexecutable
MD5:F36412FC804A3D4B2236B59195232B16
SHA256:AF51DE13B16EE6EA6E09E59C4B2B32CBBA200F4A47A558B48E879C63D1AB1164
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
30
DNS requests
23
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3176
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3176
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7012
VirtuServer128.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
—
—
whitelisted
7012
VirtuServer128.exe
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
—
—
unknown
7600
wermgr.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7600
wermgr.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3176
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.65
  • 20.190.160.130
  • 20.190.160.132
  • 40.126.32.138
  • 40.126.32.74
  • 20.190.160.2
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
data-seed-prebsc-1-s1.binance.org
  • 3.33.196.84
  • 15.197.198.189
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
7012
VirtuServer128.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sh.ext.bin