File name:

h4.tattlererun.life

Full analysis: https://app.any.run/tasks/76f26e21-474e-4ae4-9c5b-e967d1d96e9f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 17:24:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

06CD992D7E3A5334AD400EAA61C160AB

SHA1:

584A4C96687A73A4C4A04A16D1D9AA0A30AB8D5C

SHA256:

F86FB2936D6B0B2E6C84519734016EE8AE695457734194C6331F86D1962091DD

SSDEEP:

98304:Hf1Q+0MMreKeQjEwtp2QetcnxP/ky0ICwMCJWwUeFmZ4spGKXxtXn3pFUpOTkpWP:YLiPD8VJlMchS0G5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • DistriCompiler89.exe (PID: 2284)
      • DistriCompiler89.exe (PID: 2136)
      • DistriCompiler89.exe (PID: 6964)
      • VirtuServer128.exe (PID: 632)

    • Known privilege escalation attack

      • dllhost.exe (PID: 6640)

    • Actions looks like stealing of personal data

      • VirtuServer128.exe (PID: 632)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • h4.tattlererun.life.exe (PID: 5968)
      • VirtuServer128.exe (PID: 632)
      • MicrosoftEdgeUpdate.exe (PID: 680)

    • Executable content was dropped or overwritten

      • h4.tattlererun.life.exe (PID: 5968)
      • DistriCompiler89.exe (PID: 2284)
      • DistriCompiler89.exe (PID: 2136)
      • DistriCompiler89.exe (PID: 6964)
      • VirtuServer128.exe (PID: 632)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)

    • Starts itself from another location

      • DistriCompiler89.exe (PID: 2284)

    • Drops 7-zip archiver for unpacking

      • DistriCompiler89.exe (PID: 2136)

    • SMB connection has been detected (probably for file transfer)

      • explorer.exe (PID: 5492)

    • There is functionality for taking screenshot (YARA)

      • DistriCompiler89.exe (PID: 6964)

    • Starts process via Powershell

      • powershell.exe (PID: 472)

    • Connects to unusual port

      • VirtuServer128.exe (PID: 632)

    • Starts POWERSHELL.EXE for commands execution

      • VirtuServer128.exe (PID: 632)

    • Process drops legitimate windows executable

      • VirtuServer128.exe (PID: 632)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)
      • MicrosoftEdgeUpdate.exe (PID: 680)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 680)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 680)

    • Creates file in the systems drive root

      • explorer.exe (PID: 5492)

  • INFO

    • Reads the computer name

      • h4.tattlererun.life.exe (PID: 5968)
      • DistriCompiler89.exe (PID: 2284)
      • DistriCompiler89.exe (PID: 2136)
      • 7za.exe (PID: 5640)
      • DistriCompiler89.exe (PID: 6964)
      • VirtuServer128.exe (PID: 632)
      • 7za.exe (PID: 4220)
      • MicrosoftEdgeUpdate.exe (PID: 680)

    • Checks supported languages

      • DistriCompiler89.exe (PID: 2284)
      • h4.tattlererun.life.exe (PID: 5968)
      • DistriCompiler89.exe (PID: 2136)
      • 7za.exe (PID: 5640)
      • DistriCompiler89.exe (PID: 6964)
      • VirtuServer128.exe (PID: 632)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)
      • 7za.exe (PID: 4220)
      • MicrosoftEdgeUpdate.exe (PID: 680)

    • Process checks computer location settings

      • h4.tattlererun.life.exe (PID: 5968)
      • MicrosoftEdgeUpdate.exe (PID: 680)

    • Creates files in the program directory

      • DistriCompiler89.exe (PID: 2284)
      • DistriCompiler89.exe (PID: 2136)
      • DistriCompiler89.exe (PID: 6964)
      • VirtuServer128.exe (PID: 632)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)

    • The sample compiled with english language support

      • DistriCompiler89.exe (PID: 2136)
      • DistriCompiler89.exe (PID: 6964)
      • VirtuServer128.exe (PID: 632)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1040)
      • MicrosoftEdgeUpdate.exe (PID: 680)

    • Create files in a temporary directory

      • DistriCompiler89.exe (PID: 2136)
      • DistriCompiler89.exe (PID: 6964)

    • Checks transactions between databases Windows and Oracle

      • 7za.exe (PID: 5640)

    • Reads the machine GUID from the registry

      • 7za.exe (PID: 5640)
      • VirtuServer128.exe (PID: 632)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 6640)
      • explorer.exe (PID: 5492)

    • Checks proxy server information

      • explorer.exe (PID: 5492)
      • VirtuServer128.exe (PID: 632)
      • MicrosoftEdgeUpdate.exe (PID: 680)
      • wermgr.exe (PID: 5744)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 5492)
      • VirtuServer128.exe (PID: 632)
      • wermgr.exe (PID: 5744)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2568)

    • Reads the software policy settings

      • explorer.exe (PID: 5492)
      • VirtuServer128.exe (PID: 632)
      • MicrosoftEdgeUpdate.exe (PID: 680)
      • slui.exe (PID: 4164)
      • wermgr.exe (PID: 5744)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 680)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 5492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:06:27 07:06:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 70656
InitializedDataSize: 116736
UninitializedDataSize: -
EntryPoint: 0x11def
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.0.1795
ProductVersionNumber: 1.4.0.1795
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Oleg N. Scherbakov
FileDescription: 7z Setup SFX (x86)
FileVersion: 1.4.0.1795
InternalName: 7ZSfxMod
LegalCopyright: Copyright © 2005-2010 Oleg N. Scherbakov
OriginalFileName: 7ZSfxMod_x86.exe
PrivateBuild: June 27, 2010
ProductName: 7-Zip SFX
ProductVersion: 1.4.0.1795
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
26
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start h4.tattlererun.life.exe districompiler89.exe districompiler89.exe sppextcomobj.exe no specs slui.exe 7za.exe no specs conhost.exe no specs CMSTPLUA districompiler89.exe explorer.exe winrar.exe virtuserver128.exe rundll32.exe no specs 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe slui.exe winrar.exe no specs 7za.exe no specs conhost.exe no specs 7za.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472powershell.exe -Command "Start-Process 'C:\ProgramData\MicrosoftEdgeWebview2Setup.exe' -ArgumentList '/silent','/install' -Wait"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—VirtuServer128.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
632C:\ProgramData\VirtuServer128.exeC:\ProgramData\VirtuServer128.exe
DistriCompiler89.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe Updater Core Helper
Exit code:
0
Version:
9\,0\,0\,11
Modules
Images
c:\users\admin\appdata\local\temp\edef3f8.tmp
c:\programdata\virtuserver128.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
680"C:\Program Files (x86)\Microsoft\Temp\EU84CD.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EU84CD.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\program files (x86)\microsoft\temp\eu84cd.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
896"C:\ProgramData\Iaclientv2\7za.exe" C:\ProgramData\Iaclientv2\7za.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Modules
Images
c:\programdata\iaclientv2\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1040"C:\ProgramData\MicrosoftEdgeWebview2Setup.exe" /silent /install C:\ProgramData\MicrosoftEdgeWebview2Setup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\programdata\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2136C:\ProgramData\Iaclientv2\DistriCompiler89.exeC:\ProgramData\Iaclientv2\DistriCompiler89.exe
DistriCompiler89.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\iaclientv2\districompiler89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2284"C:\Users\admin\DistriCompiler89.exe" C:\Users\admin\DistriCompiler89.exe
h4.tattlererun.life.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\districompiler89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2432C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2568"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\h4.tattlererun.life.exe" C:\Users\admin\Desktop\h4.tattlererun.life\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
45 652
Read events
45 460
Write events
175
Delete events
17

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000030310
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000030310
Operation:delete keyName:(default)
Value:
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Operation:delete keyName:(default)
Value:
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Operation:writeName:Classes
Value:
.accdb
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Operation:writeName:~reserved~
Value:
0800000000000600
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:00000000000A014C
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:00000000000A014C
Operation:delete keyName:(default)
Value:
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2568) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
215
Suspicious files
43
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
5968h4.tattlererun.life.exeC:\Users\admin\DistriCompiler89.exeexecutable
MD5:9E90C7BA64A66D9AB4703AF006540193
SHA256:A519304C3BBA23EAE2045A85E01AAE44E6556B2F787966654B7209DB13CFA0C4
5968h4.tattlererun.life.exeC:\Users\admin\dx0.dllexecutable
MD5:693DFBB9B324E80B70660927CA1DEA69
SHA256:7C28D90E3484B566EE00ADAB4679A3D1C51F86F01560035D86C8F7788AC05234
5968h4.tattlererun.life.exeC:\Users\admin\DirectGUI.dllexecutable
MD5:DBB97D5BA941838BB34FF9F98BD47B6C
SHA256:D121A42FC56B92CD0B8AEDE3C0A268BEC534293F87DA0C774CF78CA557D3E1AD
2284DistriCompiler89.exeC:\ProgramData\Iaclientv2\IconX.dllexecutable
MD5:F36412FC804A3D4B2236B59195232B16
SHA256:AF51DE13B16EE6EA6E09E59C4B2B32CBBA200F4A47A558B48E879C63D1AB1164
2284DistriCompiler89.exeC:\ProgramData\Iaclientv2\DirectGUI.dllexecutable
MD5:DBB97D5BA941838BB34FF9F98BD47B6C
SHA256:D121A42FC56B92CD0B8AEDE3C0A268BEC534293F87DA0C774CF78CA557D3E1AD
2136DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\EA8B632.tmpbinary
MD5:C5A646CD3A758C10E125DAA73DC59F24
SHA256:18BA58457B286D87CD557BFAB73C4F69AC80DEC41EC4022E1FF48EA9523A8ABC
5968h4.tattlererun.life.exeC:\Users\admin\balata.appbinary
MD5:B91B05B3D67760A786C8B1EFC5955BC3
SHA256:3BF2616347DA3CF6440536EE343CA7B44811E9D5F7307CFEF9BE54714AB8AF00
2136DistriCompiler89.exeC:\ProgramData\Iaclientv2\7za.exeexecutable
MD5:874D01860E2C726CF7D18E0054E30ACA
SHA256:EC835CBAAD5C14EF5ABCD659199C2027D2C05CEE852FB82018D9D065261F304F
6964DistriCompiler89.exeC:\Users\admin\AppData\Local\Temp\EDEF3F8.tmp —
MD5:—
SHA256:—
2284DistriCompiler89.exeC:\ProgramData\Iaclientv2\DistriCompiler89.exeexecutable
MD5:9E90C7BA64A66D9AB4703AF006540193
SHA256:A519304C3BBA23EAE2045A85E01AAE44E6556B2F787966654B7209DB13CFA0C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
37
DNS requests
30
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5492
explorer.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5492
explorer.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
1012
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5492
explorer.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAruVGuiPIrhlyXYQx0KDpA%3D
unknown
—
—
whitelisted
1012
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
632
VirtuServer128.exe
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
—
—
unknown
632
VirtuServer128.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.190:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.190
  • 23.48.23.191
  • 23.48.23.179
  • 23.48.23.185
  • 23.48.23.188
  • 23.48.23.181
  • 23.48.23.189
  • 23.48.23.183
  • 23.48.23.193
  • 2.19.11.105
  • 2.19.11.120
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 23.219.150.101
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.31.2
  • 40.126.31.130
  • 20.190.159.23
  • 40.126.31.129
  • 20.190.159.73
  • 40.126.31.73
  • 40.126.31.67
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.64
  • 40.126.31.131
  • 20.190.159.128
  • 20.190.159.131
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
data-seed-prebsc-1-s1.binance.org
  • 3.33.196.84
  • 15.197.198.189
unknown
ocsp.rootca1.amazontrust.com
  • 18.245.38.41
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
632
VirtuServer128.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
h4.tattlererun.life