File name:

PatchMyPC.exe

Full analysis: https://app.any.run/tasks/fddcb9f8-d941-4acf-b8aa-f595c997ac44
Verdict: Malicious activity
Analysis date: March 23, 2025, 11:10:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

D82CB08C93ED60168A99727421EE2261

SHA1:

08EC5D854C07729E4890D81F29BC584451A996DF

SHA256:

2E8B16DA78D2207FD80C77715B6F2F236218D7BE15862194DFEB1DB0F540825E

SSDEEP:

49152:ooirjM+8I5iRo2rU+1+FmPqKmxKLJN+MTEUKKsH0KNC7QjxiiR/:o73iRo24lmSKWKLP+TUeH67Qj8iR/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • PatchMyPC.exe (PID: 4448)

    • Executing a file with an untrusted certificate

      • gacutil.exe (PID: 1912)

    • Changes the autorun value in the registry

      • VC_redist.x64.exe (PID: 7932)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • PatchMyPC.exe (PID: 4448)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)

    • Reads Microsoft Outlook installation path

      • PatchMyPC.exe (PID: 4448)

    • Reads the date of Windows installation

      • PatchMyPC.exe (PID: 4448)

    • Reads Internet Explorer settings

      • PatchMyPC.exe (PID: 4448)

    • Executable content was dropped or overwritten

      • PatchMyPC.exe (PID: 4448)
      • gacutil.exe (PID: 1912)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 1568)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)
      • VC_redist.x64.exe (PID: 7932)

    • Process drops legitimate windows executable

      • PatchMyPC.exe (PID: 4448)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 1568)
      • VC_redist.x64.exe (PID: 7932)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)

    • Starts a Microsoft application from unusual location

      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)
      • VC_redist.x64.exe (PID: 7932)

    • Searches for installed software

      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)
      • dllhost.exe (PID: 7976)
      • PatchMyPC.exe (PID: 4448)

    • Creates a software uninstall entry

      • VC_redist.x64.exe (PID: 7932)

    • Starts itself from another location

      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)

    • Executes as Windows Service

      • VSSVC.exe (PID: 8016)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7544)

  • INFO

    • Reads the machine GUID from the registry

      • PatchMyPC.exe (PID: 4448)
      • gacutil.exe (PID: 1912)
      • VC_redist.x64.exe (PID: 7932)
      • msiexec.exe (PID: 7544)

    • Creates files or folders in the user directory

      • PatchMyPC.exe (PID: 4448)
      • BackgroundTransferHost.exe (PID: 8040)
      • msiexec.exe (PID: 7544)

    • Reads the software policy settings

      • PatchMyPC.exe (PID: 4448)
      • BackgroundTransferHost.exe (PID: 8040)
      • msiexec.exe (PID: 7544)

    • Reads Environment values

      • PatchMyPC.exe (PID: 4448)

    • Reads the computer name

      • PatchMyPC.exe (PID: 4448)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 1568)
      • VC_redist.x64.exe (PID: 7932)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)
      • msiexec.exe (PID: 7544)

    • Checks supported languages

      • PatchMyPC.exe (PID: 4448)
      • gacutil.exe (PID: 1912)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 1568)
      • VC_redist.x64.exe (PID: 7932)
      • msiexec.exe (PID: 7544)

    • Disables trace logs

      • PatchMyPC.exe (PID: 4448)

    • Process checks computer location settings

      • PatchMyPC.exe (PID: 4448)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)

    • Checks proxy server information

      • PatchMyPC.exe (PID: 4448)
      • BackgroundTransferHost.exe (PID: 8040)

    • The sample compiled with english language support

      • PatchMyPC.exe (PID: 4448)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 1568)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)
      • VC_redist.x64.exe (PID: 7932)

    • Create files in a temporary directory

      • PatchMyPC.exe (PID: 4448)
      • C++ 2022 Redist. 14.42.34438.0 (x64).exe (PID: 2092)
      • VC_redist.x64.exe (PID: 7932)

    • Detects AutoHotkey samples (YARA)

      • PatchMyPC.exe (PID: 4448)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7820)
      • BackgroundTransferHost.exe (PID: 8040)
      • BackgroundTransferHost.exe (PID: 728)
      • BackgroundTransferHost.exe (PID: 1532)
      • BackgroundTransferHost.exe (PID: 7716)

    • Creates files in the program directory

      • VC_redist.x64.exe (PID: 7932)

    • Manages system restore points

      • SrTasks.exe (PID: 7252)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:13 07:58:05+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 2596864
InitializedDataSize: 57856
UninitializedDataSize: -
EntryPoint: 0x27bff6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.5.0.5
ProductVersionNumber: 0.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Third-Party App Updater
CompanyName: Patch My PC, LLC
FileDescription: Patch My PC
FileVersion: 4.5.0.5
InternalName: PatchMyPC.exe
LegalCopyright: Copyright © Patch My PC, LLC
LegalTrademarks: -
OriginalFileName: PatchMyPC.exe
ProductName: Patch My PC
ProductVersion: 0.0.0.1
AssemblyVersion: 4.5.0.5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
19
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start patchmypc.exe sppextcomobj.exe no specs slui.exe no specs gacutil.exe conhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs c++ 2022 redist. 14.42.34438.0 (x64).exe c++ 2022 redist. 14.42.34438.0 (x64).exe vc_redist.x64.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe patchmypc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—gacutil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1532"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1568"C:\PatchMyPCUpdates\C++ 2022 Redist. 14.42.34438.0 (x64).exe" /install /quiet /norestartC:\PatchMyPCUpdates\C++ 2022 Redist. 14.42.34438.0 (x64).exe
PatchMyPC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34438
Version:
14.42.34438.0
Modules
Images
c:\patchmypcupdates\c++ 2022 redist. 14.42.34438.0 (x64).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1912"C:\Users\admin\AppData\Roaming\PatchMyPC\gacutil.exe" /i C:\Users\admin\AppData\Roaming\PatchMyPC\Microsoft.Win32.TaskScheduler.dllC:\Users\admin\AppData\Roaming\PatchMyPC\gacutil.exe
PatchMyPC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) .NET Framework Global Assembly Cache Utility
Exit code:
0
Version:
4.0.30319.33440 built by: FX45W81RTMREL
Modules
Images
c:\users\admin\appdata\roaming\patchmypc\gacutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2092"C:\WINDOWS\Temp\{669C1221-D663-4836-AA96-1EB887198D38}\.cr\C++ 2022 Redist. 14.42.34438.0 (x64).exe" -burn.clean.room="C:\PatchMyPCUpdates\C++ 2022 Redist. 14.42.34438.0 (x64).exe" -burn.filehandle.attached=592 -burn.filehandle.self=596 /install /quiet /norestartC:\Windows\Temp\{669C1221-D663-4836-AA96-1EB887198D38}\.cr\C++ 2022 Redist. 14.42.34438.0 (x64).exe
C++ 2022 Redist. 14.42.34438.0 (x64).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34438
Version:
14.42.34438.0
Modules
Images
c:\windows\temp\{669c1221-d663-4836-aa96-1eb887198d38}\.cr\c++ 2022 redist. 14.42.34438.0 (x64).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3956"C:\Users\admin\AppData\Local\Temp\PatchMyPC.exe" C:\Users\admin\AppData\Local\Temp\PatchMyPC.exe—explorer.exe
User:
admin
Company:
Patch My PC, LLC
Integrity Level:
MEDIUM
Description:
Patch My PC
Exit code:
3221226540
Version:
4.5.0.5
Modules
Images
c:\users\admin\appdata\local\temp\patchmypc.exe
c:\windows\system32\ntdll.dll
4448"C:\Users\admin\AppData\Local\Temp\PatchMyPC.exe" C:\Users\admin\AppData\Local\Temp\PatchMyPC.exe
explorer.exe
User:
admin
Company:
Patch My PC, LLC
Integrity Level:
HIGH
Description:
Patch My PC
Version:
4.5.0.5
Modules
Images
c:\users\admin\appdata\local\temp\patchmypc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5056C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6744"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
13 893
Read events
13 677
Write events
205
Delete events
11

Modification events

(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4448) PatchMyPC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PatchMyPC_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
16
Suspicious files
7
Text files
38
Unknown types
0

Dropped files

PID
Process
Filename
Type
4448PatchMyPC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB —
MD5:—
SHA256:—
4448PatchMyPC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 —
MD5:—
SHA256:—
4448PatchMyPC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6C6ABF5B95E12F43EA8BA7E809010C70 —
MD5:—
SHA256:—
4448PatchMyPC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6C6ABF5B95E12F43EA8BA7E809010C70 —
MD5:—
SHA256:—
4448PatchMyPC.exeC:\Users\admin\AppData\Local\Temp\PatchMyPC.log —
MD5:—
SHA256:—
4448PatchMyPC.exeC:\Users\admin\AppData\Local\Temp\Home Updater\definitions.xml —
MD5:—
SHA256:—
4448PatchMyPC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_44B7CEC7D7846BA12D21890D7AF2D759 —
MD5:—
SHA256:—
4448PatchMyPC.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_44B7CEC7D7846BA12D21890D7AF2D759 —
MD5:—
SHA256:—
1912gacutil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log —
MD5:—
SHA256:—
8040BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
39
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4448
PatchMyPC.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
4448
PatchMyPC.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
4448
PatchMyPC.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAzDcPO1O1GePB79c2utY6I%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4448
PatchMyPC.exe
GET
301
104.22.68.185:80
http://patchmypc.com/freeupdater/definitions/definitions.xml
unknown
—
—
malicious
4448
PatchMyPC.exe
GET
301
104.22.68.185:80
http://patchmypc.com/redirect.htm?V=4.5.0.5&OS=Win10&SILENT=0
unknown
—
—
unknown
4448
PatchMyPC.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAFnjx%2FviCJV2LCnDmt7siA%3D
unknown
—
—
whitelisted
4448
PatchMyPC.exe
GET
301
104.22.68.185:80
http://patchmypc.com/freeupdater/definitions/definitions.xml
unknown
—
—
malicious
4448
PatchMyPC.exe
GET
301
104.21.80.1:80
http://patchmypc.net/redirected.htm?source=app
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4448
PatchMyPC.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4448
PatchMyPC.exe
104.22.68.185:443
patchmypc.com
CLOUDFLARENET
—
unknown
4448
PatchMyPC.exe
104.22.68.185:80
patchmypc.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.1
  • 20.190.159.23
  • 40.126.31.128
  • 20.190.159.71
  • 40.126.31.129
  • 40.126.31.0
  • 40.126.31.71
whitelisted
patchmypc.com
  • 104.22.68.185
  • 172.67.7.92
  • 104.22.69.185
unknown
patchmypc.net
  • 104.21.80.1
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.16.1
  • 104.21.96.1
  • 104.21.48.1
  • 104.21.64.1
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.19.96.83
  • 2.19.96.128
  • 2.19.96.120
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PatchMyPC.exe