File name:

WindowsUpdates.exe

Full analysis: https://app.any.run/tasks/f3f95428-d811-4481-85f0-dd219ec318e7
Verdict: Malicious activity
Analysis date: April 10, 2025, 14:32:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
meshagent
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 6 sections
MD5:

A4A3F62DB6DE8CE84CE275FC1C3A4C00

SHA1:

655FB3B768A30AA48A70CFB34D19527843D1EE3C

SHA256:

25F66AE1220A7EA09C0B5A06BA10D53ED461369C7AD357605D7DE03410D59577

SSDEEP:

98304:zh7Jc09d/1Xn0R7PRD+9KWFn1O6Al0QFUv6Azk7prpSPynGRter9t2oEhaI0vZRP:0zl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • WindowsUpdates.exe (PID: 6620)
      • WindowsUpdates.exe (PID: 4172)
      • WindowsUpdates.exe (PID: 1012)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 4424)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • WindowsUpdates.exe (PID: 6620)

    • Uses WMIC.EXE to obtain operating system information

      • WindowsUpdates.exe (PID: 6620)
      • WindowsUpdates.exe (PID: 1012)

    • MeshAgent potential remote access (YARA)

      • WindowsUpdates.exe (PID: 6620)

    • Reads security settings of Internet Explorer

      • WindowsUpdates.exe (PID: 6620)

    • Application launched itself

      • WindowsUpdates.exe (PID: 6620)

    • Creates or modifies Windows services

      • WindowsUpdates.exe (PID: 4172)

    • Creates a software uninstall entry

      • WindowsUpdates.exe (PID: 4172)
      • WindowsUpdates.exe (PID: 1012)

    • Executable content was dropped or overwritten

      • WindowsUpdates.exe (PID: 4172)

    • Executes as Windows Service

      • WindowsUpdates.exe (PID: 1012)

    • Uses WMIC.EXE to obtain computer system information

      • WindowsUpdates.exe (PID: 1012)

    • Uses WMIC.EXE to obtain system information

      • WindowsUpdates.exe (PID: 1012)

    • The process bypasses the loading of PowerShell profile settings

      • WindowsUpdates.exe (PID: 1012)

    • Starts POWERSHELL.EXE for commands execution

      • WindowsUpdates.exe (PID: 1012)

    • The process hides Powershell's copyright startup banner

      • WindowsUpdates.exe (PID: 1012)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 4424)

  • INFO

    • Checks supported languages

      • WindowsUpdates.exe (PID: 6620)
      • WindowsUpdates.exe (PID: 4172)
      • WindowsUpdates.exe (PID: 1012)

    • Reads the computer name

      • WindowsUpdates.exe (PID: 6620)
      • WindowsUpdates.exe (PID: 1012)

    • The sample compiled with english language support

      • WindowsUpdates.exe (PID: 6620)
      • WindowsUpdates.exe (PID: 4172)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 3900)
      • WMIC.exe (PID: 968)
      • WMIC.exe (PID: 1912)
      • WMIC.exe (PID: 3896)
      • WMIC.exe (PID: 7000)
      • WMIC.exe (PID: 5680)

    • Reads the machine GUID from the registry

      • WindowsUpdates.exe (PID: 6620)
      • WindowsUpdates.exe (PID: 1012)

    • Creates files in the program directory

      • WindowsUpdates.exe (PID: 4172)
      • WindowsUpdates.exe (PID: 1012)

    • Process checks computer location settings

      • WindowsUpdates.exe (PID: 6620)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6512)
      • powershell.exe (PID: 6760)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 2332)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 2332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:12:09 20:13:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 2458112
InitializedDataSize: 1345024
UninitializedDataSize: -
EntryPoint: 0x1c1570
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Microsoft Updates
FileVersion: 2022-Dec-2 11:42:16-0800
LegalCopyright: Apache 2.0 License
ProductName: Winupdates
ProductVersion: Commit: 2022-Dec-2 11:42:16-0800
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
30
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #MESHAGENT windowsupdates.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs windowsupdates.exe conhost.exe no specs windowsupdates.exe wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
968wmic os get oslanguage /FORMAT:LISTC:\Windows\SysWOW64\wbem\WMIC.exe—WindowsUpdates.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\iphlpapi.dll
1012"C:\Program Files (x86)\Microsoft\WindowsUpdates\WindowsUpdates.exe" --meshServiceName="WindowsUpdates" --installedByUser="S-1-5-21-1693682860-607145093-2874071422-1001"C:\Program Files (x86)\Microsoft\WindowsUpdates\WindowsUpdates.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
Microsoft Updates
Version:
2022-Dec-2 11:42:16-0800
Modules
Images
c:\program files (x86)\microsoft\windowsupdates\windowsupdates.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
1300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1912wmic SystemEnclosure get ChassisTypesC:\Windows\SysWOW64\wbem\WMIC.exe—WindowsUpdates.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\iphlpapi.dll
2140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WindowsUpdates.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2332powershell -noprofile -nologo -command -C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—WindowsUpdates.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
3896wmic SystemEnclosure get ChassisTypesC:\Windows\SysWOW64\wbem\WMIC.exe—WindowsUpdates.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\iphlpapi.dll
Total events
23 699
Read events
23 679
Write events
20
Delete events
0

Modification events

(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WindowsUpdates
Operation:writeName:ImagePath
Value:
"C:\Program Files (x86)\Microsoft\WindowsUpdates\WindowsUpdates.exe" --meshServiceName="WindowsUpdates" --installedByUser="S-1-5-21-1693682860-607145093-2874071422-1001"
(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsUpdates
Operation:writeName:EstimatedSize
Value:
3751
(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsUpdates
Operation:writeName:NoModify
Value:
1
(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsUpdates
Operation:writeName:NoRepair
Value:
1
(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsUpdates
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\Microsoft\WindowsUpdates\WindowsUpdates.exe -funinstall --meshServiceName="WindowsUpdates"
(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsUpdates
Operation:writeName:DisplayVersion
Value:
2022-12-02 19:42:16.000+00:00
(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WindowsUpdates
Operation:writeName:_InstalledBy
Value:
S-1-5-21-1693682860-607145093-2874071422-1001
(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsUpdates
Operation:writeName:DisplayName
Value:
Windows Updates
(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsUpdates
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Microsoft\WindowsUpdates\WindowsUpdates.exe
(PID) Process:(4172) WindowsUpdates.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WindowsUpdates
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Microsoft\WindowsUpdates\
Executable files
1
Suspicious files
7
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
4172WindowsUpdates.exeC:\Program Files (x86)\Microsoft\WindowsUpdates\WindowsUpdates.exeexecutable
MD5:A4A3F62DB6DE8CE84CE275FC1C3A4C00
SHA256:25F66AE1220A7EA09C0B5A06BA10D53ED461369C7AD357605D7DE03410D59577
1012WindowsUpdates.exeC:\Program Files (x86)\Microsoft\WindowsUpdates\WindowsUpdates.dbbinary
MD5:59A28B9F6773201D1441921E791C80DD
SHA256:B42DDDF1B96214DEC27CB4A9CCD4FAE04EBA934FB833BD130E8DF53F3B0E6D9E
1012WindowsUpdates.exeC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\350BCBF87AB5B7B9FC19DFC09C528217A8F15146binary
MD5:0D7C263C1DFACA7B23397736C979ECFD
SHA256:901FE8267EE58C2497D43ABE09B45BF07D82612333A3D95E2D4E763D4E5D63BC
1012WindowsUpdates.exeC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\8E9DF70E3B687FC46CF7DDE56FEC6D3BA885A0C0binary
MD5:78206A10E9B8A02B6071C4658547EFC0
SHA256:B7DA5D07A2232A5F7996761235F4DDF5D1439962826EEED59432A0CA3159D14E
4424powershell.exeC:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactivebinary
MD5:A8878D5E327C58A160468296A9669425
SHA256:C88719E2087EC183E45CC850940B9E3424222CDA17E2A2101990C9B41A4CC9DB
6512powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_4bzq3a52.vdi.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6512powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_adowwl0p.m0i.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6512powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_iynquuum.aae.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6512powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_tvsiky2v.juy.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6760powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_n4ti4rb1.mfm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
17
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2384
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2384
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2384
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.140
  • 40.126.32.138
  • 20.190.160.67
  • 40.126.32.74
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
omokta.com
  • 188.114.96.3
  • 188.114.97.3
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WindowsUpdates.exe