File name:

PatchMyPC.exe

Full analysis: https://app.any.run/tasks/0c288232-bfc7-42d3-97f2-5a1b1b4a2122
Verdict: Malicious activity
Analysis date: April 06, 2025, 17:12:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

D82CB08C93ED60168A99727421EE2261

SHA1:

08EC5D854C07729E4890D81F29BC584451A996DF

SHA256:

2E8B16DA78D2207FD80C77715B6F2F236218D7BE15862194DFEB1DB0F540825E

SSDEEP:

49152:ooirjM+8I5iRo2rU+1+FmPqKmxKLJN+MTEUKKsH0KNC7QjxiiR/:o73iRo24lmSKWKLP+TUeH67Qj8iR/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • runas.exe (PID: 1276)

    • Executing a file with an untrusted certificate

      • gacutil.exe (PID: 6028)

    • Changes the autorun value in the registry

      • VC_redist.x64.exe (PID: 2984)
      • VC_redist.x86.exe (PID: 4428)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • PatchMyPC.exe (PID: 744)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2908)
      • VC_redist.x64.exe (PID: 8012)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 7256)

    • Executable content was dropped or overwritten

      • PatchMyPC.exe (PID: 744)
      • gacutil.exe (PID: 6028)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 5964)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2908)
      • VC_redist.x64.exe (PID: 2984)
      • VC_redist.x64.exe (PID: 8012)
      • VC_redist.x64.exe (PID: 8060)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 8172)
      • VC_redist.x86.exe (PID: 4428)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 7256)

    • Process drops legitimate windows executable

      • PatchMyPC.exe (PID: 744)
      • msiexec.exe (PID: 7820)
      • VC_redist.x64.exe (PID: 8060)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 8172)
      • VC_redist.x86.exe (PID: 4428)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 7256)

    • Reads Microsoft Outlook installation path

      • PatchMyPC.exe (PID: 744)

    • Reads the date of Windows installation

      • PatchMyPC.exe (PID: 744)

    • Reads Internet Explorer settings

      • PatchMyPC.exe (PID: 744)

    • Starts itself from another location

      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2908)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 7256)

    • Starts a Microsoft application from unusual location

      • VC_redist.x64.exe (PID: 2984)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2908)
      • VC_redist.x86.exe (PID: 4428)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 7256)

    • Creates a software uninstall entry

      • VC_redist.x64.exe (PID: 2984)
      • VC_redist.x86.exe (PID: 4428)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5176)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7820)

    • The process checks if it is being run in the virtual environment

      • msiexec.exe (PID: 7820)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7820)

    • Searches for installed software

      • dllhost.exe (PID: 4756)
      • VC_redist.x64.exe (PID: 8060)
      • VC_redist.x64.exe (PID: 8012)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 7256)
      • VC_redist.x86.exe (PID: 4428)
      • PatchMyPC.exe (PID: 744)

    • Application launched itself

      • VC_redist.x64.exe (PID: 7988)
      • VC_redist.x64.exe (PID: 8012)

    • Starts another process probably with elevated privileges via RUNAS.EXE

      • runas.exe (PID: 1276)

  • INFO

    • Reads the software policy settings

      • PatchMyPC.exe (PID: 744)
      • msiexec.exe (PID: 7820)

    • Checks supported languages

      • PatchMyPC.exe (PID: 744)
      • gacutil.exe (PID: 6028)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 5964)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2908)
      • VC_redist.x64.exe (PID: 2984)
      • msiexec.exe (PID: 7820)
      • VC_redist.x64.exe (PID: 7988)
      • VC_redist.x64.exe (PID: 8012)
      • VC_redist.x64.exe (PID: 8060)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 8172)
      • VC_redist.x86.exe (PID: 4428)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 7256)

    • Disables trace logs

      • PatchMyPC.exe (PID: 744)

    • Reads Environment values

      • PatchMyPC.exe (PID: 744)

    • Reads the computer name

      • PatchMyPC.exe (PID: 744)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 5964)
      • VC_redist.x64.exe (PID: 2984)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2908)
      • msiexec.exe (PID: 7820)
      • VC_redist.x64.exe (PID: 8012)
      • VC_redist.x64.exe (PID: 8060)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 8172)
      • VC_redist.x86.exe (PID: 4428)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 7256)

    • Reads the machine GUID from the registry

      • PatchMyPC.exe (PID: 744)
      • gacutil.exe (PID: 6028)
      • VC_redist.x64.exe (PID: 2984)
      • msiexec.exe (PID: 7820)
      • VC_redist.x86.exe (PID: 4428)

    • Checks proxy server information

      • PatchMyPC.exe (PID: 744)

    • The sample compiled with english language support

      • PatchMyPC.exe (PID: 744)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2908)
      • msiexec.exe (PID: 7820)
      • VC_redist.x64.exe (PID: 8012)
      • VC_redist.x64.exe (PID: 8060)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 8172)
      • C++ 2022 Redist. 14.42.34438.0 (x86).exe (PID: 7256)
      • VC_redist.x86.exe (PID: 4428)

    • Manages system restore points

      • SrTasks.exe (PID: 7728)

    • Creates files in the program directory

      • VC_redist.x64.exe (PID: 2984)
      • VC_redist.x86.exe (PID: 4428)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7820)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:13 07:58:05+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 2596864
InitializedDataSize: 57856
UninitializedDataSize: -
EntryPoint: 0x27bff6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.5.0.5
ProductVersionNumber: 0.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Third-Party App Updater
CompanyName: Patch My PC, LLC
FileDescription: Patch My PC
FileVersion: 4.5.0.5
InternalName: PatchMyPC.exe
LegalCopyright: Copyright © Patch My PC, LLC
LegalTrademarks: -
OriginalFileName: PatchMyPC.exe
ProductName: Patch My PC
ProductVersion: 0.0.0.1
AssemblyVersion: 4.5.0.5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
22
Malicious processes
12
Suspicious processes
1

Behavior graph

Click at the process to see the details
start runas.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs patchmypc.exe gacutil.exe conhost.exe no specs c++ 2022 redist. 14.42.34438.0 (x64).exe c++ 2022 redist. 14.42.34438.0 (x64).exe vc_redist.x64.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe vc_redist.x64.exe no specs vc_redist.x64.exe vc_redist.x64.exe c++ 2022 redist. 14.42.34438.0 (x86).exe c++ 2022 redist. 14.42.34438.0 (x86).exe vc_redist.x86.exe SPPSurrogate no specs

Process information

PID
CMD
Path
Indicators
Parent process
744C:\Users\admin\Desktop\PatchMyPC.exeC:\Users\admin\Desktop\PatchMyPC.exe
runas.exe
User:
Administrator
Company:
Patch My PC, LLC
Integrity Level:
HIGH
Description:
Patch My PC
Version:
4.5.0.5
Modules
Images
c:\users\admin\desktop\patchmypc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
904"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1132C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1276"C:\Windows\System32\runas.exe" /user:administrator C:\Users\admin\Desktop\PatchMyPC.exeC:\Windows\System32\runas.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Run As Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runas.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2908"C:\WINDOWS\Temp\{1F1B4E48-FB01-473F-8FCC-B1B75236266E}\.cr\C++ 2022 Redist. 14.42.34438.0 (x64).exe" -burn.clean.room="C:\PatchMyPCUpdates\C++ 2022 Redist. 14.42.34438.0 (x64).exe" -burn.filehandle.attached=580 -burn.filehandle.self=576 /install /quiet /norestartC:\Windows\Temp\{1F1B4E48-FB01-473F-8FCC-B1B75236266E}\.cr\C++ 2022 Redist. 14.42.34438.0 (x64).exe
C++ 2022 Redist. 14.42.34438.0 (x64).exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34438
Exit code:
3010
Version:
14.42.34438.0
Modules
Images
c:\windows\temp\{1f1b4e48-fb01-473f-8fcc-b1b75236266e}\.cr\c++ 2022 redist. 14.42.34438.0 (x64).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2984"C:\WINDOWS\Temp\{EC146DFD-1A59-4EEC-A936-CF806C940A98}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8557C688-218C-40DF-AF81-50D5ABB11EE4} {FFBCE3D1-F535-4852-BE07-82EE355206B7} 2908C:\Windows\Temp\{EC146DFD-1A59-4EEC-A936-CF806C940A98}\.be\VC_redist.x64.exe
C++ 2022 Redist. 14.42.34438.0 (x64).exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34438
Exit code:
3010
Version:
14.42.34438.0
Modules
Images
c:\windows\temp\{ec146dfd-1a59-4eec-a936-cf806c940a98}\.be\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4428"C:\WINDOWS\Temp\{66D20B06-5D30-4CBD-8590-EA31DD6115F7}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9B660AC4-C17F-45BF-8C7D-BE85D65D4FC5} {C8DBC100-A654-4777-BF38-215D7CF51F84} 7256C:\Windows\Temp\{66D20B06-5D30-4CBD-8590-EA31DD6115F7}\.be\VC_redist.x86.exe
C++ 2022 Redist. 14.42.34438.0 (x86).exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34438
Version:
14.42.34438.0
Modules
Images
c:\windows\temp\{66d20b06-5d30-4cbd-8590-ea31dd6115f7}\.be\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4756C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
5176\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—runas.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5176C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
22 325
Read events
20 931
Write events
906
Delete events
488

Modification events

(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Patch My PC
Operation:writeName:PATH
Value:
C:\Users\admin\Desktop\PatchMyPC.exe
(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(744) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
107
Suspicious files
98
Text files
106
Unknown types
0

Dropped files

PID
Process
Filename
Type
744PatchMyPC.exeC:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6C6ABF5B95E12F43EA8BA7E809010C70binary
MD5:006B0E35178492BD6ED2AA9BD72ADBFB
SHA256:5A40AF0BE2AFA5E5125A074DF9AC11F94BA755957805CDF78549DA4D0AECA956
744PatchMyPC.exeC:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:261354E2FAB7329810F3EAE9685DEE14
SHA256:30282BE3FA4B12951F9557C2F716560A8377EF6501B55D19CA4DD6F99E2FC766
6028gacutil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.logtext
MD5:54D293AB0750418B1E56177538C8A2E3
SHA256:4CB207B404F352E56228B973AE050A263076C5C2E0BAC592F47580D644D0DCD6
744PatchMyPC.exeC:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:36793A407347E8594BB44A7A0CEF946F
SHA256:D95CAD417B24F3BE3BA2F6981483EDE0E74E08262E3B3B1D6246EAE2A6EFEEBF
6028gacutil.exeC:\Windows\assembly\tmp\KJPRON0V\Microsoft.Win32.TaskScheduler.dllexecutable
MD5:E4A7B55E9F8C52B356E264C347035CD5
SHA256:F3C2D5A2DB68B9E6CA161AC126BB8FA47B5889D5786B5DDB28F9193DD500C87D
744PatchMyPC.exeC:\Users\Administrator\AppData\Local\Patch_My_PC,_LLC\PatchMyPC.exe_Url_x2jphuauuadx1ep3qdt5gyt404nsjjk0\4.5.0.5\zbyifvd5.newcfgxml
MD5:CB3C14197FA98FF4B8BB82070C50F79F
SHA256:B1831E9F8DEDC3B1C003AEE2F7DE4ED395352B014408B2E3FB8A42C24096E078
744PatchMyPC.exeC:\Users\Administrator\AppData\Roaming\PatchMyPC\gacutil.exe.configxml
MD5:7033A6FA2F8A457716F6D642137CC7DB
SHA256:D1E116F59C6CF832090DA36F95725827A7F5EDB3173CBCE13FFEDC4FB6B61D2E
744PatchMyPC.exeC:\Users\Administrator\AppData\Roaming\PatchMyPC\gacutil.exeexecutable
MD5:4DA261A56B625BC2F8D4AE2E59F85E2F
SHA256:2F53F6A2024128E750F21B98607328DAC6238D675E0B44EF3D540F4E61A28AD8
744PatchMyPC.exeC:\Users\Administrator\AppData\Roaming\PatchMyPC\Microsoft.Win32.TaskScheduler.dllexecutable
MD5:E4A7B55E9F8C52B356E264C347035CD5
SHA256:F3C2D5A2DB68B9E6CA161AC126BB8FA47B5889D5786B5DDB28F9193DD500C87D
744PatchMyPC.exeC:\Users\Administrator\AppData\Local\Temp\Home Updater\definitions.xmltext
MD5:6D1D67EF2294B6546B92D835F5603B5F
SHA256:F1418C10C532BFA3F25141DA246EDD498B55972F8FFAD50DDFC8F2B2CDCF0F92
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
38
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
744
PatchMyPC.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAzDcPO1O1GePB79c2utY6I%3D
unknown
—
—
whitelisted
744
PatchMyPC.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
744
PatchMyPC.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAFnjx%2FviCJV2LCnDmt7siA%3D
unknown
—
—
whitelisted
744
PatchMyPC.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
7412
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7412
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
744
PatchMyPC.exe
GET
301
172.67.7.92:80
http://patchmypc.com/freeupdater/definitions/definitions.xml
unknown
—
—
malicious
744
PatchMyPC.exe
GET
301
172.67.7.92:80
http://patchmypc.com/redirect.htm?V=4.5.0.5&OS=Win10&SILENT=0
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.172.255.218:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
744
PatchMyPC.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
744
PatchMyPC.exe
172.67.7.92:443
patchmypc.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 23.216.77.38
  • 23.216.77.9
  • 23.216.77.7
  • 23.216.77.30
  • 23.216.77.42
  • 23.216.77.4
  • 23.216.77.6
  • 23.216.77.34
  • 23.216.77.37
  • 2.16.241.19
  • 2.16.241.12
whitelisted
client.wns.windows.com
  • 172.172.255.218
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.131
  • 40.126.31.73
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.2
  • 20.190.159.23
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
patchmypc.com
  • 172.67.7.92
  • 104.22.68.185
  • 104.22.69.185
unknown
patchmypc.net
  • 104.21.48.1
  • 104.21.32.1
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.64.1
whitelisted
aka.ms
  • 184.30.22.2
whitelisted
download.visualstudio.microsoft.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted

Threats

No threats detected
Process
Message
msiexec.exe
Failed to release Service
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PatchMyPC.exe