File name:

sandbox4.bat

Full analysis: https://app.any.run/tasks/d3186cdd-1a73-4163-91c6-cae339fc22d4
Verdict: Malicious activity
Threats:

The Arechclient2 malware is a sophisticated .NET-based Remote Access Trojan (RAT) that collects sensitive information, such as browser credentials, from infected computers. It employs various stealth techniques, including Base64 encoding to obscure its code and the ability to pause activities to evade automated security tools. The malware also can adjust Windows Defender settings and uses code injection to manipulate legitimate processes.

Malware Trends Tracker     >>>
Analysis date: March 13, 2025, 13:55:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arechclient2
backdoor
stealer
Indicators:
MIME: text/plain
File info: ASCII text
MD5:

A3099FC1B027C5689E10B1C58C3D1898

SHA1:

2562EC27BBFF7BF611590C7C22831DA4C83827AE

SHA256:

FB88B23368BF15C9F015270657237D32EFFFB51B450B2AF3F331085EDE86179B

SSDEEP:

3:VSJJFFnXYMz1oM3KskARWTXF83L6eP/Z2AVn:s6I1R3Ksk0iXF8GQ/ZnVn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7432)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5576)

    • Executing a file with an untrusted certificate

      • ISBEW64.exe (PID: 8048)
      • ISBEW64.exe (PID: 7916)
      • ISBEW64.exe (PID: 7512)
      • ISBEW64.exe (PID: 6800)
      • ISBEW64.exe (PID: 7956)
      • ISBEW64.exe (PID: 5668)
      • ISBEW64.exe (PID: 7320)
      • ISBEW64.exe (PID: 2908)
      • ISBEW64.exe (PID: 7328)
      • ISBEW64.exe (PID: 4724)

    • ARECHCLIENT2 has been detected (SURICATA)

      • MSBuild.exe (PID: 5740)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 5740)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 8184)
      • crashreporter.exe (PID: 1228)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 8184)
      • crashreporter.exe (PID: 1228)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 5576)

    • Application launched itself

      • powershell.exe (PID: 5576)

    • Executable content was dropped or overwritten

      • crashreporter.exe (PID: 1228)

    • Starts itself from another location

      • crashreporter.exe (PID: 1228)

    • Starts CMD.EXE for commands execution

      • crashreporter.exe (PID: 3888)

    • Connects to unusual port

      • MSBuild.exe (PID: 5740)

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 5576)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 5576)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 7432)

  • INFO

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 8184)
      • msiexec.exe (PID: 6228)

    • The sample compiled with english language support

      • msiexec.exe (PID: 6228)
      • msiexec.exe (PID: 8184)
      • crashreporter.exe (PID: 1228)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6988)
      • crashreporter.exe (PID: 1228)

    • Checks supported languages

      • ISBEW64.exe (PID: 6800)
      • ISBEW64.exe (PID: 7328)
      • MSBuild.exe (PID: 5740)

    • Reads the computer name

      • ISBEW64.exe (PID: 6800)
      • crashreporter.exe (PID: 1228)

    • Create files in a temporary directory

      • msiexec.exe (PID: 8184)
      • crashreporter.exe (PID: 3888)

    • Disables trace logs

      • MSBuild.exe (PID: 5740)
      • powershell.exe (PID: 7432)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 5740)

    • Checks proxy server information

      • MSBuild.exe (PID: 5740)
      • powershell.exe (PID: 7432)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 6988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
30
Malicious processes
3
Suspicious processes
13

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs isbew64.exe no specs crashreporter.exe crashreporter.exe no specs cmd.exe no specs conhost.exe no specs shellexperiencehost.exe no specs slui.exe #ARECHCLIENT2 msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
1228C:\Users\admin\AppData\Local\Temp\{2127C967-F38F-4B09-BC37-182F69538567}\crashreporter.exe C:\Users\admin\AppData\Local\Temp\{2127C967-F38F-4B09-BC37-182F69538567}\crashreporter.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{2127c967-f38f-4b09-bc37-182f69538567}\crashreporter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
2908C:\Users\admin\AppData\Local\Temp\{5A045F2E-28D2-463B-AEF0-C72ACA5F7E03}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7439C28-C4C8-4B3D-93B1-FC03D075C28C}C:\Users\admin\AppData\Local\Temp\{5A045F2E-28D2-463B-AEF0-C72ACA5F7E03}\ISBEW64.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\temp\{5a045f2e-28d2-463b-aef0-c72aca5f7e03}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3100C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3888C:\Users\admin\AppData\Roaming\Lm_chrome_test_v5\crashreporter.exeC:\Users\admin\AppData\Roaming\Lm_chrome_test_v5\crashreporter.exe—crashreporter.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\roaming\lm_chrome_test_v5\crashreporter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
4724C:\Users\admin\AppData\Local\Temp\{5A045F2E-28D2-463B-AEF0-C72ACA5F7E03}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2167F26D-5933-4AB4-ADBC-AF641D4D0B3C}C:\Users\admin\AppData\Local\Temp\{5A045F2E-28D2-463B-AEF0-C72ACA5F7E03}\ISBEW64.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\temp\{5a045f2e-28d2-463b-aef0-c72aca5f7e03}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5048C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe—crashreporter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5360"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5576"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\sandbox4.bat.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5668C:\Users\admin\AppData\Local\Temp\{5A045F2E-28D2-463B-AEF0-C72ACA5F7E03}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{737DC85C-24B4-4DD0-AD89-DA98C7F81D1A}C:\Users\admin\AppData\Local\Temp\{5A045F2E-28D2-463B-AEF0-C72ACA5F7E03}\ISBEW64.exe—msiexec.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\temp\{5a045f2e-28d2-463b-aef0-c72aca5f7e03}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5740C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\ccoctnvwmhhcqk
c:\windows\syswow64\mshtml.dll
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
Total events
16 740
Read events
16 708
Write events
32
Delete events
0

Modification events

(PID) Process:(8052) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8052) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8052) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6988) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6988) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6988) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5892) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5892) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5892) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7180) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
24
Suspicious files
16
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
6988BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\679ff5b3-bd7e-4fb1-8beb-3eb12d286d13.down_data —
MD5:—
SHA256:—
7432powershell.exeC:\Users\admin\AppData\Local\Temp\8ab.msi —
MD5:—
SHA256:—
5576powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_12x4fop0.2lm.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7432powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_yrscsgbs.4ap.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5576powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D1TBZ4SNXDVFOB2TYS2O.tempbinary
MD5:38522ED2D57119D7EF002FB4A1DFFC74
SHA256:8DC3A174F4335F6340B987DB4C5BCC7F549C78E9D54F762A08A9A78E1D2C11BF
7432powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2qzomixz.s3b.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6988BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:9FA7CCABC494A5328612D36DD19B8E46
SHA256:0D0B2B024CD660B45A6646F77B717CCD34A8C0D3EC4D5451D53DD436E87F531D
5576powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tg3fh1qj.ktq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5576powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:38522ED2D57119D7EF002FB4A1DFFC74
SHA256:8DC3A174F4335F6340B987DB4C5BCC7F549C78E9D54F762A08A9A78E1D2C11BF
5576powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10cb51.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
22
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1324
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6988
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5740
MSBuild.exe
GET
200
92.255.85.23:9000
http://92.255.85.23:9000/wbinjget?q=EF680CC9EFE0A8BCEC05D07897760CE8
unknown
—
—
malicious
4208
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4208
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7432
powershell.exe
172.67.143.100:443
serviceverifcaptcho.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.169
  • 23.48.23.180
  • 23.48.23.194
  • 23.48.23.137
  • 23.48.23.166
  • 23.48.23.138
  • 23.48.23.193
  • 23.48.23.176
  • 23.48.23.190
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.64
  • 40.126.31.2
  • 20.190.159.68
  • 40.126.31.128
  • 40.126.31.130
  • 40.126.31.71
  • 20.190.159.71
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
serviceverifcaptcho.com
  • 172.67.143.100
  • 104.21.79.96
unknown
tripallmaljok.com
  • 91.92.46.97
unknown
kalkgmbzfghq.com
  • 104.21.48.122
  • 172.67.151.59
unknown
arc.msn.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
5740
MSBuild.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 12
5740
MSBuild.exe
A Network Trojan was detected
ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sandbox4.bat