File name:

skidware.exe

Full analysis: https://app.any.run/tasks/1a3b3a87-be9c-46b7-bc2a-ad2bc6084ec1
Verdict: Malicious activity
Analysis date: October 03, 2025, 17:13:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

0598662D503C30B11FEF8E1FF37B9CDF

SHA1:

8B7B6BBD3D4C840F43804F8D689AD0EFCD751BAF

SHA256:

12B6EA4413816F4F1B165BC936D50E3EFD7E3660BC5417E983697D449652A26D

SSDEEP:

98304:OeMAaTG2W6bdhbU61xRrVoM0w0U0w0w0w0w0w0B0a0a0a0a0a0a0a0pwJnYyaWBW:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 2168)
      • cmd.exe (PID: 4176)
      • net.exe (PID: 7880)
      • net.exe (PID: 7240)
      • net.exe (PID: 704)
      • cmd.exe (PID: 5460)
      • net.exe (PID: 4860)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 5292)
      • cmd.exe (PID: 4448)
      • net.exe (PID: 1516)
      • net.exe (PID: 2816)
      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 4948)
      • cmd.exe (PID: 5944)
      • cmd.exe (PID: 1836)
      • cmd.exe (PID: 1188)
      • net.exe (PID: 5792)
      • cmd.exe (PID: 7728)
      • net.exe (PID: 4652)
      • cmd.exe (PID: 4584)
      • net.exe (PID: 2832)
      • cmd.exe (PID: 7744)
      • net.exe (PID: 1260)
      • net.exe (PID: 7828)
      • cmd.exe (PID: 8008)
      • net.exe (PID: 2004)
      • cmd.exe (PID: 7548)
      • net.exe (PID: 6864)
      • net.exe (PID: 2760)
      • net.exe (PID: 4804)
      • cmd.exe (PID: 2672)
      • cmd.exe (PID: 4212)
      • cmd.exe (PID: 2760)
      • net.exe (PID: 2652)
      • cmd.exe (PID: 8012)
      • net.exe (PID: 7808)
      • cmd.exe (PID: 2284)
      • net.exe (PID: 6388)
      • cmd.exe (PID: 3252)
      • net.exe (PID: 992)
      • net.exe (PID: 2980)
      • net.exe (PID: 7808)
      • net.exe (PID: 1260)
      • net.exe (PID: 5696)
      • cmd.exe (PID: 4016)
      • cmd.exe (PID: 7428)
      • net.exe (PID: 8028)
      • cmd.exe (PID: 6388)
      • cmd.exe (PID: 5792)
      • cmd.exe (PID: 1408)
      • cmd.exe (PID: 2004)
      • cmd.exe (PID: 4804)
      • cmd.exe (PID: 3160)
      • net.exe (PID: 7200)
      • net.exe (PID: 992)
      • net.exe (PID: 7980)
      • net.exe (PID: 8760)
      • net.exe (PID: 8392)
      • cmd.exe (PID: 8584)
      • net.exe (PID: 8644)
      • cmd.exe (PID: 8460)
      • cmd.exe (PID: 8700)
      • net.exe (PID: 8524)
      • net.exe (PID: 8196)
      • cmd.exe (PID: 8828)
      • net.exe (PID: 8988)
      • cmd.exe (PID: 8940)
      • net.exe (PID: 9108)
      • cmd.exe (PID: 9056)
      • net.exe (PID: 8256)
      • net.exe (PID: 8872)
      • net.exe (PID: 8180)
      • net.exe (PID: 8524)
      • net.exe (PID: 8276)
      • cmd.exe (PID: 8360)
      • net.exe (PID: 8432)
      • cmd.exe (PID: 8500)
      • cmd.exe (PID: 8520)
      • cmd.exe (PID: 2108)
      • net.exe (PID: 8508)
      • cmd.exe (PID: 8732)
      • net.exe (PID: 8960)
      • net.exe (PID: 9076)
      • cmd.exe (PID: 9156)
      • cmd.exe (PID: 2980)
      • cmd.exe (PID: 8588)
      • net.exe (PID: 8976)
      • cmd.exe (PID: 9192)
      • cmd.exe (PID: 9028)
      • cmd.exe (PID: 7788)
      • net.exe (PID: 8836)
      • net.exe (PID: 8208)
      • net.exe (PID: 8324)
      • cmd.exe (PID: 8196)
      • net.exe (PID: 8336)
      • cmd.exe (PID: 6128)
      • net.exe (PID: 8384)
      • cmd.exe (PID: 8428)
      • net.exe (PID: 8904)
      • cmd.exe (PID: 8436)
      • net.exe (PID: 8808)
      • cmd.exe (PID: 9048)
      • net.exe (PID: 8108)
      • cmd.exe (PID: 9036)
      • cmd.exe (PID: 5580)
      • cmd.exe (PID: 9180)
      • net.exe (PID: 8868)
      • cmd.exe (PID: 8720)
      • net.exe (PID: 6864)
      • net.exe (PID: 9100)
      • cmd.exe (PID: 8944)
      • net.exe (PID: 8512)
      • cmd.exe (PID: 8368)
      • net.exe (PID: 8988)
      • net.exe (PID: 8536)
      • net.exe (PID: 8784)
      • net.exe (PID: 8984)
      • net.exe (PID: 8988)
      • cmd.exe (PID: 8312)
      • cmd.exe (PID: 8928)
      • cmd.exe (PID: 7716)
      • cmd.exe (PID: 8840)
      • net.exe (PID: 8932)
      • cmd.exe (PID: 8488)
      • net.exe (PID: 6972)
      • net.exe (PID: 9020)
      • net.exe (PID: 8292)
      • cmd.exe (PID: 8268)
      • cmd.exe (PID: 8284)
      • net.exe (PID: 8904)
      • cmd.exe (PID: 8792)
      • net.exe (PID: 8808)
      • cmd.exe (PID: 8668)
      • cmd.exe (PID: 8444)
      • net.exe (PID: 8304)
      • cmd.exe (PID: 8316)
      • net.exe (PID: 9012)
      • cmd.exe (PID: 8884)
      • net.exe (PID: 9044)
      • cmd.exe (PID: 6788)
      • net.exe (PID: 5548)
      • cmd.exe (PID: 5320)
      • net.exe (PID: 4416)
      • net.exe (PID: 8572)
      • cmd.exe (PID: 8600)
      • cmd.exe (PID: 8032)
      • net.exe (PID: 9008)
      • cmd.exe (PID: 4652)
      • net.exe (PID: 8912)
      • cmd.exe (PID: 9176)
      • net.exe (PID: 8548)
      • cmd.exe (PID: 8976)
      • net.exe (PID: 7996)
      • net.exe (PID: 8812)
      • cmd.exe (PID: 8684)
      • net.exe (PID: 9076)
      • cmd.exe (PID: 7776)
      • net.exe (PID: 3572)
      • cmd.exe (PID: 8892)
      • net.exe (PID: 8780)
      • cmd.exe (PID: 8744)
      • net.exe (PID: 6332)
      • cmd.exe (PID: 8868)
      • cmd.exe (PID: 9188)
      • net.exe (PID: 3240)
      • net.exe (PID: 8288)
      • cmd.exe (PID: 8256)
      • cmd.exe (PID: 8736)
      • net.exe (PID: 8228)
      • cmd.exe (PID: 8524)
      • net.exe (PID: 9060)
      • cmd.exe (PID: 8812)
      • net.exe (PID: 4620)
      • cmd.exe (PID: 7032)
      • net.exe (PID: 9052)
      • net.exe (PID: 9016)
      • cmd.exe (PID: 8204)
      • net.exe (PID: 8344)
      • cmd.exe (PID: 2836)
      • cmd.exe (PID: 8988)
      • cmd.exe (PID: 8916)
      • net.exe (PID: 8308)

    • UAC/LUA settings modification

      • skidware.exe (PID: 3000)

    • Disables the Shutdown in the Start menu

      • skidware.exe (PID: 3000)

    • Disables the Command Prompt (cmd)

      • skidware.exe (PID: 3000)

    • Disables task manager

      • skidware.exe (PID: 3000)

    • Changes the login/logoff helper path in the registry

      • skidware.exe (PID: 3000)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • skidware.exe (PID: 3000)

    • Starts CMD.EXE for commands execution

      • skidware.exe (PID: 3000)

    • Reads security settings of Internet Explorer

      • skidware.exe (PID: 3000)

    • Reads the date of Windows installation

      • skidware.exe (PID: 3000)

    • Uses WMIC.EXE to obtain user accounts information

      • cmd.exe (PID: 7556)

    • The system shut down or reboot

      • skidware.exe (PID: 3000)

    • Changes the desktop background image

      • skidware.exe (PID: 3000)

  • INFO

    • Changes file name

      • cmd.exe (PID: 7556)

    • Reads the computer name

      • skidware.exe (PID: 3000)

    • Process checks computer location settings

      • skidware.exe (PID: 3000)

    • Checks supported languages

      • skidware.exe (PID: 3000)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6972)

    • Creates files in the program directory

      • skidware.exe (PID: 3000)

    • Process checks whether UAC notifications are on

      • skidware.exe (PID: 3000)

    • Reads mouse settings

      • skidware.exe (PID: 3000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2100:02:26 01:29:54+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 2385408
InitializedDataSize: 5120
UninitializedDataSize: -
EntryPoint: 0x2482f2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: Cluttscape.exe
LegalCopyright:
OriginalFileName: Cluttscape.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
543
Monitored processes
379
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
560\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
704net user å≈▲ÿń¾×Ÿεž×5╬▄ å≈▲ÿń¾×Ÿεž×5╬▄ /add C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
764\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
992net user 5½1ß◘♦æ√☺π♣äš× 5½1ß◘♦æ√☺π♣äš× /add C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
992net user πµ82◄7▀Æ▲Ç4í▌¬ πµ82◄7▀Æ▲Ç4í▌¬ /add C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mpr.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
992\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
992C:\WINDOWS\system32\net1 user 1œžÿ1ßε█×♦å«ě5 1œžÿ1ßε█×♦å«ě5 /add C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\dsrole.dll
1136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1188"C:\Windows\System32\cmd.exe" /k net user ♫×3¢¢╚¬¶▀öčΣžž ♫×3¢¢╚¬¶▀öčΣžž /add && exitC:\Windows\System32\cmd.exe—skidware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1260net user ☼▲½š◙²øč汫╚Æń ☼▲½š◙²øč汫╚Æń /add C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
10 280
Read events
10 257
Write events
23
Delete events
0

Modification events

(PID) Process:(3000) skidware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3000) skidware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3000) skidware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3000) skidware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3000) skidware.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layout
Operation:writeName:Scancode Map
Value:
000000000000000051000000000021E000006CE000006DE0000011E000006BE0000050E000004BE000004DE0000048E0000040E0000042E000003BE000003EE000003CE000003FE0000058E0000007E0000041E0000057E0000043E0000023E000003DE00E0008E00000280000000C000000330000003400000035000000270000001A0000002B0000001B000000290000000D0000000B00000002000000030000000400000005000000060000000700000008000000090000000A0000001E000000300000002E0000002000000012000000210000002200000023000000240000003200000031000000180000001900000010000000130000001F00000014000000160000002F000000110000002D000000150000002C000000520000004F00000050000000510000004B0000004C0000004D0000004700000048000000490000000E00000053E000005FE000000000
(PID) Process:(3000) skidware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableTaskMgr
Value:
1
(PID) Process:(3000) skidware.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableRegistryTools
Value:
1
(PID) Process:(3000) skidware.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe, cluttscape.exe
(PID) Process:(3000) skidware.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:AutoColorization
Value:
1
(PID) Process:(3000) skidware.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WallPaper
Value:
C:\ProgramData\Microsoft\User Account Pictures\background.jpg
Executable files
1
Suspicious files
0
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3000skidware.exeC:\Windows\cluttscape.exeexecutable
MD5:0598662D503C30B11FEF8E1FF37B9CDF
SHA256:12B6EA4413816F4F1B165BC936D50E3EFD7E3660BC5417E983697D449652A26D
3000skidware.exeC:\ProgramData\Microsoft\User Account Pictures\guest.bmpimage
MD5:31807E22503FD43248974C03CE11B61B
SHA256:32D5564C90DF8972F66E6B680CB725D6DF215D22ED8A611BEDB259E460A45D69
3000skidware.exeC:\ProgramData\Microsoft\User Account Pictures\user.bmpimage
MD5:31807E22503FD43248974C03CE11B61B
SHA256:32D5564C90DF8972F66E6B680CB725D6DF215D22ED8A611BEDB259E460A45D69
3000skidware.exeC:\ProgramData\Microsoft\User Account Pictures\background.jpgimage
MD5:2503DC1CC27BC4727456F514FC2DFD13
SHA256:0A9ED9BEF18A3C864713ACC9745E72AF4F8AE5B2FF426CDED7A251A2942A5CAC
3000skidware.exeC:\ProgramData\Microsoft\User Account Pictures\user-192.pngimage
MD5:12B879DCC2833BA4A9F19713955434F8
SHA256:0C1132041C8EE4D924AF023A90D4BF42B9E2EF82D8812FB1626FA6D140B097D0
3000skidware.exeC:\ProgramData\Microsoft\User Account Pictures\guest.pngimage
MD5:12B879DCC2833BA4A9F19713955434F8
SHA256:0C1132041C8EE4D924AF023A90D4BF42B9E2EF82D8812FB1626FA6D140B097D0
3000skidware.exeC:\ProgramData\Microsoft\User Account Pictures\user-48.pngimage
MD5:12B879DCC2833BA4A9F19713955434F8
SHA256:0C1132041C8EE4D924AF023A90D4BF42B9E2EF82D8812FB1626FA6D140B097D0
3000skidware.exeC:\ProgramData\Microsoft\User Account Pictures\kill.icoimage
MD5:708B6F1CE799360FC5295B85A54819CC
SHA256:8E243953C3BDF5FBD20027990CB88EA195BEAEEB1D57F2A65DB49AF43087E4E5
3000skidware.exeC:\ProgramData\Microsoft\User Account Pictures\user.pngimage
MD5:12B879DCC2833BA4A9F19713955434F8
SHA256:0C1132041C8EE4D924AF023A90D4BF42B9E2EF82D8812FB1626FA6D140B097D0
3000skidware.exeC:\ProgramData\Microsoft\User Account Pictures\user-40.pngimage
MD5:12B879DCC2833BA4A9F19713955434F8
SHA256:0C1132041C8EE4D924AF023A90D4BF42B9E2EF82D8812FB1626FA6D140B097D0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
37
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
20.190.160.5:443
https://login.live.com/RST2.srf
US
xml
11.0 Kb
unknown
—
—
POST
204
92.123.104.62:443
https://www.bing.com/web/xlsc.aspx?t=5&dl=1&wsbc=1
unknown
—
—
unknown
—
—
GET
200
92.123.104.8:443
https://www.bing.com/th?id=ODSWG.8229b0e5-fa8c-4e4a-af74-69717698b903&pid=dsb
unknown
image
4.62 Kb
unknown
—
—
GET
200
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
unknown
—
—
GET
200
20.3.187.198:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
unknown
8396
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
—
—
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
unknown
—
—
GET
200
52.109.76.240:443
https://officeclient.microsoft.com/config16/?syslcid=1033&build=16.0.16026&crev=3
IE
xml
183 Kb
unknown
—
—
POST
403
69.192.161.161:443
https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409
US
html
384 b
unknown
—
—
POST
200
20.190.160.14:443
https://login.live.com/RST2.srf
US
xml
10.3 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6016
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6904
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6016
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5948
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5224
SearchApp.exe
184.86.251.22:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4440
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3464
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
8396
SIHClient.exe
135.232.92.137:443
slscr.update.microsoft.com
LUCENT-CIO
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.bing.com
  • 184.86.251.22
  • 184.86.251.27
  • 184.86.251.19
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.131
  • 20.190.159.23
  • 40.126.31.3
  • 40.126.31.1
  • 20.190.159.4
  • 20.190.159.64
  • 20.190.159.2
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 135.232.92.137
  • 2603:1030:c06:15::4a5
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
self.events.data.microsoft.com
  • 13.89.179.8
  • 13.69.239.79
whitelisted
137.92.232.135.in-addr.arpa
  • —
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
skidware.exe