File name:

AdskNLM.exe

Full analysis: https://app.any.run/tasks/ecf7f11d-ba81-44eb-a3d6-bbded26cd5e3
Verdict: Malicious activity
Analysis date: January 01, 2025, 17:06:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

552E9EEEBB2C81C3B5D133C159C5588D

SHA1:

F0F9A1B7C4742AB0ED5538D84D5FA57ED9DE8571

SHA256:

4B020276CC13285C8E3409D00FA4DFAD8FBD133D541AE63B3DC23F19B3367EA9

SSDEEP:

196608:r+X74XJgUfM2xyZc1jeuTOfBXiEGkQfFJi5q:rKE5gZOIcTOpyTkQfbic

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • adskflex.exe (PID: 420)

  • SUSPICIOUS

    • Application launched itself

      • AdskNLM.exe (PID: 6376)
      • AdskNLM.exe (PID: 6512)
      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 4672)
      • cmd.exe (PID: 6552)
      • lmgrd.exe (PID: 6012)

    • Reads security settings of Internet Explorer

      • AdskNLM.exe (PID: 6376)
      • AdskNLM.exe (PID: 6564)
      • AdskNLM.exe (PID: 6680)
      • AdskNLM.exe (PID: 5696)
      • AdskNLM.exe (PID: 4224)
      • AdskNLM.exe (PID: 2796)
      • AdskNLM.exe (PID: 6632)
      • AdskNLM.exe (PID: 6788)
      • AdskNLM.exe (PID: 6840)
      • AdskNLM.exe (PID: 7124)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 2736)
      • AdskNLM.exe (PID: 6512)
      • AdskNLM.exe (PID: 4244)
      • AdskNLM.exe (PID: 6436)
      • AdskNLM.exe (PID: 3172)
      • AdskNLM.exe (PID: 6724)
      • AdskNLM.exe (PID: 3652)
      • AdskNLM.exe (PID: 6712)
      • AdskNLM.exe (PID: 7124)
      • AdskNLM.exe (PID: 1704)
      • AdskNLM.exe (PID: 6940)
      • AdskNLM.exe (PID: 4320)
      • AdskNLM.exe (PID: 5992)
      • AdskNLM.exe (PID: 6068)
      • AdskNLM.exe (PID: 5308)
      • AdskNLM.exe (PID: 7100)
      • AdskNLM.exe (PID: 5460)
      • AdskNLM.exe (PID: 2280)

    • Executable content was dropped or overwritten

      • AdskNLM.exe (PID: 6512)

    • Reads the date of Windows installation

      • AdskNLM.exe (PID: 6564)
      • AdskNLM.exe (PID: 6680)
      • AdskNLM.exe (PID: 5696)
      • AdskNLM.exe (PID: 4224)
      • AdskNLM.exe (PID: 2796)
      • AdskNLM.exe (PID: 6632)
      • AdskNLM.exe (PID: 6788)
      • AdskNLM.exe (PID: 6840)
      • AdskNLM.exe (PID: 7124)
      • AdskNLM.exe (PID: 6512)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 2736)
      • AdskNLM.exe (PID: 4244)
      • AdskNLM.exe (PID: 6436)
      • AdskNLM.exe (PID: 3172)
      • AdskNLM.exe (PID: 6724)
      • AdskNLM.exe (PID: 6784)
      • AdskNLM.exe (PID: 6756)
      • AdskNLM.exe (PID: 6712)
      • AdskNLM.exe (PID: 7056)
      • AdskNLM.exe (PID: 5964)
      • AdskNLM.exe (PID: 1704)
      • AdskNLM.exe (PID: 836)
      • AdskNLM.exe (PID: 4500)
      • AdskNLM.exe (PID: 2356)
      • AdskNLM.exe (PID: 5992)
      • AdskNLM.exe (PID: 7100)
      • AdskNLM.exe (PID: 2280)
      • AdskNLM.exe (PID: 6068)
      • AdskNLM.exe (PID: 5460)

    • Stops a currently running service

      • sc.exe (PID: 6608)
      • sc.exe (PID: 3364)
      • sc.exe (PID: 6768)

    • Starts SC.EXE for service management

      • AdskNLM.exe (PID: 6564)
      • AdskNLM.exe (PID: 2796)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 2736)
      • AdskNLM.exe (PID: 6436)
      • AdskNLM.exe (PID: 7060)
      • AdskNLM.exe (PID: 3640)
      • AdskNLM.exe (PID: 5460)

    • Uses TASKKILL.EXE to kill process

      • AdskNLM.exe (PID: 6680)
      • AdskNLM.exe (PID: 6632)
      • AdskNLM.exe (PID: 6788)
      • AdskNLM.exe (PID: 6840)
      • AdskNLM.exe (PID: 7124)
      • AdskNLM.exe (PID: 4244)

    • Starts CMD.EXE for commands execution

      • AdskNLM.exe (PID: 5696)
      • AdskNLM.exe (PID: 4224)
      • AdskNLM.exe (PID: 3172)
      • AdskNLM.exe (PID: 6724)
      • AdskNLM.exe (PID: 6784)
      • AdskNLM.exe (PID: 3652)
      • AdskNLM.exe (PID: 2972)
      • AdskNLM.exe (PID: 6712)
      • AdskNLM.exe (PID: 6756)
      • AdskNLM.exe (PID: 5964)
      • AdskNLM.exe (PID: 7124)
      • cmd.exe (PID: 7144)
      • AdskNLM.exe (PID: 5236)
      • cmd.exe (PID: 4672)
      • AdskNLM.exe (PID: 2280)
      • cmd.exe (PID: 6552)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6492)
      • sc.exe (PID: 3988)
      • sc.exe (PID: 6620)
      • sc.exe (PID: 6684)

    • Uses REG/REGEDIT.EXE to modify registry

      • AdskNLM.exe (PID: 6512)
      • AdskNLM.exe (PID: 1704)
      • AdskNLM.exe (PID: 4500)
      • AdskNLM.exe (PID: 6940)
      • AdskNLM.exe (PID: 836)
      • AdskNLM.exe (PID: 4320)
      • AdskNLM.exe (PID: 2356)
      • AdskNLM.exe (PID: 5992)
      • AdskNLM.exe (PID: 1920)
      • AdskNLM.exe (PID: 4228)
      • AdskNLM.exe (PID: 5308)
      • AdskNLM.exe (PID: 7100)
      • AdskNLM.exe (PID: 6068)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 6212)
      • cmd.exe (PID: 7052)

    • Uses WMIC.EXE to obtain service application data

      • cmd.exe (PID: 3540)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7140)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 7140)

    • Process copies executable file

      • cmd.exe (PID: 7144)

    • Executing commands from ".cmd" file

      • AdskNLM.exe (PID: 5236)

    • Creates a new Windows service

      • sc.exe (PID: 4628)

    • Uses WMIC.EXE

      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 3524)

    • Executes as Windows Service

      • lmgrd.exe (PID: 6012)

  • INFO

    • Reads the computer name

      • AdskNLM.exe (PID: 6376)
      • AdskNLM.exe (PID: 6512)
      • AdskNLM.exe (PID: 6564)
      • AdskNLM.exe (PID: 6680)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 4224)
      • AdskNLM.exe (PID: 2796)
      • AdskNLM.exe (PID: 6632)
      • AdskNLM.exe (PID: 6788)
      • AdskNLM.exe (PID: 6840)
      • AdskNLM.exe (PID: 7124)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 2736)
      • AdskNLM.exe (PID: 4244)
      • AdskNLM.exe (PID: 6436)
      • AdskNLM.exe (PID: 3172)
      • AdskNLM.exe (PID: 6724)
      • AdskNLM.exe (PID: 6784)
      • msiexec.exe (PID: 7140)
      • AdskNLM.exe (PID: 3652)
      • AdskNLM.exe (PID: 5964)
      • AdskNLM.exe (PID: 6712)
      • AdskNLM.exe (PID: 7124)
      • msiexec.exe (PID: 6568)
      • AdskNLM.exe (PID: 3640)
      • AdskNLM.exe (PID: 6940)
      • AdskNLM.exe (PID: 836)
      • AdskNLM.exe (PID: 2356)
      • AdskNLM.exe (PID: 5992)
      • AdskNLM.exe (PID: 1920)
      • AdskNLM.exe (PID: 7100)
      • AdskNLM.exe (PID: 5308)
      • AdskNLM.exe (PID: 5460)
      • lmgrd.exe (PID: 6244)
      • adskflex.exe (PID: 420)

    • Checks supported languages

      • AdskNLM.exe (PID: 6376)
      • AdskNLM.exe (PID: 6512)
      • AdskNLM.exe (PID: 6564)
      • AdskNLM.exe (PID: 6680)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 5696)
      • AdskNLM.exe (PID: 4224)
      • AdskNLM.exe (PID: 2796)
      • AdskNLM.exe (PID: 6632)
      • AdskNLM.exe (PID: 6788)
      • AdskNLM.exe (PID: 6840)
      • AdskNLM.exe (PID: 7124)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 2736)
      • AdskNLM.exe (PID: 4244)
      • AdskNLM.exe (PID: 6436)
      • AdskNLM.exe (PID: 3172)
      • AdskNLM.exe (PID: 6724)
      • AdskNLM.exe (PID: 6784)
      • AdskNLM.exe (PID: 6756)
      • AdskNLM.exe (PID: 6712)
      • AdskNLM.exe (PID: 7060)
      • AdskNLM.exe (PID: 7056)
      • msiexec.exe (PID: 7140)
      • AdskNLM.exe (PID: 5964)
      • AdskNLM.exe (PID: 7124)
      • msiexec.exe (PID: 6184)
      • msiexec.exe (PID: 6568)
      • AdskNLM.exe (PID: 3640)
      • AdskNLM.exe (PID: 1704)
      • AdskNLM.exe (PID: 4320)
      • AdskNLM.exe (PID: 6940)
      • AdskNLM.exe (PID: 4500)
      • AdskNLM.exe (PID: 836)
      • AdskNLM.exe (PID: 5992)
      • AdskNLM.exe (PID: 2356)
      • AdskNLM.exe (PID: 1920)
      • AdskNLM.exe (PID: 6068)
      • AdskNLM.exe (PID: 4228)
      • AdskNLM.exe (PID: 7100)
      • AdskNLM.exe (PID: 2280)
      • adskflex.exe (PID: 420)
      • AdskNLM.exe (PID: 5460)
      • lmgrd.exe (PID: 6244)

    • The process uses the downloaded file

      • AdskNLM.exe (PID: 6376)
      • AdskNLM.exe (PID: 6564)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 5696)
      • AdskNLM.exe (PID: 4224)
      • AdskNLM.exe (PID: 2796)
      • AdskNLM.exe (PID: 6788)
      • AdskNLM.exe (PID: 6632)
      • AdskNLM.exe (PID: 6840)
      • AdskNLM.exe (PID: 7124)
      • AdskNLM.exe (PID: 6512)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 2736)
      • AdskNLM.exe (PID: 4244)
      • AdskNLM.exe (PID: 6436)
      • AdskNLM.exe (PID: 3172)
      • AdskNLM.exe (PID: 6784)
      • AdskNLM.exe (PID: 6724)
      • AdskNLM.exe (PID: 7060)
      • AdskNLM.exe (PID: 6756)
      • AdskNLM.exe (PID: 2972)
      • AdskNLM.exe (PID: 5964)
      • AdskNLM.exe (PID: 3652)
      • AdskNLM.exe (PID: 7056)
      • AdskNLM.exe (PID: 7124)
      • AdskNLM.exe (PID: 5236)
      • AdskNLM.exe (PID: 3640)
      • AdskNLM.exe (PID: 1920)
      • AdskNLM.exe (PID: 4228)
      • AdskNLM.exe (PID: 6068)

    • The sample compiled with english language support

      • AdskNLM.exe (PID: 6512)
      • msiexec.exe (PID: 7140)

    • Create files in a temporary directory

      • AdskNLM.exe (PID: 6512)

    • Process checks computer location settings

      • AdskNLM.exe (PID: 6564)
      • AdskNLM.exe (PID: 6680)
      • AdskNLM.exe (PID: 5696)
      • AdskNLM.exe (PID: 4224)
      • AdskNLM.exe (PID: 2796)
      • AdskNLM.exe (PID: 6632)
      • AdskNLM.exe (PID: 7124)
      • AdskNLM.exe (PID: 6840)
      • AdskNLM.exe (PID: 6788)
      • AdskNLM.exe (PID: 6948)
      • AdskNLM.exe (PID: 2736)
      • AdskNLM.exe (PID: 6512)
      • AdskNLM.exe (PID: 4244)
      • AdskNLM.exe (PID: 6436)
      • AdskNLM.exe (PID: 3172)
      • AdskNLM.exe (PID: 6724)
      • AdskNLM.exe (PID: 6784)
      • AdskNLM.exe (PID: 6712)
      • AdskNLM.exe (PID: 6756)
      • AdskNLM.exe (PID: 7056)
      • AdskNLM.exe (PID: 5964)
      • AdskNLM.exe (PID: 1704)
      • AdskNLM.exe (PID: 836)
      • AdskNLM.exe (PID: 4500)
      • AdskNLM.exe (PID: 2356)
      • AdskNLM.exe (PID: 5992)
      • AdskNLM.exe (PID: 7100)
      • AdskNLM.exe (PID: 2280)
      • AdskNLM.exe (PID: 5460)
      • AdskNLM.exe (PID: 6068)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 5828)
      • WMIC.exe (PID: 624)
      • WMIC.exe (PID: 5080)
      • WMIC.exe (PID: 6484)

    • Changes file name

      • cmd.exe (PID: 3092)
      • cmd.exe (PID: 6076)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 7140)

    • Reads the software policy settings

      • msiexec.exe (PID: 7140)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7140)

    • Application launched itself

      • msiexec.exe (PID: 7140)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7140)

    • Creates files in the program directory

      • cmd.exe (PID: 4672)

    • Creates files or folders in the user directory

      • xcopy.exe (PID: 2380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2016:03:05 12:48:50+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 8
CodeSize: 128512
InitializedDataSize: 287744
UninitializedDataSize: -
EntryPoint: 0x1fe7c
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 5.0.0.0
ProductVersionNumber: 5.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: MAGNiTUDE & m0nkrus
FileDescription: Autodesk Cracked NLM Installer (MAGNiTUDE method)
FileVersion: 5.0.0.0
InternalName: AdskNLM
LegalCopyright: Copyright © 2022 MAGNiTUDE & m0nkrus
OriginalFileName: AdskNLM.exe
PrivateBuild: July 31, 2022
ProductName: Autodesk Cracked NLM
ProductVersion: 5.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
273
Monitored processes
143
Malicious processes
2
Suspicious processes
8

Behavior graph

Click at the process to see the details
start adsknlm.exe no specs adsknlm.exe adsknlm.exe no specs sc.exe no specs conhost.exe no specs adsknlm.exe no specs taskkill.exe no specs conhost.exe no specs adsknlm.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs adsknlm.exe no specs sc.exe no specs conhost.exe no specs adsknlm.exe no specs taskkill.exe no specs conhost.exe no specs adsknlm.exe no specs taskkill.exe no specs conhost.exe no specs adsknlm.exe no specs taskkill.exe no specs conhost.exe no specs adsknlm.exe no specs taskkill.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs sc.exe no specs conhost.exe no specs adsknlm.exe no specs sc.exe no specs conhost.exe no specs adsknlm.exe no specs taskkill.exe no specs conhost.exe no specs adsknlm.exe no specs sc.exe no specs conhost.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs msiexec.exe adsknlm.exe no specs cmd.exe no specs conhost.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs adsknlm.exe no specs sc.exe no specs conhost.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs adsknlm.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs xcopy.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs adsknlm.exe no specs sc.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs reg.exe no specs conhost.exe no specs adsknlm.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs xcopy.exe no specs adsknlm.exe no specs sc.exe no specs conhost.exe no specs lmgrd.exe no specs conhost.exe no specs lmgrd.exe no specs adskflex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
420adskflex.exe -T DESKTOP-JGLLJLD 11.18 -1 -c ";C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic;" -lmgrd_port 6978 -srv BdHz62lVb232obDZiia8UeBztIh9l7PVg9Vnq6WSjgF3TP0CyQAbCm6T63lRrMB --lmgrd_start 67757623 -vdrestart 0 C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe—lmgrd.exe
User:
LOCAL SERVICE
Company:
Autodesk, Inc.
Integrity Level:
SYSTEM
Description:
Autodesk Licensing Vendor Daemon
Version:
3
Modules
Images
c:\program files (x86)\common files\autodesk shared\network license manager\adskflex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
624"C:\Windows\System32\cmd.exe" /c if exist "C:\Program Files (x86)\Common Files\Autodesk Shared\Adlm\R28\LMU.exe" ( echo D | xcopy /hkry "C:\Users\admin\AppData\Local\Temp\Adsk-NLM\netapi32.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\Adlm\R28" )C:\Windows\System32\cmd.exe—AdskNLM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
624wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
836C:\Windows\System32\MsiExec.exe -Embedding C240A244B941C22564106845B271BB9AC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
836"C:\Users\admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /fC:\Users\admin\AppData\Local\Temp\AdskNLM.exe—AdskNLM.exe
User:
admin
Company:
MAGNiTUDE & m0nkrus
Integrity Level:
HIGH
Description:
Autodesk Cracked NLM Installer (MAGNiTUDE method)
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\adsknlm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1512\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1704"C:\Users\admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /fC:\Users\admin\AppData\Local\Temp\AdskNLM.exe—AdskNLM.exe
User:
admin
Company:
MAGNiTUDE & m0nkrus
Integrity Level:
HIGH
Description:
Autodesk Cracked NLM Installer (MAGNiTUDE method)
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\adsknlm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1920wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterTypeC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1920"C:\Users\admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /fC:\Users\admin\AppData\Local\Temp\AdskNLM.exe—AdskNLM.exe
User:
admin
Company:
MAGNiTUDE & m0nkrus
Integrity Level:
HIGH
Description:
Autodesk Cracked NLM Installer (MAGNiTUDE method)
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\adsknlm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
32 010
Read events
31 891
Write events
106
Delete events
13

Modification events

(PID) Process:(7012) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Autodesk Access
Value:
(PID) Process:(7140) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Operation:delete valueName:2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
Value:
(PID) Process:(7140) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
Operation:writeName:Blob
Value:
0400000001000000100000001BFE69D191B71933A372A80FE155E5B51D0000000100000010000000885010358D29A38F059B028559C95F90620000000100000020000000E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD2090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B060105050703080F000000010000003000000066B764A96581128168CF208E374DDA479D54E311F32457F4AEE0DBD2A6C8D171D531289E1CD22BFDBBD4CFD9796254830300000001000000140000002B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E190000000100000010000000EA6089055218053DD01E37E1D806EEDF53000000010000004300000030413022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C01400000001000000140000005379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB0B00000001000000100000005300650063007400690067006F0000002000000001000000E2050000308205DE308203C6A003020102021001FD6D30FCA3CA51A81BBC640E35032D300D06092A864886F70D01010C0500308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F72697479301E170D3130303230313030303030305A170D3338303131383233353935395A308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F7269747930820222300D06092A864886F70D01010105000382020F003082020A028202010080126517360EC3DB08B3D0AC570D76EDCD27D34CAD508361E2AA204D092D6409DCCE899FCC3DA9ECF6CFC1DCF1D3B1D67B3728112B47DA39C6BC3A19B45FA6BD7D9DA36342B676F2A93B2B91F8E26FD0EC162090093EE2E874C918B491D46264DB7FA306F188186A90223CBCFE13F087147BF6E41F8ED4E451C61167460851CB8614543FBC33FE7E6C9CFF169D18BD518E35A6A766C87267DB2166B1D49B7803C0503AE8CCF0DCBC9E4CFEAF0596351F575AB7FFCEF93DB72CB6F654DDC8E7123A4DAE4C8AB75C9AB4B7203DCA7F2234AE7E3B68660144E7014E46539B3360F794BE5337907343F332C353EFDBAAFE744E69C76B8C6093DEC4C70CDFE132AECC933B517895678BEE3D56FE0CD0690F1B0FF325266B336DF76E47FA7343E57E0EA566B1297C3284635589C40DC19354301913ACD37D37A7EB5D3A6C355CDB41D712DAA9490BDFD8808A0993628EB566CF2588CD84B8B13FA4390FD9029EEB124C957CF36B05A95E1683CCB867E2E8139DCC5B82D34CB3ED5BFFDEE573AC233B2D00BF3555740949D849581A7F9236E651920EF3267D1C4D17BCC9EC4326D0BF415F40A94444F499E757879E501F5754A83EFD74632FB1506509E658422E431A4CB4F0254759FA041E93D426464A5081B2DEBE78B7FC6715E1C957841E0F63D6E962BAD65F552EEA5CC62808042539B80E2BA9F24C971C073F0D52F5EDEF2F820F0203010001A3423040301D0603551D0E041604145379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF300D06092A864886F70D01010C050003820201005CD47C0DCFF7017D4199650C73C5529FCBF8CF99067F1BDA43159F9E0255579614F1523C27879428ED1F3A0137A276FC5350C0849BC66B4EBA8C214FA28E556291F36915D8BC88E3C4AA0BFDEFA8E94B552A06206D55782919EE5F305C4B241155FF249A6E5E2A2BEE0B4D9F7FF70138941495430709FB60A9EE1CAB128CA09A5EA7986A596D8B3F08FBC8D145AF18156490120F73282EC5E2244EFC58ECF0F445FE22B3EB2F8ED2D9456105C1976FA876728F8B8C36AFBF0D05CE718DE6A66F1F6CA67162C5D8D083720CF16711890C9C134C7234DFBCD571DFAA71DDE1B96C8C3C125D65DABD5712B6436BFFE5DE4D661151CF99AEEC17B6E871918CDE49FEDD3571A21527941CCF61E326BB6FA36725215DE6DD1D0B2E681B3B82AFEC836785D4985174B1B9998089FF7F78195C794A602E9240AE4C372A2CC9C762C80E5DF7365BCAE0252501B4DD1A079C77003FD0DCD5EC3DD4FABB3FCC85D66F7FA92DDFB902F7F5979AB535DAC367B0874AA9289E238EFF5C276BE1B04FF307EE002ED45987CB524195EAF447D7EE6441557C8D590295DD629DC2B9EE5A287484A59BB790C70C07DFF589367432D628C1B0B00BE09C4CC31CD6FCE369B54746812FA282ABD3634470C48DFF2D33BAAD8F7BB57088AE3E19CF4028D8FCC890BB5D9922F552E658C51F883143EE881DD7C68E3C436A1DA718DE7D3D16F162F9CA90A8FD
(PID) Process:(7140) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
Operation:writeName:Blob
Value:
5C0000000100000004000000001000000B00000001000000100000005300650063007400690067006F0000001400000001000000140000005379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB53000000010000004300000030413022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C0190000000100000010000000EA6089055218053DD01E37E1D806EEDF0300000001000000140000002B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E0F000000010000003000000066B764A96581128168CF208E374DDA479D54E311F32457F4AEE0DBD2A6C8D171D531289E1CD22BFDBBD4CFD979625483090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B06010505070308620000000100000020000000E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD21D0000000100000010000000885010358D29A38F059B028559C95F900400000001000000100000001BFE69D191B71933A372A80FE155E5B52000000001000000E2050000308205DE308203C6A003020102021001FD6D30FCA3CA51A81BBC640E35032D300D06092A864886F70D01010C0500308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F72697479301E170D3130303230313030303030305A170D3338303131383233353935395A308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F7269747930820222300D06092A864886F70D01010105000382020F003082020A028202010080126517360EC3DB08B3D0AC570D76EDCD27D34CAD508361E2AA204D092D6409DCCE899FCC3DA9ECF6CFC1DCF1D3B1D67B3728112B47DA39C6BC3A19B45FA6BD7D9DA36342B676F2A93B2B91F8E26FD0EC162090093EE2E874C918B491D46264DB7FA306F188186A90223CBCFE13F087147BF6E41F8ED4E451C61167460851CB8614543FBC33FE7E6C9CFF169D18BD518E35A6A766C87267DB2166B1D49B7803C0503AE8CCF0DCBC9E4CFEAF0596351F575AB7FFCEF93DB72CB6F654DDC8E7123A4DAE4C8AB75C9AB4B7203DCA7F2234AE7E3B68660144E7014E46539B3360F794BE5337907343F332C353EFDBAAFE744E69C76B8C6093DEC4C70CDFE132AECC933B517895678BEE3D56FE0CD0690F1B0FF325266B336DF76E47FA7343E57E0EA566B1297C3284635589C40DC19354301913ACD37D37A7EB5D3A6C355CDB41D712DAA9490BDFD8808A0993628EB566CF2588CD84B8B13FA4390FD9029EEB124C957CF36B05A95E1683CCB867E2E8139DCC5B82D34CB3ED5BFFDEE573AC233B2D00BF3555740949D849581A7F9236E651920EF3267D1C4D17BCC9EC4326D0BF415F40A94444F499E757879E501F5754A83EFD74632FB1506509E658422E431A4CB4F0254759FA041E93D426464A5081B2DEBE78B7FC6715E1C957841E0F63D6E962BAD65F552EEA5CC62808042539B80E2BA9F24C971C073F0D52F5EDEF2F820F0203010001A3423040301D0603551D0E041604145379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF300D06092A864886F70D01010C050003820201005CD47C0DCFF7017D4199650C73C5529FCBF8CF99067F1BDA43159F9E0255579614F1523C27879428ED1F3A0137A276FC5350C0849BC66B4EBA8C214FA28E556291F36915D8BC88E3C4AA0BFDEFA8E94B552A06206D55782919EE5F305C4B241155FF249A6E5E2A2BEE0B4D9F7FF70138941495430709FB60A9EE1CAB128CA09A5EA7986A596D8B3F08FBC8D145AF18156490120F73282EC5E2244EFC58ECF0F445FE22B3EB2F8ED2D9456105C1976FA876728F8B8C36AFBF0D05CE718DE6A66F1F6CA67162C5D8D083720CF16711890C9C134C7234DFBCD571DFAA71DDE1B96C8C3C125D65DABD5712B6436BFFE5DE4D661151CF99AEEC17B6E871918CDE49FEDD3571A21527941CCF61E326BB6FA36725215DE6DD1D0B2E681B3B82AFEC836785D4985174B1B9998089FF7F78195C794A602E9240AE4C372A2CC9C762C80E5DF7365BCAE0252501B4DD1A079C77003FD0DCD5EC3DD4FABB3FCC85D66F7FA92DDFB902F7F5979AB535DAC367B0874AA9289E238EFF5C276BE1B04FF307EE002ED45987CB524195EAF447D7EE6441557C8D590295DD629DC2B9EE5A287484A59BB790C70C07DFF589367432D628C1B0B00BE09C4CC31CD6FCE369B54746812FA282ABD3634470C48DFF2D33BAAD8F7BB57088AE3E19CF4028D8FCC890BB5D9922F552E658C51F883143EE881DD7C68E3C436A1DA718DE7D3D16F162F9CA90A8FD
(PID) Process:(7140) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7140) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
E41B000059D67B776F5CDB01
(PID) Process:(7140) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
78872DF9A7D2207257B0C586A444AB4A8DDB087984185E2E0A2CF3C1F13069C5
(PID) Process:(7140) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(7140) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\13cbd2.rbs
Value:
31153263
(PID) Process:(7140) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4BE91685-1632-47FC-B563-A8A542C6664C}
Operation:writeName:VersionMajor
Value:
11
Executable files
13
Suspicious files
22
Text files
10
Unknown types
3

Dropped files

PID
Process
Filename
Type
6512AdskNLM.exeC:\Users\admin\AppData\Local\Temp\Adsk-NLM\nlm11.18.0.0_ipv4_ipv6_win64.msi —
MD5:—
SHA256:—
7140msiexec.exeC:\Windows\Installer\13cbcf.msi —
MD5:—
SHA256:—
6512AdskNLM.exeC:\Users\admin\AppData\Local\Temp\Adsk-NLM\version.dllexecutable
MD5:51F0E19B4CF164ECBA9A006C4CF3B2A5
SHA256:6F13E52D797A732435C8BB456BE08C64D0B6FADEA29F85486F4B44559D6CC95F
6512AdskNLM.exeC:\Users\admin\AppData\Local\Temp\Adsk-NLM\createlic.ps1text
MD5:58BCF86F2DABEC7015953F57348CA2AF
SHA256:B3C8309436E2D74565FF0FB1350B0A6694C2F08512758EB134CBEFD99A3C511A
6512AdskNLM.exeC:\Users\admin\AppData\Local\Temp\Adsk-NLM\UnNamed.jsonbinary
MD5:BA3088F87EDFCCEB1E084C971DB40601
SHA256:E0371582686D18B48EDB9E956057B52AA97DE8C034EE79AAB10FFB5331711651
6512AdskNLM.exeC:\Users\admin\AppData\Local\Temp\Adsk-NLM\adskflex.exeexecutable
MD5:C00B8B7B1C084718EC5D63A53AEFB1EB
SHA256:05B24756D46CE216C84878DDDC97EF9E2EEB6ECA8EC12C97E780C4D0EEF63731
6512AdskNLM.exeC:\Users\admin\AppData\Local\Temp\Adsk-NLM\AdskNLM.txttext
MD5:5D4A482D9A04454840C8859530B05A5A
SHA256:9DF6984B9D4F4F8C85ECA2C8DAD3F2A64F5A05EC0D66B99290B774AA7829D891
6512AdskNLM.exeC:\Users\admin\AppData\Local\Temp\Adsk-NLM\createlic.cmdtext
MD5:606AC2202CD0B8488C6AC4F9078F3081
SHA256:5252A0F65286025E335661873ECDC4A7E9B6B8FE7D1A4D1FF5AC08549465A54F
6512AdskNLM.exeC:\Users\admin\AppData\Local\Temp\Adsk-NLM\netapi32.dllexecutable
MD5:5C51CC926C76B23830D27A97445BF734
SHA256:655181D13D9707500BF77FF88B0B6C2595459B475ADE7B919A2B1E00402C1CEB
7140msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_A1600B7DBA43609905A99E0BEC30BB50binary
MD5:91ACBD0B15BBD5A3CA6F4AAD2B664E50
SHA256:1B001E76D806A5C4F6EDAC70F72CE1B651F68AC8AC1F6D1A58AA48AE4E8B1FE3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
42
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2512
WmiPrvSE.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
2512
WmiPrvSE.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2512
WmiPrvSE.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
2512
WmiPrvSE.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl
unknown
—
—
whitelisted
2512
WmiPrvSE.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
2512
WmiPrvSE.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAkQWITrlZ07yLmU%2BRintu4%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2040
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.176
  • 23.48.23.159
  • 23.48.23.164
  • 23.48.23.162
  • 23.48.23.156
  • 23.48.23.173
  • 23.48.23.177
  • 23.48.23.143
  • 23.48.23.147
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.128
  • 104.126.37.176
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.185
  • 104.126.37.177
  • 104.126.37.170
  • 104.126.37.137
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.68
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.0
  • 20.190.159.64
whitelisted
go.microsoft.com
  • 23.218.210.69
unknown
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AdskNLM.exe