File name:

MaryWatters.wsf

Full analysis: https://app.any.run/tasks/4da79ec1-d668-4ce1-a78c-fe9f4fa5cefc
Verdict: Malicious activity
Analysis date: May 15, 2025, 13:02:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with CRLF line terminators
MD5:

3CD511CE2A070946739C55B8A3DAEC98

SHA1:

41B5B46C8035CFD26EDAFFD16A32DEAF93E316DD

SHA256:

4ADDDED66ED92FA76BAE32CFC577FC892B4B34E115C8B116D60C9340B382DD92

SSDEEP:

1536:iIzbJeeGUJIgg2/A+ZfukgKo9kNxyJ3OOjll68fef0qu7iE5ToGauKTYL7TBHQ/m:iIzbJXGUJtL/A+ZfUl6yqfs80

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a new folder (SCRIPT)

      • wscript.exe (PID: 6480)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6480)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6480)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 7468)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 8032)

    • Group Policy Discovery via Microsoft GPResult Utility

      • cmd.exe (PID: 6456)

    • Get information on the list of running processes

      • cmd.exe (PID: 8148)
      • wscript.exe (PID: 6480)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 6480)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 6480)

    • Uses WEVTUTIL.EXE to export log

      • cmd.exe (PID: 1760)
      • cmd.exe (PID: 7280)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 8168)
      • cmd.exe (PID: 2384)
      • cmd.exe (PID: 6244)

    • Uses WEVTUTIL.EXE to archive the exported log

      • cmd.exe (PID: 2384)
      • cmd.exe (PID: 7424)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 7184)
      • cmd.exe (PID: 7252)
      • cmd.exe (PID: 6208)
      • cmd.exe (PID: 920)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6480)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 5048)
      • cmd.exe (PID: 7720)
      • cmd.exe (PID: 1012)
      • cmd.exe (PID: 7604)
      • cmd.exe (PID: 7856)
      • cmd.exe (PID: 1020)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 7208)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 7180)
      • cmd.exe (PID: 7268)
      • cmd.exe (PID: 7648)
      • cmd.exe (PID: 728)
      • cmd.exe (PID: 1116)
      • cmd.exe (PID: 5544)
      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 8116)
      • cmd.exe (PID: 7496)
      • cmd.exe (PID: 4424)
      • cmd.exe (PID: 7476)
      • cmd.exe (PID: 920)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 6480)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 6272)
      • cmd.exe (PID: 7284)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 2800)

    • Connects to the server without a host name

      • curl.exe (PID: 5772)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7992)
      • cmd.exe (PID: 8036)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 7368)
      • cmd.exe (PID: 732)
      • cmd.exe (PID: 7196)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8032)
      • sc.exe (PID: 7576)
      • sc.exe (PID: 8068)
      • sc.exe (PID: 7192)
      • sc.exe (PID: 7424)
      • sc.exe (PID: 3192)

    • Executes application which crashes

      • wscript.exe (PID: 6480)

  • INFO

    • Create files in a temporary directory

      • reg.exe (PID: 7272)
      • reg.exe (PID: 7420)
      • reg.exe (PID: 8092)
      • reg.exe (PID: 2096)
      • curl.exe (PID: 5772)

    • The sample compiled with english language support

      • curl.exe (PID: 5772)

    • Execution of CURL command

      • cmd.exe (PID: 7352)

    • Checks supported languages

      • curl.exe (PID: 5772)

    • Reads security settings of Internet Explorer

      • netsh.exe (PID: 4844)
      • netsh.exe (PID: 7572)
      • dxdiag.exe (PID: 812)

    • Prints a route via ROUTE.EXE

      • ROUTE.EXE (PID: 6584)

    • Reads the software policy settings

      • dxdiag.exe (PID: 812)

    • Creates files or folders in the user directory

      • dxdiag.exe (PID: 812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
393
Monitored processes
260
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs gpresult.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs sppextcomobj.exe no specs conhost.exe no specs reg.exe no specs slui.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs systeminfo.exe no specs tiworker.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powercfg.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs curl.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs route.exe no specs cmd.exe no specs conhost.exe no specs certutil.exe no specs cmd.exe no specs conhost.exe no specs certutil.exe no specs cmd.exe no specs conhost.exe no specs certutil.exe no specs cmd.exe no specs conhost.exe no specs certutil.exe no specs cmd.exe no specs conhost.exe no specs certutil.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs dxdiag.exe cmd.exe no specs conhost.exe no specs dispdiag.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs ipconfig.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs werfault.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
668wevtutil epl "Microsoft-Windows-Wcmsvc/Operational" C:\Users\admin\AppData\Local\Temp\WCMLog.evtxC:\Windows\System32\wevtutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Eventing Command Line Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
c:\windows\system32\sechost.dll
672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728"C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show firewall >> C:\Users\admin\AppData\Local\Temp\WindowsFirewallConfig.txtC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
732"C:\Windows\System32\cmd.exe" /c sc query fdrespub >> C:\Users\admin\AppData\Local\Temp\WcnInfo.txtC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
736netsh lan show settings C:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
812dxdiag /t C:\Users\admin\AppData\Local\Temp\dxdiag.txtC:\Windows\System32\dxdiag.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft DirectX Diagnostic Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dxdiag.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
856netsh wlan show interfaces C:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
31 901
Read events
31 786
Write events
94
Delete events
21

Modification events

(PID) Process:(7916) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31180185
(PID) Process:(7916) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
(PID) Process:(812) dxdiag.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool
Operation:writeName:DxDiag In SystemInfo
Value:
1
(PID) Process:(812) dxdiag.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool
Operation:delete valueName:DxDiag In SystemInfo
Value:

(PID) Process:(812) dxdiag.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool
Operation:writeName:DxDiag In DirectDraw
Value:
1
(PID) Process:(812) dxdiag.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool
Operation:delete valueName:DxDiag In DirectDraw
Value:

(PID) Process:(812) dxdiag.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool
Operation:writeName:DxDiag In DirectSound
Value:
1
(PID) Process:(812) dxdiag.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool
Operation:delete valueName:DxDiag In DirectSound
Value:

(PID) Process:(812) dxdiag.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool
Operation:writeName:DxDiag In VideoCapture
Value:
1
(PID) Process:(812) dxdiag.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectX Diagnostic Tool
Operation:delete valueName:DxDiag In Diagnostics
Value:

Executable files
0
Suspicious files
11
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
2096reg.exeC:\Users\admin\AppData\Local\Temp\Reg\Notif.reg.txttext
MD5:9B854EFE8795D80357D5515CC1D4186F
SHA256:AA7CFB6E102C4D6E38EB3DCA4F3DF416B9657C808B8DDFC4D284627BE9C14803
6480wscript.exeC:\Users\admin\AppData\Local\Temp\adapterinfo.txttext
MD5:8D5C87318E456B59AACC7ACED9AA7C4A
SHA256:50BAF079FDB93C13FFE50BB4660939AD0B67620AEE417B75DEA45B36579F734C
8092reg.exeC:\Users\admin\AppData\Local\Temp\Reg\HKLMWlanSvc.reg.txttext
MD5:87F2A9E5A4192112D2E96CAE2B4254AA
SHA256:9D3B9148E6377CB110B6BD989846BC6574C90BF65E0095A998731490235B13B7
8148cmd.exeC:\Users\admin\AppData\Local\Temp\processes.txttext
MD5:4DE813858C9CFB24D48BF7EDEBB8111D
SHA256:61BE0DD1A501B239647EAC3B7F3D62A34D1A246CA0277BE853D2ECAA33552718
7916TiWorker.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:DDE303CD49F56E97E27E13F7B27100D0
SHA256:E6D2AD951904DB437CA524CA4AE40DAEEA0BB146E87F8FC9029863983E50098A
7720cmd.exeC:\Users\admin\AppData\Local\Temp\envinfo.txttext
MD5:0D7A6263CB01DDB0CBAA18664652C9B4
SHA256:C52A55BC05EE8E832B033932FEE50D1613DC9D0D1723577289D3A0250103E2E1
7496cmd.exeC:\Users\admin\AppData\Local\Temp\WinsockCatalog.txttext
MD5:F611E57F45EFB26353A557741945C373
SHA256:49D775394279B4CADF487C711B99DEFA13C5FE2C373E7DABE23F73DF307BACBE
6456cmd.exeC:\Users\admin\AppData\Local\Temp\gpresult.txttext
MD5:6CD3AB2AA8B7B5CCC083C99E4525F7E2
SHA256:0FE202BDA37CC8E2D50CA5AB811C535F1A42887960583E946745327369748117
2096reg.exeC:\Users\admin\AppData\Local\Temp\REGC853.tmptext
MD5:9B854EFE8795D80357D5515CC1D4186F
SHA256:AA7CFB6E102C4D6E38EB3DCA4F3DF416B9657C808B8DDFC4D284627BE9C14803
7420reg.exeC:\Users\admin\AppData\Local\Temp\Reg\AllCredFilter.reg.txttext
MD5:9A5A295EFDC30925C631166A5D041BD3
SHA256:88275B3C833910726328D29FB29F50FF6E5D357E8D3F316362C6D709D5FA5EF5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
22
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.167:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5772
curl.exe
GET
200
64.20.33.198:80
http://64.20.33.198/css/keepass.cfs
unknown
—
—
malicious
812
dxdiag.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
812
dxdiag.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.167:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4448
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
4448
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.167
  • 23.48.23.166
  • 23.48.23.164
  • 23.48.23.158
  • 23.48.23.143
  • 23.48.23.159
  • 23.48.23.145
  • 23.48.23.162
  • 23.48.23.156
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
  • 23.219.150.101
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.4
  • 20.190.160.14
  • 20.190.160.65
  • 20.190.160.64
  • 40.126.32.76
  • 20.190.160.131
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted

Threats

PID
Process
Class
Message
5772
curl.exe
Potentially Bad Traffic
ET HUNTING curl User-Agent to Dotted Quad
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MaryWatters.wsf