File name:

Exela-V2.0-main.zip

Full analysis: https://app.any.run/tasks/3ccaaf5c-76a6-4833-82cf-26af23f4877c
Verdict: Malicious activity
Analysis date: July 27, 2024, 08:47:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

1284123A329839E8C0F2DB4687AB0DE4

SHA1:

F02E5610C7038857D1BE6DFB2CA85DAEB7A90F79

SHA256:

F918A13DC2C83DF5DA9E9243A4F39420A40314C39982AF4B4D402001E0968E39

SSDEEP:

24576:+/Vo9kvYZ630mAga5KCEGmk+gZk3D2z0KBBLBqoQ7:+/C9kvYZ630mAga5KCEGmk+gZ2D2z0KW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2072)
      • python-3.12.4-amd64.exe (PID: 6940)
      • python-3.12.4-amd64.exe (PID: 4656)
      • python-3.12.4-amd64.exe (PID: 2616)
      • msiexec.exe (PID: 6624)

    • Changes the autorun value in the registry

      • python-3.12.4-amd64.exe (PID: 4656)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • python-3.12.4-amd64.exe (PID: 6940)
      • python-3.12.4-amd64.exe (PID: 4656)
      • python-3.12.4-amd64.exe (PID: 2616)

    • The process drops C-runtime libraries

      • python-3.12.4-amd64.exe (PID: 4656)
      • msiexec.exe (PID: 6624)

    • Starts itself from another location

      • python-3.12.4-amd64.exe (PID: 4656)

    • Searches for installed software

      • dllhost.exe (PID: 636)
      • python-3.12.4-amd64.exe (PID: 2616)
      • python-3.12.4-amd64.exe (PID: 4656)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6544)

    • Creates a software uninstall entry

      • python-3.12.4-amd64.exe (PID: 4656)

    • Process drops legitimate windows executable

      • python-3.12.4-amd64.exe (PID: 4656)
      • msiexec.exe (PID: 6624)

    • Reads security settings of Internet Explorer

      • python-3.12.4-amd64.exe (PID: 4656)

    • Reads the date of Windows installation

      • python-3.12.4-amd64.exe (PID: 4656)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6624)

    • Process drops python dynamic module

      • msiexec.exe (PID: 6624)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6624)

  • INFO

    • Manual execution by a user

      • notepad.exe (PID: 5864)
      • notepad.exe (PID: 4192)
      • cmd.exe (PID: 7052)
      • cmd.exe (PID: 2884)
      • firefox.exe (PID: 3980)
      • cmd.exe (PID: 2132)
      • firefox.exe (PID: 5868)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2072)
      • firefox.exe (PID: 5732)
      • msiexec.exe (PID: 6624)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 5864)
      • notepad.exe (PID: 4192)

    • Checks proxy server information

      • slui.exe (PID: 6364)

    • Reads the software policy settings

      • slui.exe (PID: 6364)
      • msiexec.exe (PID: 6624)

    • Application launched itself

      • firefox.exe (PID: 3980)
      • firefox.exe (PID: 6164)
      • firefox.exe (PID: 5868)
      • firefox.exe (PID: 5732)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 6164)
      • firefox.exe (PID: 5732)

    • Reads the computer name

      • python-3.12.4-amd64.exe (PID: 4656)
      • python-3.12.4-amd64.exe (PID: 2616)
      • msiexec.exe (PID: 6624)

    • Checks supported languages

      • python-3.12.4-amd64.exe (PID: 6940)
      • python-3.12.4-amd64.exe (PID: 4656)
      • python-3.12.4-amd64.exe (PID: 2616)
      • msiexec.exe (PID: 6624)

    • The process uses the downloaded file

      • firefox.exe (PID: 5732)

    • Create files in a temporary directory

      • python-3.12.4-amd64.exe (PID: 6940)
      • python-3.12.4-amd64.exe (PID: 4656)

    • Drops the executable file immediately after the start

      • firefox.exe (PID: 5732)

    • Creates files or folders in the user directory

      • python-3.12.4-amd64.exe (PID: 4656)
      • msiexec.exe (PID: 6624)

    • Reads the machine GUID from the registry

      • python-3.12.4-amd64.exe (PID: 4656)
      • python-3.12.4-amd64.exe (PID: 2616)
      • msiexec.exe (PID: 6624)

    • Creates files in the program directory

      • python-3.12.4-amd64.exe (PID: 2616)

    • Process checks computer location settings

      • python-3.12.4-amd64.exe (PID: 4656)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:01:25 05:28:12
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Exela-V2.0-main/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
191
Monitored processes
42
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe slui.exe notepad.exe no specs notepad.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs python-3.12.4-amd64.exe python-3.12.4-amd64.exe python-3.12.4-amd64.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2940 -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 2916 -prefsLen 29917 -prefMapSize 244343 -jsInitHandle 1424 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89ede026-a51e-4622-99d8-9cb51b9fca47} 5732 "\\.\pipe\gecko-crash-server-pipe.5732" 1e49f891150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
636C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
720"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1900 -parentBuildID 20240213221259 -prefsHandle 1836 -prefMapHandle 1816 -prefsLen 30537 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20b05512-bb7f-4bd0-9d86-907a9924685e} 6164 "\\.\pipe\gecko-crash-server-pipe.6164" 2595a0e2710 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
736"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5168 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 5500 -prefMapHandle 5472 -prefsLen 34713 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf3f6994-0adf-4f87-b0a7-7a6a581afa2d} 6164 "\\.\pipe\gecko-crash-server-pipe.6164" 25964adb710 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1000"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6848 -childID 7 -isForBrowser -prefsHandle 5948 -prefMapHandle 5332 -prefsLen 31936 -prefMapSize 244343 -jsInitHandle 1436 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89dce587-9a8d-431d-b40c-36a21188afaf} 6164 "\\.\pipe\gecko-crash-server-pipe.6164" 2595db94f50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1428"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1896 -parentBuildID 20240213221259 -prefsHandle 1836 -prefMapHandle 1816 -prefsLen 29501 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7efd250a-d766-4609-8c53-f55d3891a408} 5732 "\\.\pipe\gecko-crash-server-pipe.5732" 1e499ec8410 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2072"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Exela-V2.0-main.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2088"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4600 -childID 2 -isForBrowser -prefsHandle 4592 -prefMapHandle 4588 -prefsLen 36263 -prefMapSize 244343 -jsInitHandle 1436 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d20c4d33-b97f-4724-8e33-cd8bbee9d252} 6164 "\\.\pipe\gecko-crash-server-pipe.6164" 25961203bd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2132C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\Exela-V2.0-main\install.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
Total events
59 902
Read events
58 291
Write events
1 555
Delete events
56

Modification events

(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Exela-V2.0-main.zip
(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(2072) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
55
Suspicious files
323
Text files
757
Unknown types
5

Dropped files

PID
Process
Filename
Type
2072WinRAR.exeC:\Users\admin\Desktop\Exela-V2.0-main\Exela.pytext
MD5:53D0F2EDF910D03BF6A5B2A2806ADF02
SHA256:FF0B26B330F3BDDC1A9EBA6DAE2BC4F8609FC85592F8F3C6344F2907A7A57CF9
2072WinRAR.exeC:\Users\admin\Desktop\Exela-V2.0-main\Obfuscator\obf.pytext
MD5:BFBF108641C41832AC8584A6B85960CC
SHA256:2BA721B0F3311123399CFA098502AD53CFA4E8E0FE6CE0DE65ED2C84EA1C1101
2072WinRAR.exeC:\Users\admin\Desktop\Exela-V2.0-main\AssemblyFile\version.txttext
MD5:B13F73267D6A3E865A941BF7BB817D19
SHA256:5C7DA4BF53B1EBDA26683C75E5C03D1D062683D4F1AF10DB939BA334787136CF
6164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2072WinRAR.exeC:\Users\admin\Desktop\Exela-V2.0-main\README.mdhtml
MD5:5A9C53CAB4888A16488776DABAA8FFA0
SHA256:862C3D6DDFA842F83FC5106366C8E761EDDA554DCB6E1D8C54B7078995C49E31
2072WinRAR.exeC:\Users\admin\Desktop\Exela-V2.0-main\LICENSEtext
MD5:F57BA58CDBEB92901C54411F17778ECF
SHA256:61942D31CC5C5791BF214FBAB7DE4649FB4D15D5E058B2646D9FFBF40BFFCAC5
2072WinRAR.exeC:\Users\admin\Desktop\Exela-V2.0-main\builder.pytext
MD5:C334E5C6DBDC27F8E8B48D1DAC286F23
SHA256:27EBC271F47BD76B63B5F3AA36B7F0587F3BD543C9CA5E0E89719DF54EF82F73
6164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:7A97B8DBC4F98D175F958C00F463A52A
SHA256:92074D2ED1AA1FD621287E35DB9EF1AE3DC04777EFAE5F09E7A3B4534C201548
2072WinRAR.exeC:\Users\admin\Desktop\Exela-V2.0-main\UPX\upx.exeexecutable
MD5:39ECDF78CB357513D1FD565C5E9EDBDD
SHA256:1EA92DA93EEAF4D456114B847B9BDDFB47EF854E7C24143F290D5E3F44973E91
6164firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
67
TCP/UDP connections
188
DNS requests
216
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5836
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6164
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
6164
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
6164
firefox.exe
POST
200
184.25.51.82:80
http://r10.o.lencr.org/
unknown
—
—
unknown
6164
firefox.exe
POST
200
184.25.51.82:80
http://r10.o.lencr.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4340
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5368
SearchApp.exe
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6044
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6012
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5368
SearchApp.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
unknown
1800
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
  • 52.185.211.133
whitelisted
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 2.23.209.149
  • 2.23.209.182
  • 2.23.209.176
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.140
  • 2.23.209.133
  • 2.23.209.148
  • 2.23.209.189
  • 92.122.215.74
  • 92.122.215.65
  • 2.20.142.155
  • 92.122.215.53
  • 2.20.142.251
  • 2.20.142.4
  • 2.20.142.154
  • 92.122.215.95
  • 92.122.215.57
whitelisted
google.com
  • 142.250.185.110
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.45
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.74
  • 20.190.160.22
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Exela-V2.0-main.zip