File name:

new.exe

Full analysis: https://app.any.run/tasks/9f2b9a41-74b7-4477-ab48-692ff11d0392
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: March 23, 2025, 19:09:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
miner
winring0x64-sys
vuln-driver
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 11 sections
MD5:

30E4C5723BB3AC91E1D20EF6B57DB0BE

SHA1:

EC4104C6853B30AADC056CD5AC08C53E73392C17

SHA256:

1ABEDDC843E9BFE555849E7C5EC8B1251FCFD0F589F6EED396D5E3291A4BE4A8

SSDEEP:

98304:anP5dhxS8ifWlxjfDamGkJhkPM75Jyns5YODDPqaH06i3LOi8d6LQWPjk+jHxL42:8Zys5YOTI1vu6rsY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • new.exe (PID: 5176)
      • new.exe (PID: 2136)
      • updater.exe (PID: 7840)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • Vulnerable driver has been detected

      • updater.exe (PID: 7840)

  • SUSPICIOUS

    • Manipulates environment variables

      • powershell.exe (PID: 812)
      • powershell.exe (PID: 7860)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 7392)
      • cmd.exe (PID: 2088)

    • Executable content was dropped or overwritten

      • new.exe (PID: 2136)
      • updater.exe (PID: 7840)

    • The process executes via Task Scheduler

      • updater.exe (PID: 7840)

    • Crypto Currency Mining Activity Detected

      • svchost.exe (PID: 2196)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 7840)

  • INFO

    • Manual execution by a user

      • powershell.exe (PID: 812)
      • cmd.exe (PID: 7392)
      • powershell.exe (PID: 7400)
      • schtasks.exe (PID: 7780)
      • powershell.exe (PID: 7860)
      • cmd.exe (PID: 2088)
      • powershell.exe (PID: 7328)
      • explorer.exe (PID: 8024)
      • conhost.exe (PID: 6712)

    • Checks supported languages

      • new.exe (PID: 2136)
      • updater.exe (PID: 7840)

    • The sample compiled with english language support

      • new.exe (PID: 2136)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 812)
      • powershell.exe (PID: 7400)
      • powershell.exe (PID: 7860)
      • powershell.exe (PID: 7328)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 812)
      • powershell.exe (PID: 7860)

    • Creates files in the program directory

      • new.exe (PID: 2136)
      • updater.exe (PID: 7840)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6272)
      • slui.exe (PID: 4696)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8016)
      • BackgroundTransferHost.exe (PID: 6272)
      • BackgroundTransferHost.exe (PID: 1096)
      • BackgroundTransferHost.exe (PID: 7244)
      • BackgroundTransferHost.exe (PID: 2392)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 6272)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6272)

    • The sample compiled with japanese language support

      • updater.exe (PID: 7840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:03:14 12:20:22+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.38
CodeSize: 105472
InitializedDataSize: 5958656
UninitializedDataSize: 10240
EntryPoint: 0x14b0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 116.0.5845.96
ProductVersionNumber: 116.0.5845.96
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Google Chrome
FileTitle: -
FileDescription: Google Chrome
FileVersion: 116,0,5845,96
LegalCopyright: Copyright 2023 Google LLC. All rights reserved.
LegalTrademark: -
ProductName: Google LLC
ProductVersion: 116,0,5845,96
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
36
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start new.exe powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe powershell.exe conhost.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe conhost.exe no specs THREAT updater.exe powershell.exe conhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs cmd.exe conhost.exe no specs powershell.exe conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs conhost.exe explorer.exe #MINER svchost.exe slui.exe no specs new.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
812C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1096"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2088C:\WINDOWS\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0C:\Windows\System32\cmd.exe
explorer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2136"C:\Users\admin\AppData\Local\Temp\new.exe" C:\Users\admin\AppData\Local\Temp\new.exe
explorer.exe
User:
admin
Company:
Google Chrome
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
116,0,5845,96
Modules
Images
c:\users\admin\appdata\local\temp\new.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
2140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2392"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4380C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4696"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5176"C:\Users\admin\AppData\Local\Temp\new.exe" C:\Users\admin\AppData\Local\Temp\new.exe—explorer.exe
User:
admin
Company:
Google Chrome
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221226540
Version:
116,0,5845,96
Modules
Images
c:\users\admin\appdata\local\temp\new.exe
c:\windows\system32\ntdll.dll
Total events
25 613
Read events
25 598
Write events
15
Delete events
0

Modification events

(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6272) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6272) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6272) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1096) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1096) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2392) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2392) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
4
Suspicious files
6
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
6272BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D —
MD5:—
SHA256:—
6272BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\03f7e9a0-2f1f-4cb1-a54d-2f520677a5b8.down_data —
MD5:—
SHA256:—
7860powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_4baa0tte.1et.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7860powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_4j51hadv.jfy.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6272BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\49527453-7ffc-4949-8685-d4bdd56d60b9.up_meta_securebinary
MD5:A7445049E1C785055C96EA72D310A02E
SHA256:0E20637E8CF6430D2951F026C2B68DFEED3FE1F65957500CD2EC7F3092BFEEED
2136new.exeC:\Program Files\Google\Chrome\updater.exeexecutable
MD5:30E4C5723BB3AC91E1D20EF6B57DB0BE
SHA256:1ABEDDC843E9BFE555849E7C5EC8B1251FCFD0F589F6EED396D5E3291A4BE4A8
6272BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:B261B35533C42CC53D4FE108557214A4
SHA256:0B435E7D80B01E335BD31291260C01C7280DBFB57C528FFA5E5415B4FF482808
7840updater.exeC:\Windows\Temp\uefqeqnbgtvw.tmpexecutable
MD5:1A5929356C79141CEFD46A420B5EDFB0
SHA256:7B5E28A3EB24D4FC8005ABA0A5D159E172C8B228B1D43085A09826AECA3E0858
812powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vq23egpa.tk0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
812powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2ifwqr3l.ilh.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
—
—
GET
200
184.24.77.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5116
backgroundTaskHost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
6272
BackgroundTransferHost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
5116
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
5116
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
184.24.77.37:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6544
svchost.exe
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
DE
unknown
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5116
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
unknown
crl.microsoft.com
  • 184.24.77.37
  • 184.24.77.35
unknown
google.com
  • 142.250.185.142
unknown
client.wns.windows.com
  • 40.113.103.199
unknown
login.live.com
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.128
  • 40.126.31.0
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.159.64
  • 40.126.31.129
unknown
ocsp.digicert.com
  • 23.63.118.230
unknown
arc.msn.com
  • 20.103.156.88
unknown
www.bing.com
  • 2.16.204.158
  • 2.16.204.134
  • 2.16.204.145
  • 2.16.204.148
unknown
pool.hashvault.pro
  • 80.240.16.67
  • 192.248.189.11
unknown
slscr.update.microsoft.com
  • 52.149.20.212
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Crypto Currency Mining Activity Detected
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
new.exe