File name:

moo.exe

Full analysis: https://app.any.run/tasks/025feb26-75f6-49bd-8135-9087fe833734
Verdict: Malicious activity
Analysis date: February 19, 2026, 04:37:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

7FB8DE3E953DDF6A23C34C4FD020E28E

SHA1:

A35487D795488A88C5D0D90D77E0A5275484AA54

SHA256:

3FE66EA3D2B6EA9D377BDE1A67DB7EF82123DD28DA10E37EBD3E7B51C2525609

SSDEEP:

98304:bTO3SXZY2C972W78d72nXoGBsgi82xumzy72m3SH0bVGMvLzDv6AE3ANBpc7+mSt:C4gjs3jwHEEHdWPI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Loads Python modules

      • moo.exe (PID: 6980)
      • moo.exe (PID: 5148)
      • moo.exe (PID: 5780)
      • moo.exe (PID: 7448)
      • moo.exe (PID: 7204)
      • moo.exe (PID: 9112)
      • moo.exe (PID: 1960)
      • moo.exe (PID: 3232)
      • moo.exe (PID: 8820)
      • moo.exe (PID: 2684)
      • moo.exe (PID: 9056)

    • Process drops python dynamic module

      • moo.exe (PID: 7324)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)

    • Application launched itself

      • moo.exe (PID: 7324)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)

  • INFO

    • Checks supported languages

      • moo.exe (PID: 7324)
      • moo.exe (PID: 6980)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 7448)
      • moo.exe (PID: 5148)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 5780)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 9112)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 7204)
      • moo.exe (PID: 1960)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3232)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 8820)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 2684)
      • moo.exe (PID: 6936)
      • moo.exe (PID: 9056)

    • Reads the computer name

      • moo.exe (PID: 7324)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)

    • Create files in a temporary directory

      • moo.exe (PID: 7324)
      • moo.exe (PID: 7292)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)

    • Checks proxy server information

      • slui.exe (PID: 6272)

    • Manual execution by a user

      • moo.exe (PID: 7292)
      • moo.exe (PID: 6724)
      • moo.exe (PID: 5520)
      • moo.exe (PID: 6364)
      • moo.exe (PID: 4804)
      • moo.exe (PID: 7648)
      • moo.exe (PID: 1672)
      • moo.exe (PID: 3976)
      • moo.exe (PID: 1068)
      • moo.exe (PID: 6936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:01:05 20:28:56+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.44
CodeSize: 184832
InitializedDataSize: 461312
UninitializedDataSize: -
EntryPoint: 0xcf30
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
192
Monitored processes
34
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start moo.exe no specs conhost.exe no specs moo.exe no specs slui.exe moo.exe conhost.exe no specs moo.exe no specs moo.exe conhost.exe no specs moo.exe no specs moo.exe conhost.exe no specs moo.exe no specs moo.exe conhost.exe no specs moo.exe no specs moo.exe conhost.exe no specs moo.exe no specs moo.exe conhost.exe no specs moo.exe no specs moo.exe conhost.exe no specs moo.exe no specs moo.exe conhost.exe no specs moo.exe no specs moo.exe conhost.exe no specs moo.exe no specs moo.exe conhost.exe no specs moo.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1068"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1672"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1960"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe—moo.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1984\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—moo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2288\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—moo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2684"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe—moo.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3232"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe—moo.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3976"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4796\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—moo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4804"C:\Users\admin\Desktop\moo.exe" C:\Users\admin\Desktop\moo.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\moo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
4 177
Read events
4 177
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
231

Dropped files

PID
Process
Filename
Type
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\VCRUNTIME140.dllbinary
MD5:BE8DBE2DC77EBE7F88F910C61AEC691A
SHA256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\_cffi_backend.cp311-win_amd64.pydbinary
MD5:D73E60E5DDD70625FD0092677CFF5628
SHA256:8100F667A3F64EEB37B9326D0C53A931E0EA3CEA4ADE5DBDC638C368355C0948
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\cryptography-46.0.3.dist-info\METADATAbinary
MD5:F48CBB569521D70FCA5EB61242154D72
SHA256:6F1D8BC82126395502F051F986C18465EC163E2668208613AB484CF66BBDAF8B
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\_decimal.pydbinary
MD5:C88282908BA54510EDA3887C488198EB
SHA256:980A63F2B39CF16910F44384398E25F24482346A482ADDB00DE42555B17D4278
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\cryptography-46.0.3.dist-info\licenses\LICENSE.BSDbinary
MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\python311.dllbinary
MD5:387BB2C1E40BDE1517F06B46313766BE
SHA256:0817A2A657A24C0D5FBB60DF56960F42FC66B3039D522EC952DAB83E2D869364
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\_bz2.pydbinary
MD5:AA1083BDE6D21CABFC630A18F51B1926
SHA256:00B8CA9A338D2B47285C9E56D6D893DB2A999B47216756F18439997FB80A56E3
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\_hashlib.pydbinary
MD5:B4FF25B1ACA23D48897FC616E102E9B6
SHA256:87DD0C858620287454FD6D31D52B6A48EDDBB2A08E09E8B2D9FDB0B92200D766
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\python3.dllbinary
MD5:7E07C63636A01DF77CD31CFCA9A5C745
SHA256:DB84BC052CFB121FE4DB36242BA5F1D2C031B600EF5D8D752CF25B7C02B6BAC6
7324moo.exeC:\Users\admin\AppData\Local\Temp\_MEI73242\base_library.zipbinary
MD5:52F59304ED19D6476E6F5849D3E091BC
SHA256:304C41B2D0AE0EB627570A3619B7F6FC646D6B90C222C6B05B6EB250C683C038
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
27
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8736
svchost.exe
GET
304
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
2212
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
2212
SIHClient.exe
GET
200
40.69.42.241:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
2212
SIHClient.exe
GET
200
74.179.77.204:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
2212
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
8736
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
8736
svchost.exe
GET
200
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
text
5.70 Kb
whitelisted
8736
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
356
svchost.exe
POST
200
40.126.31.3:443
https://login.live.com/RST2.srf
US
binary
10.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
8736
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
8176
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
8736
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8736
svchost.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
8736
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
3412
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
356
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.201.174
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.52.181.212
  • 88.221.169.152
  • 72.246.29.11
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.3
  • 40.126.31.131
  • 20.190.159.64
  • 40.126.31.130
  • 20.190.159.2
  • 20.190.159.128
  • 20.190.159.75
  • 40.126.31.73
  • 40.126.31.1
  • 40.126.31.129
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.131
whitelisted
ocsp.digicert.com
  • 162.159.142.9
  • 172.66.2.5
whitelisted
slscr.update.microsoft.com
  • 74.179.77.204
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.65
  • 48.192.1.64
whitelisted

Threats

PID
Process
Class
Message
8736
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
moo.exe