File name:

Apollo.exe

Full analysis: https://app.any.run/tasks/f88f0c7c-b6b4-46a7-8834-82ff1c102ad3
Verdict: Malicious activity
Analysis date: July 21, 2025, 01:11:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 9 sections
MD5:

0FF951E3173AF3E9E440DA91526148C2

SHA1:

4195DA2704E14954493490177C3D13053D2B5C59

SHA256:

13C406840A973E4087848541907C29E07FD9C7DB7A6E0E4A96CE87DB01BE4956

SSDEEP:

98304:/epSdvd56xTP61+B/OEqs6nB4rS/CdA93+ZArzN7P3r7zcBue0fwkIWGtqoAw3eu:6VXG3DxuLaNXzFjkbnakR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • cmd.exe (PID: 1488)
      • net.exe (PID: 6852)
      • net.exe (PID: 1244)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Apollo.exe (PID: 2716)
      • nefconc.exe (PID: 1488)
      • drvinst.exe (PID: 72)

    • There is functionality for taking screenshot (YARA)

      • Apollo.exe (PID: 2716)

    • Creates a software uninstall entry

      • Apollo.exe (PID: 2716)

    • Uses ICACLS.EXE to modify access control lists

      • Apollo.exe (PID: 2716)
      • cmd.exe (PID: 1232)

    • Starts CMD.EXE for commands execution

      • Apollo.exe (PID: 2716)
      • cmd.exe (PID: 2188)
      • cmd.exe (PID: 856)

    • Executing commands from a ".bat" file

      • Apollo.exe (PID: 2716)

    • Application launched itself

      • cmd.exe (PID: 2188)
      • cmd.exe (PID: 856)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2188)
      • cmd.exe (PID: 6756)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2188)

    • Adds/modifies Windows certificates

      • certutil.exe (PID: 2612)
      • certutil.exe (PID: 4456)
      • powershell.exe (PID: 5288)

    • Creates files in the driver directory

      • drvinst.exe (PID: 72)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 4888)

    • Executes as Windows Service

      • WUDFHost.exe (PID: 4032)
      • sunshinesvc.exe (PID: 6636)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 856)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 4832)

    • Execution of CURL command

      • cmd.exe (PID: 856)

    • Windows service management via SC.EXE

      • sc.exe (PID: 4412)
      • sc.exe (PID: 6748)
      • sc.exe (PID: 2312)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1488)
      • cmd.exe (PID: 5244)

    • Creates a new Windows service

      • sc.exe (PID: 4232)

    • Manipulates environment variables

      • powershell.exe (PID: 5288)

    • The process creates files with name similar to system file names

      • Apollo.exe (PID: 2716)

    • Sets the service to start on system boot

      • sc.exe (PID: 4112)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Apollo.exe (PID: 2716)

  • INFO

    • Checks supported languages

      • Apollo.exe (PID: 2716)
      • nefconc.exe (PID: 6820)
      • nefconc.exe (PID: 7064)
      • drvinst.exe (PID: 72)
      • drvinst.exe (PID: 4888)
      • nefconc.exe (PID: 1488)
      • curl.exe (PID: 4072)
      • curl.exe (PID: 644)
      • sunshine.exe (PID: 4512)
      • sunshinesvc.exe (PID: 6636)

    • Creates files in the program directory

      • Apollo.exe (PID: 2716)
      • cmd.exe (PID: 1232)
      • sunshine.exe (PID: 4512)

    • Create files in a temporary directory

      • Apollo.exe (PID: 2716)
      • nefconc.exe (PID: 1488)

    • Reads the computer name

      • Apollo.exe (PID: 2716)
      • nefconc.exe (PID: 6820)
      • nefconc.exe (PID: 7064)
      • nefconc.exe (PID: 1488)
      • drvinst.exe (PID: 72)
      • drvinst.exe (PID: 4888)
      • curl.exe (PID: 644)
      • sunshinesvc.exe (PID: 6636)
      • sunshine.exe (PID: 4512)

    • The sample compiled with english language support

      • Apollo.exe (PID: 2716)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 72)
      • sunshine.exe (PID: 4512)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 72)

    • Reads the software policy settings

      • drvinst.exe (PID: 72)
      • slui.exe (PID: 3108)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5288)

    • Execution of CURL command

      • cmd.exe (PID: 6756)
      • cmd.exe (PID: 856)

    • Checks proxy server information

      • reg.exe (PID: 4164)
      • slui.exe (PID: 3108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:04:30 18:11:53+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.44
CodeSize: 35328
InitializedDataSize: 103936
UninitializedDataSize: 402432
EntryPoint: 0x42bd
OSVersion: 5.1
ImageVersion: 6
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
198
Monitored processes
61
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start apollo.exe icacls.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs where.exe no specs certutil.exe no specs certutil.exe no specs nefconc.exe no specs nefconc.exe no specs nefconc.exe drvinst.exe drvinst.exe no specs wudfhost.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs curl.exe findstr.exe no specs curl.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sunshinesvc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sunshine.exe no specs conhost.exe no specs slui.exe apollo.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
72DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{e2db3f13-3376-3b4e-be75-a5bba9902e73}\SudoVDA.inf" "9" "4fbf0c1f7" "00000000000001DC" "WinSta0\Default" "00000000000001C8" "208" "C:\Program Files\Apollo\drivers\sudovda"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
644curl -s -L https://api.github.com/repos/nefarius/vigembus/releases/latest C:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
HIGH
Description:
The curl executable
Exit code:
35
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
856C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\Apollo\scripts\install-gamepad.bat""C:\Windows\System32\cmd.exe—Apollo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sunshine.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\Apollo\drivers\sudovda\install.bat""C:\Windows\System32\cmd.exe—Apollo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1160netsh advfirewall firewall add rule name=Apollo dir=in action=allow protocol=udp program="C:\Program Files\Apollo\sunshine.exe" enable=yesC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1232C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\Apollo\scripts\migrate-config.bat""C:\Windows\System32\cmd.exe—Apollo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1244net start ApolloServiceC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1488nefconc.exe --install-driver --inf-path "SudoVDA.inf"C:\Program Files\Apollo\drivers\sudovda\nefconc.exe
cmd.exe
User:
admin
Company:
Nefarius Software Solutions e.U.
Integrity Level:
HIGH
Description:
Nefarius' Device Console Utility
Exit code:
0
Version:
1.12.0.0
Modules
Images
c:\program files\apollo\drivers\sudovda\nefconc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
1488C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\Apollo\scripts\install-service.bat""C:\Windows\System32\cmd.exe—Apollo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
Total events
15 299
Read events
15 237
Write events
52
Delete events
10

Modification events

(PID) Process:(2716) Apollo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Apollo
Operation:writeName:NoModify
Value:
1
(PID) Process:(2716) Apollo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Apollo
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Apollo\sunshine.exe
(PID) Process:(2716) Apollo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Apollo
Operation:writeName:DisplayName
Value:
Apollo
(PID) Process:(2716) Apollo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Apollo
Operation:writeName:DisplayVersion
Value:
0.4.1
(PID) Process:(2716) Apollo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Apollo
Operation:writeName:Publisher
Value:
SudoMaker
(PID) Process:(2716) Apollo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Apollo
Operation:writeName:UninstallString
Value:
"C:\Program Files\Apollo\Uninstall.exe"
(PID) Process:(2716) Apollo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Apollo
Operation:writeName:NoRepair
Value:
1
(PID) Process:(2716) Apollo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Apollo
Operation:writeName:StartMenu
Value:
Apollo
(PID) Process:(2716) Apollo.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\SudoMaker\Apollo
Operation:writeName:Start Menu Folder
Value:
Apollo
(PID) Process:(2612) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION
Executable files
18
Suspicious files
47
Text files
105
Unknown types
0

Dropped files

PID
Process
Filename
Type
2716Apollo.exeC:\Program Files\Apollo\sunshine.exe —
MD5:—
SHA256:—
2716Apollo.exeC:\Users\admin\AppData\Local\Temp\nsxDDBA.tmp\UserInfo.dllexecutable
MD5:7357838AC641996018FEF63B2F30E085
SHA256:B12B4A4BA795356E4112F51986A329BE29929FD7CC533984F55BF6AFE5E3F2FD
2716Apollo.exeC:\Users\admin\AppData\Local\Temp\nsxDDBA.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
2716Apollo.exeC:\Users\admin\AppData\Local\Temp\nsxDDBA.tmp\InstallOptions.dllexecutable
MD5:79C985EA58A63ADF00D79D5D9BEDE11C
SHA256:FE1D0728BCFB370048F1738259CAC8835B5E41DAFEADD5D80486C8ECC3C1577B
2716Apollo.exeC:\Program Files\Apollo\assets\shaders\directx\convert_yuv420_packed_uv_type0_vs.hlsltext
MD5:88820E52A237F7B6E78BD99F4C081095
SHA256:8B524DB00460581242BA8BFED502D04FD6DF2DC0B88E8BE1CB0042A4FEB9E1C1
2716Apollo.exeC:\Users\admin\AppData\Local\Temp\nsxDDBA.tmp\modern-header.bmpimage
MD5:C2BE5451C34E23EAD65DEB643289AF64
SHA256:F09B4A7569844A6A1B07FBC3F53782903676E461F6019BD5FBEFA6A2E5BA52D1
2716Apollo.exeC:\Users\admin\AppData\Local\Temp\nsxDDBA.tmp\StartMenu.dllexecutable
MD5:24ED78F875EBD2F412ABBD53820350EC
SHA256:643F52F1341EACE7D8FB2FD2BA54A41B8863F0AC435F2FA0918E2971A1B4BA1B
2716Apollo.exeC:\Program Files\Apollo\tools\sunshinesvc.exeexecutable
MD5:F11FB598ABA2713ECE04BC7C53AA5681
SHA256:69CA004BD731CB2B8F37F9F5D4885B8CA5D11B9E9DB70A604DE48FE4C44FCBBD
2716Apollo.exeC:\Program Files\Apollo\assets\apps.jsonbinary
MD5:02719945E8E88BB5E843E9C561943F71
SHA256:BC2099CF6CC1AFCBFF42D7E8627DBDB6F729D346FDBCB400770A44FE7E1423EC
2716Apollo.exeC:\Program Files\Apollo\assets\shaders\directx\convert_yuv420_packed_uv_type0_ps.hlsltext
MD5:920BFD762632909D51768DF25483356C
SHA256:897BC37D0319B5400E142EE5D04C7DD260AF1071040B4D8F0BB6DCA90C510A3E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
67
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.159.4:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
20.190.159.4:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.73:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.3:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.68:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3112
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.14
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.64
  • 20.190.160.14
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.131
  • 40.126.32.72
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
api.github.com
  • 140.82.121.5
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted
www.bing.com
  • 92.123.104.34
  • 92.123.104.38
  • 92.123.104.32
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Apollo.exe