File name:

Underware.exe

Full analysis: https://app.any.run/tasks/02abdcd0-c538-4b6c-90dc-68f00b60242a
Verdict: Malicious activity
Analysis date: January 30, 2026, 23:57:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
auto-reg
auto-startup
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

533B899EFB97EA137CDCD54981B0BEF8

SHA1:

6A4C235BD6679DD62C9059DD7148ECAEAB497F17

SHA256:

0614F7DBEF0DA1EA74A00283446C20E64318B75C114BBCA8F65BD2F6B1DF0CD6

SSDEEP:

6144:yi/5EIg4NFp0tkbDMXO4Qd7sROBki1nfwqt+BLEZIk77AE8ISUEm92oBF8OPvFYL:ZCIg4xGOBk6fTTIk7gjUEm92EF6qW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Changes Windows Defender settings

      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1876)
      • powershell.exe (PID: 2092)
      • powershell.exe (PID: 6084)
      • powershell.exe (PID: 1424)
      • powershell.exe (PID: 5164)
      • powershell.exe (PID: 4140)

    • Changes powershell execution policy (Bypass)

      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Adds process to the Windows Defender exclusion list

      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Uses Task Scheduler to run other applications

      • AggregatorHost.exe (PID: 1856)

    • Changes the autorun value in the registry

      • AggregatorHost.exe (PID: 1856)

    • Create files in the Startup directory

      • AggregatorHost.exe (PID: 1856)

    • Known privilege escalation attack

      • dllhost.exe (PID: 824)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • Underware.exe (PID: 7672)
      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 6400)
      • mshta.exe (PID: 5440)

    • Uses TASKKILL.EXE to kill process

      • mshta.exe (PID: 6400)

    • Probably UAC bypass using CMSTP.exe (Connection Manager service profile)

      • Underware.exe (PID: 7672)

    • Used cmstp for execute code hidden within an inf file

      • Underware.exe (PID: 7672)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 5440)

    • Starts POWERSHELL.EXE for commands execution

      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Script adds exclusion path to Windows Defender

      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Script adds exclusion process to Windows Defender

      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Executable content was dropped or overwritten

      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • The process creates files with name similar to system file names

      • Underware.exe (PID: 476)

    • The process executes via Task Scheduler

      • AggregatorHost.exe (PID: 1856)
      • SySinfocap.exe (PID: 8708)

    • Checks for external IP

      • svchost.exe (PID: 2292)
      • AggregatorHost.exe (PID: 1856)

    • Executes as Windows Service

      • VSSVC.exe (PID: 8904)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2292)

  • INFO

    • Reads the machine GUID from the registry

      • Underware.exe (PID: 7672)
      • AggregatorHost.exe (PID: 1856)

    • Reads security settings of Internet Explorer

      • Underware.exe (PID: 7672)
      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Checks supported languages

      • Underware.exe (PID: 7672)
      • AggregatorHost.exe (PID: 1856)
      • Underware.exe (PID: 476)
      • SySinfocap.exe (PID: 8672)
      • SySinfocap.exe (PID: 8708)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6400)
      • mshta.exe (PID: 5440)

    • Process checks computer location settings

      • Underware.exe (PID: 7672)
      • Underware.exe (PID: 476)
      • AggregatorHost.exe (PID: 1856)

    • Reads the computer name

      • Underware.exe (PID: 7672)
      • AggregatorHost.exe (PID: 1856)
      • SySinfocap.exe (PID: 8672)
      • SySinfocap.exe (PID: 8708)
      • Underware.exe (PID: 476)

    • Disables trace logs

      • cmstp.exe (PID: 1368)
      • AggregatorHost.exe (PID: 1856)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1876)
      • powershell.exe (PID: 2092)
      • powershell.exe (PID: 5164)
      • powershell.exe (PID: 1424)
      • powershell.exe (PID: 6084)
      • powershell.exe (PID: 4140)

    • Drops script file

      • powershell.exe (PID: 1876)
      • powershell.exe (PID: 2092)
      • powershell.exe (PID: 6084)
      • powershell.exe (PID: 5164)
      • powershell.exe (PID: 1424)
      • powershell.exe (PID: 4140)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1876)
      • powershell.exe (PID: 2092)
      • powershell.exe (PID: 6084)
      • powershell.exe (PID: 5164)
      • powershell.exe (PID: 1424)
      • powershell.exe (PID: 4140)

    • Creates files in the program directory

      • dllhost.exe (PID: 824)

    • Reads Environment values

      • AggregatorHost.exe (PID: 1856)

    • Checks proxy server information

      • AggregatorHost.exe (PID: 1856)
      • slui.exe (PID: 4280)

    • Launching a file from a Registry key

      • AggregatorHost.exe (PID: 1856)

    • Creates files or folders in the user directory

      • AggregatorHost.exe (PID: 1856)

    • Checks transactions between databases Windows and Oracle

      • cmstp.exe (PID: 1368)

    • Launching a file from the Startup directory

      • AggregatorHost.exe (PID: 1856)

    • Manual execution by a user

      • SySinfocap.exe (PID: 8672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2026:01:30 23:55:54+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 484864
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x7850e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: Underware.exe
LegalCopyright:
OriginalFileName: Underware.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
31
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start underware.exe no specs cmstp.exe no specs CMSTPLUA mshta.exe no specs cmd.exe no specs conhost.exe no specs underware.exe mshta.exe no specs taskkill.exe no specs conhost.exe no specs SPPSurrogate no specs vssvc.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs aggregatorhost.exe svchost.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs sysinfocap.exe no specs slui.exe sysinfocap.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
476"C:\Users\admin\Desktop\Underware.exe" C:\Users\admin\Desktop\Underware.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\underware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
824C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1368"C:\WINDOWS\system32\cmstp.exe" /au C:\WINDOWS\temp\neq04z3e.infC:\Windows\System32\cmstp.exe—Underware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile Installer
Exit code:
1
Version:
7.2.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmstp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1424"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\admin\SySinfocap.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—AggregatorHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1856"C:\WINDOWS\AggregatorHost.exe"C:\Windows\AggregatorHost.exe
svchost.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
1.0.0.0
Modules
Images
c:\windows\aggregatorhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1876"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\WINDOWS\AggregatorHost.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Underware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2092"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AggregatorHost.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Underware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\atl.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\user32.dll
c:\windows\system32\ucrtbase.dll
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2312\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
49 593
Read events
49 529
Write events
64
Delete events
0

Modification events

(PID) Process:(1368) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1368) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1368) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1368) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1368) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1368) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1368) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1368) cmstp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Network Connections
Operation:writeName:DesktopShortcut
Value:
0
(PID) Process:(5440) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5440) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
3
Suspicious files
2
Text files
24
Unknown types
0

Dropped files

PID
Process
Filename
Type
2092powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_epfsctp3.ovf.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1876powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ahfhxpgg.tgc.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1876powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e0bwcg35.2ex.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1876powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:E0782DE94B61C72B3EE3447CBDF846E7
SHA256:A1D79E26DE165BFD2966071E3BA6C5FD5E0911FC48ACD51E8B9D22AAB7CB6B39
7672Underware.exeC:\Windows\Temp\neq04z3e.inftext
MD5:356FD40431C972DD2F2FFDAAEFF0F16C
SHA256:FCE684EF93AE99FA068FC3F72613D9FCB6C986C37709C3DCAB5DE1A8D6754932
476Underware.exeC:\Windows\AggregatorHost.exeexecutable
MD5:533B899EFB97EA137CDCD54981B0BEF8
SHA256:0614F7DBEF0DA1EA74A00283446C20E64318B75C114BBCA8F65BD2F6B1DF0CD6
2092powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_gu3200sf.aoe.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2092powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_snbigm5z.k4o.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1876powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hoypkajb.lbg.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5164powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1ta1fpuv.vix.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
27
DNS requests
12
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7244
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7208
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1856
AggregatorHost.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
unknown
—
—
POST
204
92.123.104.49:443
https://www.bing.com/threshold/xls.aspx?t=5&dl=1&wsbc=1
unknown
—
—
unknown
5568
SearchApp.exe
POST
204
2.16.241.201:443
https://www.bing.com/threshold/xls.aspx?t=5&dl=1&wsbc=1
unknown
—
—
whitelisted
8276
slui.exe
POST
500
128.24.231.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
unknown
3292
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
3292
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
7244
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7208
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7244
svchost.exe
23.216.77.28:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7208
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7244
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
self.events.data.microsoft.com
  • 52.182.143.211
  • 20.189.173.10
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
www.bing.com
  • 2.16.241.201
  • 2.16.241.218
whitelisted
Jari25u777-33269.portmap.host
  • 193.161.193.99
unknown
activation-v2.sls.microsoft.com
  • 128.24.231.64
  • 48.192.1.64
whitelisted
www.microsoft.com
  • 23.52.181.212
whitelisted

Threats

PID
Process
Class
Message
2292
svchost.exe
Misc activity
INFO [ANY.RUN] External IP Check (ip-api .com)
2292
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
1856
AggregatorHost.exe
A Network Trojan was detected
ET MALWARE Common Stealer Behavior - Source IP Associated with Hosting Provider Check via ip.api .com
1856
AggregatorHost.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2292
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
2292
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Underware.exe