download:

/conhost.exe

Full analysis: https://app.any.run/tasks/b3ecbd44-a858-4b0b-8f32-e3b04325983a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 16, 2025, 17:52:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pastebin
miner
loader
winring0x64-sys
vuln-driver
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

C11A82D699A06D9B8BA4296E0C562AE4

SHA1:

FF473C680C4367E61B7B6816CDE476922F0EA446

SHA256:

31DDCA65A8F9EFC647AA7C5EA572E0DA24AC6D4CC557D3446F0B00CDB6D0803A

SSDEEP:

384:rAwJqGTIB8zYR/0r9OJrybCN906pXtM5ZFNwY9zmnlEh8aXl/syWDy9U:rAwJqG8ezYh0zbGqbFNwrOKaZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7364)
      • cmd.exe (PID: 7356)

    • Vulnerable driver has been detected

      • conhost.exe (PID: 3020)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • conhost.exe (PID: 3020)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5892)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 5892)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 5892)

    • Creates file in the systems drive root

      • conhost.exe (PID: 3020)

    • The process creates files with name similar to system file names

      • conhost.exe (PID: 3020)

    • Executable content was dropped or overwritten

      • conhost.exe (PID: 3020)

    • Crypto Currency Mining Activity Detected

      • conhost.exe (PID: 3020)

    • Drops a system driver (possible attempt to evade defenses)

      • conhost.exe (PID: 3020)

    • Potential Corporate Privacy Violation

      • conhost.exe (PID: 3020)

    • Process requests binary or script from the Internet

      • conhost.exe (PID: 3020)

    • Connects to the server without a host name

      • conhost.exe (PID: 3020)

  • INFO

    • Reads the computer name

      • conhost.exe (PID: 3020)

    • Checks supported languages

      • conhost.exe (PID: 3020)

    • Reads the machine GUID from the registry

      • conhost.exe (PID: 3020)

    • Creates files in the program directory

      • conhost.exe (PID: 3020)

    • Disables trace logs

      • conhost.exe (PID: 3020)

    • Checks proxy server information

      • conhost.exe (PID: 3020)

    • Reads the software policy settings

      • conhost.exe (PID: 3020)
      • slui.exe (PID: 5324)

    • Create files in a temporary directory

      • conhost.exe (PID: 3020)

    • The sample compiled with japanese language support

      • conhost.exe (PID: 3020)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6700)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6700)

    • Manual execution by a user

      • Taskmgr.exe (PID: 7872)
      • Taskmgr.exe (PID: 7928)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 7928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2051:12:11 03:03:22+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 18432
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0x663a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 10.0.19041.746
ProductVersionNumber: 10.0.19041.746
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Programs Engine
CompanyName: Microsoft® Windows®
FileDescription: Programs Engine
FileVersion: 10.0.19041.746
InternalName: Task32Main.exe
LegalCopyright: Copyright © 2021
LegalTrademarks: -
OriginalFileName: Task32Main.exe
ProductName: Programs Engine
ProductVersion: 10.0.19041.746
AssemblyVersion: 10.0.19041.746
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
17
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT conhost.exe sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs taskmgr.exe no specs taskmgr.exe slui.exe no specs rundll32.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1276"C:\Users\admin\Desktop\conhost.exe" C:\Users\admin\Desktop\conhost.exe—explorer.exe
User:
admin
Company:
Microsoft® Windows®
Integrity Level:
MEDIUM
Description:
Programs Engine
Exit code:
3221226540
Version:
10.0.19041.746
Modules
Images
c:\users\admin\desktop\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1512C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3020"C:\Users\admin\Desktop\conhost.exe" C:\Users\admin\Desktop\conhost.exe
explorer.exe
User:
admin
Company:
Microsoft® Windows®
Integrity Level:
HIGH
Description:
Programs Engine
Exit code:
4294967295
Version:
10.0.19041.746
Modules
Images
c:\users\admin\desktop\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5324"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5892"cmd.exe" /C powershell -EncodedCommand "PAAjAGQANQBKAGIAQQA5AFMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBLAFoAYwA4AHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgBIAFMAUwBEAFcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAOABaACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate offC:\Windows\SysWOW64\cmd.exe—conhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
4294967295
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5956\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6700powershell -EncodedCommand "PAAjAGQANQBKAGIAQQA5AFMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBLAFoAYwA4AHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgBIAFMAUwBEAFcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAOABaACMAPgA=" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7356"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\cmd.exe—conhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
4294967295
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7364"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk2839" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\cmd.exe—conhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7372\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 757
Read events
9 733
Write events
20
Delete events
4

Modification events

(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3020) conhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\conhost_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
1
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3020conhost.exeC:\ProgramData\HostData\logs.ucetext
MD5:1A4E05716C2A8B7A5F34172178340305
SHA256:FB42753CE0F515D7E4BF6B3C86895CC14FC59BE6A1A81D429A34B88F48286173
6700powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:62A2A133128885E328334E39723696C9
SHA256:1D610B40DED74CD1757842328B379E94728E0E2835AB3C0A48E4EC150BB1B9BD
6700powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qjrc31pe.fkd.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6700powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cio30ccu.2mx.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6700powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zifiw003.w2p.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6700powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ptbvgdfl.e1p.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7928Taskmgr.exeC:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
3020conhost.exeC:\ProgramData\Dllhost\winlogson.exeexecutable
MD5:B01E0542B6347C83D175F05241113C00
SHA256:570E825538F39197E73E50F1E477E59A87E76CE9E50B54B5D478AB9267319397
3020conhost.exeC:\Users\admin\AppData\Local\Temp\logs.ucetext
MD5:1A4E05716C2A8B7A5F34172178340305
SHA256:FB42753CE0F515D7E4BF6B3C86895CC14FC59BE6A1A81D429A34B88F48286173
3020conhost.exeC:\logs.ucetext
MD5:1A4E05716C2A8B7A5F34172178340305
SHA256:FB42753CE0F515D7E4BF6B3C86895CC14FC59BE6A1A81D429A34B88F48286173
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
15
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3020
conhost.exe
GET
—
185.215.113.51:80
http://185.215.113.51/xmrig.exe
unknown
—
—
malicious
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3020
conhost.exe
GET
200
185.215.113.51:80
http://185.215.113.51/WinRing0x64.sys
unknown
—
—
malicious
7748
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7748
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.172:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3020
conhost.exe
104.22.69.199:443
pastebin.com
CLOUDFLARENET
—
whitelisted
3020
conhost.exe
185.215.113.51:80
—
1337team Limited
SC
malicious
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.172
  • 23.48.23.171
  • 23.48.23.177
  • 23.48.23.170
  • 23.48.23.176
  • 23.48.23.179
  • 23.48.23.173
  • 23.48.23.175
  • 23.48.23.180
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.71
  • 20.190.159.0
  • 40.126.31.3
  • 20.190.159.68
  • 40.126.31.69
  • 40.126.31.130
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
pastebin.com
  • 104.22.69.199
  • 104.22.68.199
  • 172.67.25.94
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
3020
conhost.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
3020
conhost.exe
Crypto Currency Mining Activity Detected
MINER [ANY.RUN] Request Coinminer Xmrig
3020
conhost.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3020
conhost.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3020
conhost.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
3020
conhost.exe
Misc activity
ET INFO Packed Executable Download
3020
conhost.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3020
conhost.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
3020
conhost.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/conhost.exe