File name:

_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe

Full analysis: https://app.any.run/tasks/6d89b3e7-ee8c-4e7e-98c5-4c7ce6ecf0b6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 08, 2025, 22:51:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
auto-startup
webdav
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

6AD65B03E75BC5509BA3104510178EE6

SHA1:

DBA73F97938D2DAB4BF8FB8076B363DB82AD3A16

SHA256:

4D74EB72321C5137ED364541DEEF19DDC30593FFF62ABAB2A3D17A0BAD7BD5C6

SSDEEP:

98304:fbw8QGAJLH2RgfgKQDQgxatAce/Unba+O+CB3jD9l:9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)

    • Scans artifacts that could help determine the target

      • RUXIMICS.exe (PID: 4972)

  • SUSPICIOUS

    • Process requests binary or script from the Internet

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)

    • Reads security settings of Internet Explorer

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)

    • Potential Corporate Privacy Violation

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)

    • Starts CMD.EXE for commands execution

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)

    • The system shut down or reboot

      • cmd.exe (PID: 3636)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4132)
      • updater.exe (PID: 4156)

    • Application launched itself

      • updater.exe (PID: 4156)

  • INFO

    • The sample compiled with chinese language support

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)

    • Reads the computer name

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)
      • updater.exe (PID: 4156)
      • RUXIMICS.exe (PID: 4972)
      • PLUGScheduler.exe (PID: 4132)

    • Checks proxy server information

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)

    • Checks supported languages

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)
      • PLUGScheduler.exe (PID: 4132)
      • updater.exe (PID: 4156)
      • RUXIMICS.exe (PID: 4972)
      • updater.exe (PID: 5000)
      • RUXIMICS.exe (PID: 5156)

    • Launching a file from the Startup directory

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)

    • Creates files or folders in the user directory

      • _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe (PID: 3540)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 4132)
      • RUXIMICS.exe (PID: 5156)

    • Reads Environment values

      • RUXIMICS.exe (PID: 4972)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 4156)

    • Reads the machine GUID from the registry

      • RUXIMICS.exe (PID: 4972)

    • Reads the software policy settings

      • RUXIMICS.exe (PID: 4972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (17.3)
.dll | Win32 Dynamic Link Library (generic) (4.1)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:02 15:02:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 1579520
InitializedDataSize: 1921536
UninitializedDataSize: -
EntryPoint: 0x14ba09
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: TODO: <公司名>
FileDescription: DownLoad
FileVersion: 1.0.0.1
InternalName: DownLoad.exe
LegalCopyright: TODO: (C) <公司名>。 保留所有权利。
OriginalFileName: DownLoad.exe
ProductName: TODO: <产品名>
ProductVersion: 1.0.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
276
Monitored processes
9
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe cmd.exe no specs conhost.exe no specs shutdown.exe no specs plugscheduler.exe no specs updater.exe no specs ruximics.exe updater.exe no specs ruximics.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3540"C:\Users\admin\Desktop\_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe" C:\Users\admin\Desktop\_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
explorer.exe
User:
admin
Company:
TODO: <公司名>
Integrity Level:
MEDIUM
Description:
DownLoad
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\desktop\_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3636C:\WINDOWS\system32\cmd.exe /c "shutdown /r /t 0"C:\Windows\SysWOW64\cmd.exe—_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3756\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4132"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4156"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4972%ProgramFiles%\RUXIM\RUXIMICS.EXE /onlyloadcampaignsC:\Program Files\RUXIM\RUXIMICS.exe
PLUGScheduler.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Reusable UX Interaction Manager
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\ruximics.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
5000"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2a4,0x2a8,0x2ac,0xd0,0x2b0,0x105c460,0x105c46c,0x105c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5156%ProgramFiles%\RUXIM\RUXIMICS.EXE /nonetworkC:\Program Files\RUXIM\RUXIMICS.exe—PLUGScheduler.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Reusable UX Interaction Manager
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\ruximics.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
6732shutdown /r /t 0C:\Windows\SysWOW64\shutdown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 969
Read events
4 946
Write events
23
Delete events
0

Modification events

(PID) Process:(3540) _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3540) _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3540) _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3540) _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3540) _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3540) _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3540) _4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4132) PLUGScheduler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\PLUG\Scheduler\Activity\State\OneSettings
Operation:writeName:ExecutionCount
Value:
9
(PID) Process:(4132) PLUGScheduler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\PLUG\Scheduler\Activity\State\OneSettings
Operation:writeName:LastExecutionResult
Value:
0
(PID) Process:(4132) PLUGScheduler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\PLUG\Scheduler\Activity\State\OneSettings
Operation:writeName:LastExecutionExitCode
Value:
0
Executable files
0
Suspicious files
0
Text files
1
Unknown types
128

Dropped files

PID
Process
Filename
Type
4132PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.050.etletl
MD5:C1F87CF12DD702D2185E703BA004D216
SHA256:9D993487866C9538DC19F281A6346E1796E7478C7C164D61437AF6E698C66125
3540_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnklnk
MD5:64C03FC25A3910E81DD3546B9F3AD9DC
SHA256:8C510C1B0BF0150FDA99F7ECCA9D82D7671C9839CC719226B5F06E95BCF814AF
4132PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.037.etletl
MD5:F9D8BBFBB3073C1ACA1D6D611F3937CC
SHA256:BC040E242B9963E9ACDEA9ED8DD6FEDC97EFBE93816250C1801A822539E8602B
4132PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.041.etletl
MD5:AB9303129E2242D02DC2069E5A4F3896
SHA256:9031A5BD681D52A903A2BCA625F6D9D8B1456B26D2335CA8170BB39A2FE8F2A0
4132PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.043.etletl
MD5:2FC3641AD4F7A4A3C83C9F3014B0F0A5
SHA256:92C3D62BC45E1DDFC77DA511ACE5E47D021D69BA625D2766AF91E376102F11AC
4132PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.035.etletl
MD5:B2DCCF84AD3730CC025D433B03860DF6
SHA256:D92260469906F2847FA4C38A8355BE35383B0BE9B9D2AB9A8801C7FFF8CBC926
4132PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.038.etletl
MD5:4558A195AA3B11F3AF5D839B627BF95A
SHA256:C6F97F8924A2199569D3B36355531D342FDDC2F84DADF410F34E0D7E8C5A50B2
4132PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.036.etletl
MD5:C24F2F73AE0F37A15E43051889BE2387
SHA256:654E4670D1D662456E5ABB532CFD8E7E50162D6763F3AB09FFEDA10B7C9A92D2
4132PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.031.etletl
MD5:938B477DD8384852FC05E3D20D5E3CC3
SHA256:72AF2AAE3F5B7FD51C5BF0AF8F7AAAED0D4A161942766D1C4696BD4958EC98BD
4132PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.034.etletl
MD5:C18A737E8085C1AA9BC777F17DA7E01F
SHA256:B448014A0105F38BD004DF52D1F43631FF013CCA5F42936EB17A6ED4946C930E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
57
TCP/UDP connections
62
DNS requests
29
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3540
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
GET
403
47.254.187.92:80
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.exe
unknown
—
—
malicious
3540
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
GET
—
47.254.187.92:80
http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dll
unknown
—
—
malicious
1268
svchost.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3688
RUXIMICS.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3688
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
52.109.28.46:443
https://officeclient.microsoft.com/config16/?syslcid=1033&build=16.0.16026&crev=3
unknown
xml
181 Kb
whitelisted
3540
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
GET
200
47.254.187.92:80
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3688
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3540
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
47.254.187.92:80
bruplong.oss-accelerate.aliyuncs.com
Alibaba US Technology Co., Ltd.
DE
malicious
5944
MoUsoCoreWorker.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3688
RUXIMICS.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 172.217.16.206
whitelisted
bruplong.oss-accelerate.aliyuncs.com
  • 47.254.187.92
malicious
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.6
  • 23.216.77.18
  • 23.216.77.41
  • 23.216.77.42
  • 23.216.77.22
  • 23.216.77.28
  • 23.216.77.20
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
watson.events.data.microsoft.com
  • 52.182.143.212
whitelisted
self.events.data.microsoft.com
  • 20.189.173.8
  • 52.182.143.214
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted
www.bing.com
  • 2.16.241.201
  • 2.16.241.218
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
3540
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
Potential Corporate Privacy Violation
ET INFO User-Agent (Launcher)
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
3540
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
Potential Corporate Privacy Violation
ET INFO User-Agent (Launcher)
3540
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
Potential Corporate Privacy Violation
ET INFO User-Agent (Launcher)
3540
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
Misc activity
ET INFO LNK File Downloaded via HTTP
3540
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] A suspicious Lnk file was downloaded causing the exe file to be executed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6.exe