File name:

ocspackage.exe

Full analysis: https://app.any.run/tasks/55856dbe-6ddc-4888-a03d-73a465c51a17
Verdict: Malicious activity
Analysis date: October 31, 2024, 09:23:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

C89C81F60D46030F4714EF48D9E9999A

SHA1:

192E5A01D4CE839ADAEDE89B2AC48C94B109E49A

SHA256:

41C395003079D5AB23FF892D5DD937CF4C7D919E03C32B4D84CF99715B0F3E70

SSDEEP:

98304:TqPvIH/RQa7BSN/R93hvYOHFoClwRigDOXtBj3zhuCkEGx7yXfWDG8VIAJQEWgyJ:JhUHvBtH8YP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • ocspackage.exe (PID: 6424)
      • instocs.exe (PID: 612)
      • OcsSetup.exe (PID: 5604)

    • Executable content was dropped or overwritten

      • ocspackage.exe (PID: 6424)
      • instocs.exe (PID: 612)
      • OcsSetup.exe (PID: 5604)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ocspackage.exe (PID: 6424)
      • instocs.exe (PID: 612)
      • OcsSetup.exe (PID: 5604)

    • Reads security settings of Internet Explorer

      • instocs.exe (PID: 612)

    • Process drops legitimate windows executable

      • OcsSetup.exe (PID: 5604)

    • Executes as Windows Service

      • OcsService.exe (PID: 7044)

    • Starts CMD.EXE for commands execution

      • OcsService.exe (PID: 7044)

    • The process drops C-runtime libraries

      • OcsSetup.exe (PID: 5604)

  • INFO

    • Checks supported languages

      • ocspackage.exe (PID: 6424)
      • instocs.exe (PID: 612)
      • OcsSetup.exe (PID: 5604)

    • Create files in a temporary directory

      • ocspackage.exe (PID: 6424)
      • instocs.exe (PID: 612)
      • OcsSetup.exe (PID: 5604)

    • Reads the computer name

      • ocspackage.exe (PID: 6424)
      • instocs.exe (PID: 612)

    • Creates files in the program directory

      • instocs.exe (PID: 612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 22:50:52+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x30fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.4.0
ProductVersionNumber: 2.0.4.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
Comments: OCS-NG-Windows-Agent-Setup.exe v2.0.4.0 for OCS Inventory NG
CompanyName: Ocs Inventory Team
FileDescription: OCS-NG-Windows-Agent-Setup.exe v2.0.4.0 for OCS Inventory NG
FileVersion: 2.0.4.0
LegalCopyright: Ocs Inventory Team
LegalTrademarks: OcsPackager is an addon for Ocs Inventory NG.
ProductName: Package made by OcsPackager
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
13
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start ocspackage.exe instocs.exe ocssetup.exe ocsinventory.exe no specs ocsinventory.exe no specs ocssystray.exe no specs ocsservice.exe no specs conhost.exe no specs ocsservice.exe no specs cmd.exe no specs conhost.exe no specs ocsinventory.exe no specs ocspackage.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
608\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—OcsService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
612instocs.exeC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\instocs.exe
ocspackage.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsyc2cd.tmp\instocs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1160"C:\Users\admin\AppData\Local\Temp\ocspackage.exe" C:\Users\admin\AppData\Local\Temp\ocspackage.exe—explorer.exe
User:
admin
Company:
Ocs Inventory Team
Integrity Level:
MEDIUM
Description:
OCS-NG-Windows-Agent-Setup.exe v2.0.4.0 for OCS Inventory NG
Exit code:
3221226540
Version:
2.0.4.0
Modules
Images
c:\users\admin\appdata\local\temp\ocspackage.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3608"C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe" -installC:\Program Files (x86)\OCS Inventory Agent\OcsService.exe—OcsSetup.exe
User:
admin
Company:
OCS Inventory NG
Integrity Level:
HIGH
Description:
OCS Inventory NG Service
Exit code:
0
Version:
2, 0, 4, 0
Modules
Images
c:\program files (x86)\ocs inventory agent\ocsservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3844"C:\Program Files (x86)\OCS Inventory Agent\ocsinventory.exe"C:\Program Files (x86)\OCS Inventory Agent\OCSInventory.exe—OcsSetup.exe
User:
admin
Company:
OCS Inventory NG
Integrity Level:
HIGH
Description:
OCS Inventory NG Agent
Exit code:
4
Version:
2, 0, 4, 0
Modules
Images
c:\program files (x86)\ocs inventory agent\ocsinventory.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3952"C:\WINDOWS\system32\cmd.exe" /c "C:\Program Files (x86)\OCS Inventory Agent\ocsinventory.exe"C:\Windows\SysWOW64\cmd.exe—OcsService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
4
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4072"C:\Program Files (x86)\OCS Inventory Agent\ocsinventory.exe"C:\Program Files (x86)\OCS Inventory Agent\OCSInventory.exe—cmd.exe
User:
SYSTEM
Company:
OCS Inventory NG
Integrity Level:
SYSTEM
Description:
OCS Inventory NG Agent
Exit code:
4
Version:
2, 0, 4, 0
Modules
Images
c:\program files (x86)\ocs inventory agent\ocsinventory.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5084"C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe"C:\Program Files (x86)\OCS Inventory Agent\OcsSystray.exe—OcsSetup.exe
User:
admin
Company:
OCS Inventory NG
Integrity Level:
HIGH
Description:
OCS Inventory NG Systray applet
Version:
2, 0, 4, 0
Modules
Images
c:\program files (x86)\ocs inventory agent\ocssystray.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5604"C:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\OcsSetup.exe" /NOW /S /NOSPLASH /SSL=0 /SERVER=http://comserver.ocs.intranet/ocsinventoryC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\OcsSetup.exe
instocs.exe
User:
admin
Company:
OCS Inventory NG Team
Integrity Level:
HIGH
Description:
OCS Inventory NG Agent
Exit code:
0
Version:
2.0.4.0
Modules
Images
c:\users\admin\appdata\local\temp\nsyc2cd.tmp\ocssetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5736"C:\Program Files (x86)\OCS Inventory Agent\ocsinventory.exe" /SAVE_CONF /SERVER=http://comserver.ocs.intranet/ocsinventory /USER= /PWD= /SSL=0 /CA=cacert.pem /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG=C:\Program Files (x86)\OCS Inventory Agent\OCSInventory.exe—OcsSetup.exe
User:
admin
Company:
OCS Inventory NG
Integrity Level:
HIGH
Description:
OCS Inventory NG Agent
Exit code:
0
Version:
2, 0, 4, 0
Modules
Images
c:\program files (x86)\ocs inventory agent\ocsinventory.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
1 576
Read events
1 564
Write events
12
Delete events
0

Modification events

(PID) Process:(612) instocs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(612) instocs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(612) instocs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Volatile\00\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(612) instocs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Volatile\00\MACHINE\SOFTWARE\Classes\Interface\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(3608) OcsService.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\OCS Inventory Service
Operation:writeName:EventMessageFile
Value:
C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe
(PID) Process:(3608) OcsService.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\OCS Inventory Service
Operation:writeName:TypesSupported
Value:
7
(PID) Process:(5604) OcsSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OCS Inventory NG Agent
Operation:writeName:DisplayName
Value:
OCS Inventory NG Agent 2.0.4.0
(PID) Process:(5604) OcsSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OCS Inventory NG Agent
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\OCS Inventory Agent\uninst.exe
(PID) Process:(5604) OcsSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OCS Inventory NG Agent
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\OCS Inventory Agent\OCSInventory.exe
(PID) Process:(5604) OcsSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OCS Inventory NG Agent
Operation:writeName:DisplayVersion
Value:
2.0.4.0
Executable files
33
Suspicious files
8
Text files
14
Unknown types
1

Dropped files

PID
Process
Filename
Type
6424ocspackage.exeC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\OcsSetup.exeexecutable
MD5:94A21B457E22E79BF2DB01712950957E
SHA256:FA23B54C11CBDDA1886CA17AF5E6DE152D90493A87CA557492C23C9F9B0D5F0E
6424ocspackage.exeC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\pack.icoimage
MD5:6F26F0FC6014B0EA5899B9D075EEC459
SHA256:972D438129646352D4058B2053929692488C1E962D194F1C009E6A3ABD20B164
5604OcsSetup.exeC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\OCS-NG-Windows-Agent-Setup.logtext
MD5:85CB0A7C85F412D906A259BF9492EE74
SHA256:432203B41A8E419BCD746E5922A2EB43C3502C6799302F117D59DC58D1E662FC
6424ocspackage.exeC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\psexec.exeexecutable
MD5:AEEE996FD3484F28E5CD85FE26B6BDCD
SHA256:F8DBABDFA03068130C277CE49C60E35C029FF29D9E3C74C362521F3FB02670D5
6424ocspackage.exeC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
6424ocspackage.exeC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\UserInfo.dllexecutable
MD5:7579ADE7AE1747A31960A228CE02E666
SHA256:564C80DEC62D76C53497C40094DB360FF8A36E0DC1BDA8383D0F9583138997F5
612instocs.exeC:\Users\admin\AppData\Local\Temp\nspC6D4.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
6424ocspackage.exeC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\cacert.pemtext
MD5:67E7DDE7B7604FF7F6893910B12BC74D
SHA256:053DBF324C06C357E2058935A895AB318B7FA1A5344E480EF8FFBBA2A44C9208
6424ocspackage.exeC:\Users\admin\AppData\Local\Temp\nsyC2CD.tmp\instocs.exeexecutable
MD5:CDF133C8B8BD4BEDEECDA0ADB0EF125D
SHA256:1713C4B9D99D004B0F89D7DD624C135E61555D95B66DCCE96800C66523D2B0A0
612instocs.exeC:\ProgramData\OCS Inventory NG\Agent\cacert.pemtext
MD5:67E7DDE7B7604FF7F6893910B12BC74D
SHA256:053DBF324C06C357E2058935A895AB318B7FA1A5344E480EF8FFBBA2A44C9208
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
37
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6828
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6828
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3156
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
624
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7060
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6944
svchost.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
2.23.209.162:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 2.23.209.162
  • 2.23.209.156
  • 2.23.209.173
  • 2.23.209.179
  • 2.23.209.175
  • 2.23.209.177
  • 2.23.209.176
  • 2.23.209.181
  • 2.23.209.167
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.140
  • 20.190.160.20
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.136
whitelisted
th.bing.com
  • 2.23.209.132
  • 2.23.209.133
  • 2.23.209.143
  • 2.23.209.156
  • 2.23.209.140
  • 2.23.209.149
  • 2.23.209.160
  • 2.23.209.154
  • 2.23.209.135
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ocspackage.exe