File name:

4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe

Full analysis: https://app.any.run/tasks/79659555-2335-4250-8fc5-fd7f281bbe3c
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 12:49:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections
MD5:

2A0E4240DBBB3B8FD92181AF80E8324A

SHA1:

C57ECF974AFA23D74B9F644CAC49E827D18E4514

SHA256:

4630A1A0312F5A6531D429DCD90214207666E8CA5CD45F945BF05EEE9A2A41D4

SSDEEP:

49152:MvrxXlftaYXeAdZPsgd6pigQs6LG1EPhVu26s4msQx40ll92me4SBrFVsxVKWHKr:Mvrx/nX/dZEgd6pigC8EPn1XsQxvll4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Deletes shadow copies

      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 6704)

    • Changes the autorun value in the registry

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 5956)

    • RANSOMWARE has been detected

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 5956)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 5772)

    • Starts CMD.EXE for commands execution

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 5956)
      • svccost.exe (PID: 6524)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 7120)
      • cmd.exe (PID: 6488)

    • Executable content was dropped or overwritten

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 5956)

    • Application launched itself

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 6068)
      • svccost.exe (PID: 6396)

    • Reads security settings of Internet Explorer

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 6068)

    • Uses WEVTUTIL.EXE to cleanup log

      • cmd.exe (PID: 7148)
      • cmd.exe (PID: 5592)
      • cmd.exe (PID: 6536)
      • cmd.exe (PID: 6720)

    • Creates file in the systems drive root

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 5956)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4060)

  • INFO

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6184)
      • notepad.exe (PID: 4172)
      • notepad.exe (PID: 1116)

    • Process checks computer location settings

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 6068)

    • Reads the computer name

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 6068)

    • Checks supported languages

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 5956)
      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 6068)

    • Manual execution by a user

      • mspaint.exe (PID: 1012)
      • notepad.exe (PID: 1116)
      • svccost.exe (PID: 6396)
      • notepad.exe (PID: 4172)
      • notepad.exe (PID: 7104)
      • mspaint.exe (PID: 7132)
      • mspaint.exe (PID: 6804)

    • Checks proxy server information

      • slui.exe (PID: 5984)

    • Reads the software policy settings

      • slui.exe (PID: 5984)

    • Creates files in the program directory

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 5956)

    • Creates files or folders in the user directory

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 5956)

    • Create files in a temporary directory

      • 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe (PID: 5956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.5)
.exe | DOS Executable Borland Pascal 7.0x (19.2)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit, No debug
PEType: PE32
LinkerVersion: -
CodeSize: -
InitializedDataSize: 4096
UninitializedDataSize: 1433600
EntryPoint: 0x26b3fa
OSVersion: -
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
314
Monitored processes
52
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe no specs THREAT 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs vssvc.exe no specs cmd.exe no specs sppextcomobj.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs notepad.exe no specs slui.exe mspaint.exe no specs notepad.exe no specs plugscheduler.exe no specs svccost.exe no specs svccost.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs notepad.exe no specs mspaint.exe no specs mspaint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\inputhope.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1116"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Arcus-ReadMe.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1164C:\WINDOWS\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\SysWOW64\cmd.exe—4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2504C:\WINDOWS\system32\cmd.exe /c vssadmin delete shadows /all /quietC:\Windows\SysWOW64\cmd.exe—4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2908C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
3272\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 720
Read events
4 625
Write events
92
Delete events
3

Modification events

(PID) Process:(5956) 4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:cr
Value:
C:\ProgramData\svccost.exe
(PID) Process:(4172) notepad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad
Operation:writeName:iWindowPosX
Value:
292
(PID) Process:(4172) notepad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad
Operation:writeName:iWindowPosY
Value:
92
(PID) Process:(4172) notepad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad
Operation:writeName:iWindowPosDX
Value:
960
(PID) Process:(4172) notepad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad
Operation:writeName:iWindowPosDY
Value:
489
(PID) Process:(1012) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:WindowPlacement
Value:
2C00000000000000010000000000000000000000FFFFFFFFFFFFFFFF7F000000470000007F04000087020000
(PID) Process:(1012) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowThumbnail
Value:
0
(PID) Process:(1012) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPWidth
Value:
0
(PID) Process:(1012) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPHeight
Value:
0
(PID) Process:(1012) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbXPos
Value:
0
Executable files
1
Suspicious files
45
Text files
4 220
Unknown types
0

Dropped files

PID
Process
Filename
Type
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\Program Files\Arcus-ReadMe.txttext
MD5:747D08AB155892ADD3BF0D96C4DC35B7
SHA256:34C4857E0AE4FB466F89E722C7A85ADB9575CF4B7A521A4657E5CD001CE372A6
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\ProgramData\svccost.exeexecutable
MD5:2A0E4240DBBB3B8FD92181AF80E8324A
SHA256:4630A1A0312F5A6531D429DCD90214207666E8CA5CD45F945BF05EEE9A2A41D4
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\found.000\Arcus-ReadMe.txttext
MD5:747D08AB155892ADD3BF0D96C4DC35B7
SHA256:34C4857E0AE4FB466F89E722C7A85ADB9575CF4B7A521A4657E5CD001CE372A6
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\$WinREAgent\Rollback\Arcus-ReadMe.txttext
MD5:747D08AB155892ADD3BF0D96C4DC35B7
SHA256:34C4857E0AE4FB466F89E722C7A85ADB9575CF4B7A521A4657E5CD001CE372A6
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\found.000\dir_00000002.chk\Arcus-ReadMe.txttext
MD5:747D08AB155892ADD3BF0D96C4DC35B7
SHA256:34C4857E0AE4FB466F89E722C7A85ADB9575CF4B7A521A4657E5CD001CE372A6
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\Program Files\Adobe\Arcus-ReadMe.txttext
MD5:747D08AB155892ADD3BF0D96C4DC35B7
SHA256:34C4857E0AE4FB466F89E722C7A85ADB9575CF4B7A521A4657E5CD001CE372A6
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\found.000\dir0000.chk\Arcus-ReadMe.txttext
MD5:747D08AB155892ADD3BF0D96C4DC35B7
SHA256:34C4857E0AE4FB466F89E722C7A85ADB9575CF4B7A521A4657E5CD001CE372A6
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\PerfLogs\Arcus-ReadMe.txttext
MD5:747D08AB155892ADD3BF0D96C4DC35B7
SHA256:34C4857E0AE4FB466F89E722C7A85ADB9575CF4B7A521A4657E5CD001CE372A6
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\Users\Arcus-ReadMe.txttext
MD5:747D08AB155892ADD3BF0D96C4DC35B7
SHA256:34C4857E0AE4FB466F89E722C7A85ADB9575CF4B7A521A4657E5CD001CE372A6
59564630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exeC:\$WinREAgent\Arcus-ReadMe.txttext
MD5:747D08AB155892ADD3BF0D96C4DC35B7
SHA256:34C4857E0AE4FB466F89E722C7A85ADB9575CF4B7A521A4657E5CD001CE372A6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
50
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5528
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5604
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5196
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3032
OfficeClickToRun.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5528
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3812
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2292
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.130
  • 20.190.159.64
  • 20.190.159.129
  • 20.190.159.75
  • 40.126.31.128
  • 20.190.159.131
  • 40.126.31.69
  • 40.126.31.129
  • 20.190.160.4
  • 40.126.32.76
  • 20.190.160.131
  • 20.190.160.67
  • 40.126.32.138
  • 40.126.32.136
  • 20.190.160.66
  • 40.126.32.72
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4630a1a0312f5a6531d429dcd90214207666e8ca5cd45f945bf05eee9a2a41d4.exe