File name:

moo.exe

Full analysis: https://app.any.run/tasks/025feb26-75f6-49bd-8135-9087fe833734
Verdict: Malicious activity
Analysis date: February 19, 2026, 04:37:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

7FB8DE3E953DDF6A23C34C4FD020E28E

SHA1:

A35487D795488A88C5D0D90D77E0A5275484AA54

SHA256:

3FE66EA3D2B6EA9D377BDE1A67DB7EF82123DD28DA10E37EBD3E7B51C2525609

SSDEEP:

98304:bTO3SXZY2C972W78d72nXoGBsgi82xumzy72m3SH0bVGMvLzDv6AE3ANBpc7+mSt:C4gjs3jwHEEHdWPI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops python dynamic module

      • moo.exe (PID: 7324)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)

    • Application launched itself

      • moo.exe (PID: 7324)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)

    • Loads Python modules

      • moo.exe (PID: 6980)
      • moo.exe (PID: 7448)
      • moo.exe (PID: 5148)
      • moo.exe (PID: 5780)
      • moo.exe (PID: 7204)
      • moo.exe (PID: 9112)
      • moo.exe (PID: 1960)
      • moo.exe (PID: 3232)
      • moo.exe (PID: 8820)
      • moo.exe (PID: 2684)
      • moo.exe (PID: 9056)

  • INFO

    • Checks supported languages

      • moo.exe (PID: 7324)
      • moo.exe (PID: 6980)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 7448)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 5148)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 5780)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 7204)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 9112)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1960)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3232)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 8820)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 2684)
      • moo.exe (PID: 9056)
      • moo.exe (PID: 6936)

    • Reads the computer name

      • moo.exe (PID: 7324)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)

    • Create files in a temporary directory

      • moo.exe (PID: 7324)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)

    • Checks proxy server information

      • slui.exe (PID: 6272)

    • Manual execution by a user

      • moo.exe (PID: 7292)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:01:05 20:28:56+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.44
CodeSize: 184832
InitializedDataSize: 461312
UninitializedDataSize: -
EntryPoint: 0xcf30
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
192
Monitored processes
34
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
1068"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1672"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1960"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe—moo.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1984\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—moo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2288\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—moo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2684"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe—moo.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3232"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe—moo.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3976"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4796\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—moo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4804"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
4 177
Read events
4 177
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
231

Dropped files

PID
Process
Filename
Type
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\_lzma.pydbinary
MD5:B86B9F292AF12006187EBE6C606A377D
SHA256:F5E01B516C2C23035F7703E23569DEC26C5616C05A929B2580AE474A5C6722C5
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\cryptography-46.0.3.dist-info\INSTALLERbinary
MD5:45210DA832F9626829457A65E9E7C4D0
SHA256:E6184CE10E266134FDCFA401E8F1A95005BCD4F18D16B62B757323E2833FE9A9
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\cryptography-46.0.3.dist-info\METADATAbinary
MD5:F48CBB569521D70FCA5EB61242154D72
SHA256:6F1D8BC82126395502F051F986C18465EC163E2668208613AB484CF66BBDAF8B
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\cryptography-46.0.3.dist-info\RECORDbinary
MD5:40D6987B80F1873AAF407061DD50F83E
SHA256:DD540E0209F19C05A0DF792F90934B6D88CC3158ECDE844B4CCFDD03C83C025E
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\base_library.zipbinary
MD5:52F59304ED19D6476E6F5849D3E091BC
SHA256:304C41B2D0AE0EB627570A3619B7F6FC646D6B90C222C6B05B6EB250C683C038
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\cryptography-46.0.3.dist-info\licenses\LICENSEbinary
MD5:8C3617DB4FB6FAE01F1D253AB91511E4
SHA256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\cryptography-46.0.3.dist-info\WHEELbinary
MD5:CDF468D92F0190B69BC61AC14DC8E923
SHA256:F2111FF0DCCCD459E633BEC08D5B7987C9C3B9890DDD4A99EFD2E82001D77911
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\cryptography\hazmat\bindings\_rust.pydbinary
MD5:C4521BD3AB7F887E06601D75F6100D38
SHA256:92F58BB4F01A75A0EF4DD9425DC2A96DDFE25FC93FD9DC11EA8F0D05B7A4F085
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\libcrypto-3.dllbinary
MD5:E547CF6D296A88F5B1C352C116DF7C0C
SHA256:05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\select.pydbinary
MD5:E4AB524F78A4CF31099B43B35D2FAEC3
SHA256:BAE0974390945520EB99AB32486C6A964691F8F4A028AC408D98FA8FB0DB7D90
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
27
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8736
svchost.exe
GET
304
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
2212
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
2212
SIHClient.exe
GET
200
40.69.42.241:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
2212
SIHClient.exe
GET
200
74.179.77.204:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
2212
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
8736
svchost.exe
GET
200
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
text
5.70 Kb
whitelisted
8736
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
8736
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
356
svchost.exe
POST
200
40.126.31.3:443
https://login.live.com/RST2.srf
US
binary
11.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
8736
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
8176
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
8736
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8736
svchost.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
8736
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
3412
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
356
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.201.174
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.52.181.212
  • 88.221.169.152
  • 72.246.29.11
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.3
  • 40.126.31.131
  • 20.190.159.64
  • 40.126.31.130
  • 20.190.159.2
  • 20.190.159.128
  • 20.190.159.75
  • 40.126.31.73
  • 40.126.31.1
  • 40.126.31.129
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.131
whitelisted
ocsp.digicert.com
  • 162.159.142.9
  • 172.66.2.5
whitelisted
slscr.update.microsoft.com
  • 74.179.77.204
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.65
  • 48.192.1.64
whitelisted

Threats

PID
Process
Class
Message
8736
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
moo.exe