File name:

07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample

Full analysis: https://app.any.run/tasks/eab8c32e-48a0-4333-a962-6e4dced301b8
Verdict: Malicious activity
Analysis date: April 17, 2026, 18:35:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
anti-evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

EB89F018E6C3A8E9DE0A0452ACB16E76

SHA1:

7CDCB8F372CEB7F5D3C178D9649080106A932F9E

SHA256:

07C3BBE60D47240DF7152F72BEB98EA373D9600946860BAD12F7BC617A5D6F5F

SSDEEP:

3072:0hvbKoqVruzxoQBx9bglXFPc/oG8gSTf5gSiaQ:uOoKrOJx9bgh9c/ozJTR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)
      • svchost.exe (PID: 2304)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7664)
      • svchost.exe (PID: 5444)

    • Starts process via Powershell

      • powershell.exe (PID: 1296)
      • powershell.exe (PID: 5876)

    • The process checks if it is being run in the virtual environment

      • powershell.exe (PID: 1296)

    • The process creates files with name similar to system file names

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)

    • Executable content was dropped or overwritten

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 4300)
      • cmd.exe (PID: 1296)

    • Executing commands from a ".bat" file

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)
      • svchost.exe (PID: 2304)

    • The process executes files with name similar to system file names

      • powershell.exe (PID: 5876)

  • INFO

    • Checks supported languages

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7664)
      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)
      • svchost.exe (PID: 2304)
      • svchost.exe (PID: 5444)

    • The executable file from the user directory is run by the Powershell process

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)
      • svchost.exe (PID: 2304)

    • Reads the computer name

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7664)
      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)
      • svchost.exe (PID: 2304)
      • svchost.exe (PID: 5444)

    • Creates files or folders in the user directory

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)

    • Launching a file from a Registry key

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)
      • svchost.exe (PID: 2304)

    • Reads the machine GUID from the registry

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)
      • svchost.exe (PID: 2304)

    • Create files in a temporary directory

      • 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe (PID: 7160)
      • svchost.exe (PID: 2304)

    • Manual execution by a user

      • svchost.exe (PID: 5444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2047:11:21 10:16:38+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 99840
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x1a54e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Mekorot
FileVersion: 1.0.0.0
InternalName: aXN0IGFnZ3Jlc3Npb24uIEkgYW.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: aXN0IGFnZ3Jlc3Npb24uIEkgYW.exe
ProductName: Mekorot
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
13
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe no specs powershell.exe no specs conhost.exe no specs 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe cmd.exe no specs conhost.exe no specs slui.exe svchost.exe no specs powershell.exe no specs conhost.exe no specs svchost.exe cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1296"powershell.exe" Start-Process -FilePath C:\Users\admin\AppData\Local\Temp\07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe -Verb RunAsC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1296C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\delete.bat""C:\Windows\SysWOW64\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2304"C:\Users\admin\AppData\Local\svchost.exe" C:\Users\admin\AppData\Local\svchost.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Description:
Mekorot
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4300C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\delete.bat""C:\Windows\SysWOW64\cmd.exe—07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4328\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5444C:\Users\admin\AppData\Local\svchost.exeC:\Users\admin\AppData\Local\svchost.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Mekorot
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5876"powershell.exe" Start-Process -FilePath C:\Users\admin\AppData\Local\svchost.exe -Verb RunAsC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
6804C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7160"C:\Users\admin\AppData\Local\Temp\07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe" C:\Users\admin\AppData\Local\Temp\07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Description:
Mekorot
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
13 314
Read events
13 307
Write events
5
Delete events
2

Modification events

(PID) Process:(7160) 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SystemHealthCheck
Value:
C:\Users\admin\AppData\Local\svchost.exe
(PID) Process:(7160) 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:SystemHealthCheck
Value:
C:\Users\admin\AppData\Local\svchost.exe
(PID) Process:(6804) slui.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@%SystemRoot%\System32\sppcomapi.dll,-3200
Value:
Software Licensing
(PID) Process:(5876) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
EA7DE26900000000
(PID) Process:(5876) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(2304) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SystemHealthCheck
Value:
C:\Users\admin\AppData\Local\svchost.exe
(PID) Process:(2304) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:SystemHealthCheck
Value:
C:\Users\admin\AppData\Local\svchost.exe
Executable files
1
Suspicious files
1
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
1296powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lvf0iaw2.f1u.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1296powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qnuzypf3.xsu.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1296powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:189BD00167D5877A4AECB7AC934F4A1C
SHA256:5AC4CF2CB73768218D18758C5CB1A4EF978453549FDF83B8523E93431C0CB8AE
716007c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exeC:\Users\admin\AppData\Local\Temp\delete.battext
MD5:820E729A49EBA8681C6518DBBFA6A3AC
SHA256:DEA7D0CF76F718620594FFAB95A5C61AB3734F577CC0720B0991FFF897BE6183
716007c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exeC:\Users\admin\AppData\Local\svchost.exeexecutable
MD5:EB89F018E6C3A8E9DE0A0452ACB16E76
SHA256:07C3BBE60D47240DF7152F72BEB98EA373D9600946860BAD12F7BC617A5D6F5F
716007c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample.exeC:\Users\admin\AppData\Local\Temp\target_verify.logtext
MD5:6A27E9439FA40CB89EE341133B03E4DB
SHA256:D3B4737095600C1D87F0354D8246A1D4A22C737B92A9EC62571F8330CFD03C05
2304svchost.exeC:\Users\admin\AppData\Local\Temp\delete.battext
MD5:AF4F20A36E0DCFC3B45CDC4E22894723
SHA256:CC1652C70BEE1EE435688C011BAE9F654DE7EC7000220F372A3431E7E0F7155A
5876powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_12ri4je3.uul.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5876powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bdl3zynh.r3z.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
27
DNS requests
23
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
5716
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
—
—
GET
200
23.11.41.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
NL
binary
312 b
whitelisted
5316
svchost.exe
POST
200
20.190.160.22:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
5716
SIHClient.exe
GET
200
20.165.94.54:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
5716
SIHClient.exe
GET
200
74.178.76.128:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
5716
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5316
svchost.exe
POST
400
20.190.160.22:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
5316
svchost.exe
GET
200
23.11.41.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
NL
binary
471 b
whitelisted
4044
svchost.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4044
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7380
slui.exe
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5532
SearchApp.exe
2.16.204.151:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3428
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted
www.bing.com
  • 2.16.204.151
  • 2.16.204.160
  • 2.16.204.150
  • 2.16.204.161
  • 2.16.204.141
  • 2.16.204.148
  • 2.16.204.142
  • 2.16.204.152
  • 2.16.204.134
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
google.com
  • 142.251.127.113
  • 142.251.127.101
  • 142.251.127.100
  • 142.251.127.138
  • 142.251.127.102
  • 142.251.127.139
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.4
  • 20.190.160.65
  • 20.190.160.2
  • 20.190.160.17
  • 20.190.160.5
  • 40.126.32.72
  • 20.190.160.66
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
  • 23.55.110.193
  • 23.55.110.211
whitelisted
www.microsoft.com
  • 23.59.18.102
  • 88.221.169.152
whitelisted

Threats

PID
Process
Class
Message
4044
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.exe.sample