File name:

0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt

Full analysis: https://app.any.run/tasks/ae048988-aaa9-40ac-832b-4965f52ed0a3
Verdict: Malicious activity
Threats:

TrickBot is an advanced banking trojan that attackers can use to steal payment credentials from the victims. It can redirect the victim to a fake banking cabinet and retrieve credentials typed in on the webpage.

Malware Trends Tracker     >>>
Analysis date: April 20, 2025, 06:50:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
trickbot
banker
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

D9FDA66B46A73A3DDEFDCE3C7EA5AE1E

SHA1:

17D9AAB1623AEDF734D6F77CEC409E3055ADAA47

SHA256:

0242EBB681EB1B3DBAA751320DEA56E31C5E52C8324A7DE125A8144CC5270698

SSDEEP:

6144:lUJ4vaWjFoGvCPOR9cbkjT4ndksMe5cM0ytJLrDtPT4n:lUJ4vtbvyscbkIksXj0sJJb4n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)
      • АахХееаВеАКе.exe (PID: 780)

    • Known privilege escalation attack

      • dllhost.exe (PID: 5588)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 4696)
      • cmd.exe (PID: 2236)

    • Changes Windows Defender settings

      • cmd.exe (PID: 4488)
      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 7000)
      • cmd.exe (PID: 2240)
      • cmd.exe (PID: 6516)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 664)
      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 6112)

    • Changes settings for real-time protection

      • powershell.exe (PID: 2040)

    • Disables Windows Defender

      • АахХееаВеАКе.exe (PID: 780)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 7212)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 7332)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 5260)

    • TRICKBOT mutex has been found

      • svchost.exe (PID: 7844)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)
      • АахХееаВеАКе.exe (PID: 780)

    • Starts itself from another location

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)

    • Executable content was dropped or overwritten

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)
      • svchost.exe (PID: 7844)

    • Starts a Microsoft application from unusual location

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)

    • Process drops legitimate windows executable

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)

    • Starts CMD.EXE for commands execution

      • АахХееаВеАКе.exe (PID: 780)

    • Stops a currently running service

      • sc.exe (PID: 1300)

    • Windows service management via SC.EXE

      • sc.exe (PID: 4112)

    • Script disables Windows Defender's behavior monitoring

      • cmd.exe (PID: 4488)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 4488)
      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 664)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 2240)
      • cmd.exe (PID: 7000)
      • cmd.exe (PID: 6516)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 6964)
      • cmd.exe (PID: 6112)

    • Script disables Windows Defender's real-time protection

      • cmd.exe (PID: 664)

    • Script disables Windows Defender's IPS

      • cmd.exe (PID: 5436)

  • INFO

    • Reads the machine GUID from the registry

      • АахХееаВеАКе.exe (PID: 4208)
      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)
      • АахХееаВеАКе.exe (PID: 780)

    • Checks supported languages

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)
      • АахХееаВеАКе.exe (PID: 4208)
      • АахХееаВеАКе.exe (PID: 780)

    • Process checks computer location settings

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)
      • АахХееаВеАКе.exe (PID: 780)

    • Reads the computer name

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)
      • АахХееаВеАКе.exe (PID: 4208)
      • АахХееаВеАКе.exe (PID: 780)

    • Creates files in the program directory

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)

    • The sample compiled with english language support

      • 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe (PID: 5680)
      • svchost.exe (PID: 7844)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 5588)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7268)
      • powershell.exe (PID: 6080)
      • powershell.exe (PID: 2040)
      • powershell.exe (PID: 7332)
      • powershell.exe (PID: 7228)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 7212)
      • powershell.exe (PID: 4464)
      • powershell.exe (PID: 7700)
      • powershell.exe (PID: 5260)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7700)
      • powershell.exe (PID: 4464)
      • powershell.exe (PID: 6080)
      • powershell.exe (PID: 7332)
      • powershell.exe (PID: 5260)
      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 2040)
      • powershell.exe (PID: 7228)
      • powershell.exe (PID: 7268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:07:12 12:43:14+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 6656
InitializedDataSize: 240640
UninitializedDataSize: -
EntryPoint: 0x2463
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 6.1.7600.16385
ProductVersionNumber: 6.1.7600.16385
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Media Foundation AAC Encoder
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
InternalName: Media Foundation AAC Encoder
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: mfAACEnc.dll
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7600.16385
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
43
Malicious processes
8
Suspicious processes
12

Behavior graph

Click at the process to see the details
start 0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exe ааххееавеаке.exe no specs sppextcomobj.exe no specs slui.exe no specs CMSTPLUA ааххееавеаке.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs #TRICKBOT svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
664"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\System32\cmd.exe—АахХееаВеАКе.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
780"C:\ProgramData\АахХееаВеАКе.exe" C:\ProgramData\АахХееаВеАКе.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Media Foundation AAC Encoder
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\programdata\ааххееавеаке.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1300sc stop WinDefendC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
5
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1912\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2040powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2236"C:\Windows\System32\cmd.exe" /c sc delete WinDefendC:\Windows\System32\cmd.exe—АахХееаВеАКе.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
5
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2240"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $trueC:\Windows\System32\cmd.exe—АахХееаВеАКе.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
55 538
Read events
55 532
Write events
6
Delete events
0

Modification events

(PID) Process:(5588) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(780) АахХееаВеАКе.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(780) АахХееаВеАКе.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableBehaviorMonitoring
Value:
1
(PID) Process:(780) АахХееаВеАКе.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableOnAccessProtection
Value:
1
(PID) Process:(780) АахХееаВеАКе.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableScanOnRealtimeEnable
Value:
1
(PID) Process:(780) АахХееаВеАКе.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableIOAVProtection
Value:
1
Executable files
2
Suspicious files
2
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
56800242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt.exeC:\ProgramData\АахХееаВеАКе.exeexecutable
MD5:D9FDA66B46A73A3DDEFDCE3C7EA5AE1E
SHA256:0242EBB681EB1B3DBAA751320DEA56E31C5E52C8324A7DE125A8144CC5270698
7228powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ztnuatw0.d3b.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4208АахХееаВеАКе.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:B65B75DE6D5CFB70010568CCFC27A89E
SHA256:0C9CED827F015BA49734A65019164B84CF9FE5BCA78402D7E9347C0DDA109768
7212powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xmixto1g.req.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6080powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_w2klavqj.rvw.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5260powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_41ebw5r0.0wf.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7268powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fehfryca.oii.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4464powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_w2vbueil.cmw.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7212powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bek4w0rv.1qp.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7228powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_q1jgi5hz.qqj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6712
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6712
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6712
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6712
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
google.com
  • 142.250.185.238
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.128
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.130
  • 20.190.159.4
  • 20.190.159.129
  • 20.190.159.131
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0242ebb681eb1b3dbaa751320dea56e31c5e52c8324a7de125a8144cc5270698.txt