File name:

jjsploit.exe

Full analysis: https://app.any.run/tasks/e48858c5-1662-427b-bc0d-0a630db71dd5
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: March 07, 2026, 21:32:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
xmrig
miner
winring0-sys
vuln-driver
rust
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

0F041C4D1FAD40C89A49750B03A2101C

SHA1:

D18CE17258792022233832590410042C338B1524

SHA256:

35908CA091E20999B1C3A36A8B06D78C3534B03976673855F319787967AFC168

SSDEEP:

98304:c8FM4JzjlnJCWxvRU+f3uX5eIuVkI+lx4dm0mjtubmVFo67JNbuhJLrmRz86m5vx:AXsAOH8jata

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds extension to the Windows Defender exclusion list

      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Changes Windows Defender settings

      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • XMRIG has been detected

      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Uninstalls Malicious Software Removal Tool (MRT)

      • cmd.exe (PID: 5588)
      • cmd.exe (PID: 3952)

    • Vulnerable driver has been detected

      • uylmhmydmfsb.exe (PID: 9148)

    • XMRIG has been detected (YARA)

      • explorer.exe (PID: 8736)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • jjsploit.exe (PID: 412)
      • jjsploit.exe (PID: 7884)

    • Checks for external IP

      • jjsploit.exe (PID: 412)
      • svchost.exe (PID: 2292)
      • jjsploit.exe (PID: 7884)

    • Application launched itself

      • jjsploit.exe (PID: 412)

    • Executable content was dropped or overwritten

      • jjsploit.exe (PID: 7884)
      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Manipulates environment variables

      • powershell.exe (PID: 8380)
      • powershell.exe (PID: 2368)

    • Script adds exclusion path to Windows Defender

      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Script adds exclusion extension to Windows Defender

      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Starts POWERSHELL.EXE for commands execution

      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Starts CMD.EXE for commands execution

      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Stops a currently running service

      • sc.exe (PID: 7304)
      • sc.exe (PID: 8660)
      • sc.exe (PID: 8920)
      • sc.exe (PID: 7312)
      • sc.exe (PID: 8256)
      • sc.exe (PID: 3636)
      • sc.exe (PID: 8716)
      • sc.exe (PID: 6864)
      • sc.exe (PID: 132)
      • sc.exe (PID: 5484)
      • sc.exe (PID: 4468)

    • Starts SC.EXE for service management

      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Suspicious power configuration changes

      • powercfg.exe (PID: 1068)
      • powercfg.exe (PID: 6156)
      • powercfg.exe (PID: 4136)
      • powercfg.exe (PID: 824)
      • powercfg.exe (PID: 7684)
      • powercfg.exe (PID: 7548)
      • powercfg.exe (PID: 2392)
      • powercfg.exe (PID: 4220)

    • Uses powercfg.exe to modify the power settings

      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Process uninstalls Windows update

      • wusa.exe (PID: 3348)
      • wusa.exe (PID: 8912)

    • Windows service management via SC.EXE

      • sc.exe (PID: 1368)
      • sc.exe (PID: 6632)

    • Executes as Windows Service

      • uylmhmydmfsb.exe (PID: 9148)

    • Deletes a service using sc.exe

      • sc.exe (PID: 1368)

    • Creates a new Windows service

      • sc.exe (PID: 3552)

    • Drops a system driver (possible attempt to evade defenses)

      • uylmhmydmfsb.exe (PID: 9148)

  • INFO

    • Reads the machine GUID from the registry

      • jjsploit.exe (PID: 412)
      • jjsploit.exe (PID: 7884)

    • Reads the computer name

      • jjsploit.exe (PID: 412)
      • jjsploit.exe (PID: 7884)
      • jjsploit.exe (PID: 5920)
      • RuntimeBroker.exe (PID: 468)

    • Checks supported languages

      • jjsploit.exe (PID: 412)
      • jjsploit.exe (PID: 7884)
      • RuntimeBroker.exe (PID: 468)
      • jjsploit.exe (PID: 5920)
      • BIOS.exe (PID: 5768)
      • uylmhmydmfsb.exe (PID: 9148)

    • Disables trace logs

      • jjsploit.exe (PID: 412)
      • jjsploit.exe (PID: 7884)

    • Reads Environment values

      • jjsploit.exe (PID: 412)
      • jjsploit.exe (PID: 7884)

    • Process checks computer location settings

      • jjsploit.exe (PID: 412)
      • jjsploit.exe (PID: 7884)

    • Checks proxy server information

      • jjsploit.exe (PID: 412)
      • jjsploit.exe (PID: 7884)
      • slui.exe (PID: 7360)

    • Reads security settings of Internet Explorer

      • jjsploit.exe (PID: 412)
      • jjsploit.exe (PID: 7884)

    • Create files in a temporary directory

      • jjsploit.exe (PID: 7884)

    • The sample compiled with english language support

      • jjsploit.exe (PID: 7884)
      • BIOS.exe (PID: 5768)

    • There is functionality for taking screenshot (YARA)

      • jjsploit.exe (PID: 5920)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8380)
      • powershell.exe (PID: 2368)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 8380)
      • powershell.exe (PID: 2368)

    • Application based on Rust

      • jjsploit.exe (PID: 5920)

    • Creates files in the program directory

      • BIOS.exe (PID: 5768)

    • Application launched itself

      • firefox.exe (PID: 9040)
      • firefox.exe (PID: 6784)

    • UPX packer has been detected

      • explorer.exe (PID: 8736)

    • Manual execution by a user

      • firefox.exe (PID: 9040)

    • The sample compiled with japanese language support

      • uylmhmydmfsb.exe (PID: 9148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2026:03:04 16:50:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 7246336
InitializedDataSize: 198144
UninitializedDataSize: -
EntryPoint: 0x6eb11e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: jjsploit.exe
LegalCopyright:
OriginalFileName: jjsploit.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
223
Monitored processes
76
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start jjsploit.exe svchost.exe jjsploit.exe runtimebroker.exe no specs jjsploit.exe #XMRIG bios.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs #XMRIG uylmhmydmfsb.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #XMRIG explorer.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs slui.exe firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132C:\WINDOWS\system32\sc.exe stop wuauservC:\Windows\System32\sc.exe—uylmhmydmfsb.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
412"C:\Users\admin\Desktop\jjsploit.exe" C:\Users\admin\Desktop\jjsploit.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\jjsploit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
468"C:\Users\admin\AppData\Local\Temp\RuntimeBroker.exe" C:\Users\admin\AppData\Local\Temp\RuntimeBroker.exe—jjsploit.exe
User:
admin
Company:
Rainmeter
Integrity Level:
HIGH
Description:
OBS Studio Update
Exit code:
371
Version:
82.160.52.59
Modules
Images
c:\users\admin\appdata\local\temp\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
468\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
476\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
824C:\WINDOWS\system32\powercfg.exe /x -standby-timeout-dc 0C:\Windows\System32\powercfg.exe—BIOS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1068C:\WINDOWS\system32\powercfg.exe /x -hibernate-timeout-ac 0C:\Windows\System32\powercfg.exe—BIOS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1200"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3268 -prefsLen 37207 -prefMapHandle 3272 -prefMapSize 272981 -jsInitHandle 3276 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 3284 -initialChannelId {46dc7e6e-b38c-410f-9e22-ec7c2c7db04a} -parentPid 6784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\bcrypt.dll
1368C:\WINDOWS\system32\sc.exe delete "IMJLTCOM"C:\Windows\System32\sc.exe—BIOS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1488\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
19 704
Read events
19 688
Write events
16
Delete events
0

Modification events

(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(412) jjsploit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\jjsploit_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
5
Suspicious files
173
Text files
51
Unknown types
0

Dropped files

PID
Process
Filename
Type
6784firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
7884jjsploit.exeC:\Users\admin\AppData\Local\Temp\jjsploit.exeexecutable
MD5:4B12A930454ED4B77C65E45256A578AC
SHA256:47EA99CB494000179CAF25D18F107BA95A8BC4730CA711DB5E488B8D8B0E77E2
8380powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pbrfg0oz.ykz.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7884jjsploit.exeC:\Users\admin\AppData\Local\Temp\BIOS.exeexecutable
MD5:109F81B6E1995882016F9E1C85B4C64E
SHA256:0B10E483AB7004DCB85BC510E1CAD6546BA65BCCD7CBED2C0A13473992372654
8380powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_z4eljxz4.eqv.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7884jjsploit.exeC:\Users\admin\AppData\Local\Temp\RuntimeBroker.exeexecutable
MD5:AE824CC63A30DEF0E29CC0D521B7EEDC
SHA256:0B9B935CEBDD90CA314FE3AF5E4B4EE405791E244F8B3271D20D635361198D47
8380powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:CBE56F780DA68E3921A716340B56BA45
SHA256:8DE8B782FBE50630EC7A8E49B9A7D0B337A8C14B37155E9EB8C83ABDE6341CE6
2368powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_rgo332m0.ph1.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8380powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_33bhvwe4.43d.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5768BIOS.exeC:\ProgramData\pslsmxotenrp\uylmhmydmfsb.exeexecutable
MD5:109F81B6E1995882016F9E1C85B4C64E
SHA256:0B10E483AB7004DCB85BC510E1CAD6546BA65BCCD7CBED2C0A13473992372654
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
80
TCP/UDP connections
77
DNS requests
77
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6768
MoUsoCoreWorker.exe
GET
304
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
8372
SIHClient.exe
GET
304
135.233.95.144:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
8372
SIHClient.exe
GET
200
135.233.95.135:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
412
jjsploit.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
US
text
6 b
malicious
8372
SIHClient.exe
GET
200
135.233.95.144:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
356
svchost.exe
POST
200
20.190.159.0:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
2600
svchost.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
8372
SIHClient.exe
GET
304
135.233.95.144:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
356
svchost.exe
POST
400
20.190.159.0:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
356
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
2600
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8736
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
412
jjsploit.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
356
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
356
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7884
jjsploit.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 104.208.16.92
whitelisted
google.com
  • 142.251.36.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.131
  • 40.126.31.1
  • 20.190.159.129
  • 40.126.31.67
  • 20.190.159.130
  • 20.190.159.23
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.22
  • 23.216.77.20
  • 23.216.77.36
  • 23.216.77.6
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
slscr.update.microsoft.com
  • 135.233.95.144
whitelisted

Threats

PID
Process
Class
Message
2292
svchost.exe
Misc activity
INFO [ANY.RUN] External IP Check (ip-api .com)
2292
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
412
jjsploit.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
412
jjsploit.exe
A Network Trojan was detected
ET MALWARE Common Stealer Behavior - Source IP Associated with Hosting Provider Check via ip.api .com
7884
jjsploit.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2600
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2292
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2292
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2292
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6784
firefox.exe
Device Retrieving External IP Address Detected
ET INFO Observed External IP Lookup Domain (ip-api .com) in TLS SNI
Process
Message
jjsploit.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
jjsploit.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
jjsploit.exe