File name:

LocalServiceComponents.exe

Full analysis: https://app.any.run/tasks/85c562f7-485c-4b54-9595-3b1dd2007f76
Verdict: Malicious activity
Analysis date: August 16, 2024, 09:57:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

AF41E440DA9A5521E6C37131ED03E588

SHA1:

95051FF072D7ECD8CB3A35930799475DE4E18CE4

SHA256:

54098BCFB2096D6E8C1FD1136B68E6CFF0FDAB44AFC87F92172A14070DF83FD6

SSDEEP:

98304:WmoTOTzqJIIW2LXqs+YDnFWZGjugC0d2DN2PhNLD6Ov6Co1fgnp4+uXxD29fi9Lh:s7/R1cjbckOw+loPFfU0hxm5ha

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • LocalServiceComponents.tmp (PID: 6580)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • LocalServiceComponents.exe (PID: 6456)
      • LocalServiceComponents.exe (PID: 6556)
      • LocalServiceComponents.tmp (PID: 6580)

    • Drops the executable file immediately after the start

      • LocalServiceComponents.exe (PID: 6456)
      • LocalServiceComponents.tmp (PID: 6580)
      • LocalServiceComponents.exe (PID: 6556)

    • Reads security settings of Internet Explorer

      • LocalServiceComponents.tmp (PID: 6476)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 2092)

    • Reads the date of Windows installation

      • LocalServiceComponents.tmp (PID: 6476)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 2092)

    • Reads the Windows owner or organization settings

      • LocalServiceComponents.tmp (PID: 6580)

    • Process drops legitimate windows executable

      • LocalServiceComponents.tmp (PID: 6580)

    • The process drops C-runtime libraries

      • LocalServiceComponents.tmp (PID: 6580)

    • Creates file in the systems drive root

      • LocalServiceControl.exe (PID: 6804)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 6576)
      • LocalServiceControl.exe (PID: 6452)
      • LocalServiceControl.exe (PID: 2092)
      • LocalServiceControl.exe (PID: 6304)

    • There is functionality for taking screenshot (YARA)

      • LocalServiceControl.exe (PID: 6804)

    • Application launched itself

      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 2092)

  • INFO

    • Reads the computer name

      • LocalServiceComponents.tmp (PID: 6476)
      • LocalServiceComponents.tmp (PID: 6580)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 6804)
      • LocalServiceControl.exe (PID: 6452)
      • LocalServiceControl.exe (PID: 6576)
      • LocalServiceControl.exe (PID: 2092)
      • LocalServiceControl.exe (PID: 6304)

    • Checks supported languages

      • LocalServiceComponents.exe (PID: 6456)
      • LocalServiceComponents.exe (PID: 6556)
      • LocalServiceComponents.tmp (PID: 6580)
      • LocalServiceControl.exe (PID: 6804)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 6452)
      • LocalServiceControl.exe (PID: 6576)
      • LocalServiceControl.exe (PID: 2092)
      • LocalServiceControl.exe (PID: 6304)
      • LocalServiceComponents.tmp (PID: 6476)

    • Create files in a temporary directory

      • LocalServiceComponents.exe (PID: 6456)
      • LocalServiceComponents.exe (PID: 6556)
      • LocalServiceComponents.tmp (PID: 6580)

    • Creates files in the program directory

      • LocalServiceComponents.tmp (PID: 6580)
      • LocalServiceControl.exe (PID: 6804)

    • Creates a software uninstall entry

      • LocalServiceComponents.tmp (PID: 6580)

    • Process checks computer location settings

      • LocalServiceComponents.tmp (PID: 6476)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 2092)

    • Manual execution by a user

      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 6576)
      • LocalServiceControl.exe (PID: 2092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 14848
UninitializedDataSize: -
EntryPoint: 0x9b24
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.40
ProductVersionNumber: 1.0.0.40
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: LocalServiceComponents Setup
FileVersion: 1.0.0.40
LegalCopyright:
ProductName: LocalServiceComponents
ProductVersion: 1.0.0.40
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
11
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start localservicecomponents.exe localservicecomponents.tmp no specs localservicecomponents.exe localservicecomponents.tmp THREAT localservicecontrol.exe rundll32.exe no specs localservicecontrol.exe localservicecontrol.exe localservicecontrol.exe localservicecontrol.exe localservicecontrol.exe

Process information

PID
CMD
Path
Indicators
Parent process
2092"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6304"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
LocalServiceControl.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6452"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
LocalServiceControl.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6456"C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
LocalServiceComponents Setup
Exit code:
0
Version:
1.0.0.40
Modules
Images
c:\users\admin\appdata\local\temp\localservicecomponents.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6476"C:\Users\admin\AppData\Local\Temp\is-OALIH.tmp\LocalServiceComponents.tmp" /SL5="$C0044,14923999,53760,C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" C:\Users\admin\AppData\Local\Temp\is-OALIH.tmp\LocalServiceComponents.tmp—LocalServiceComponents.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.50.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-oalih.tmp\localservicecomponents.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6484"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6556"C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" /SPAWNWND=$302C0 /NOTIFYWND=$C0044 C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe
LocalServiceComponents.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
LocalServiceComponents Setup
Exit code:
0
Version:
1.0.0.40
Modules
Images
c:\users\admin\appdata\local\temp\localservicecomponents.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6576"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6580"C:\Users\admin\AppData\Local\Temp\is-N5FID.tmp\LocalServiceComponents.tmp" /SL5="$402AE,14923999,53760,C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" /SPAWNWND=$302C0 /NOTIFYWND=$C0044 C:\Users\admin\AppData\Local\Temp\is-N5FID.tmp\LocalServiceComponents.tmp
LocalServiceComponents.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.50.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-n5fid.tmp\localservicecomponents.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6600C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
9 705
Read events
9 672
Write events
33
Delete events
0

Modification events

(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LocalServiceControl
Operation:writeName:URL Protocol
Value:
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:LocalServiceControl
Value:
C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
Value:
HIGHDPIAWARE
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.3.5 (a)
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\LocalServiceComponents
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\LocalServiceComponents\
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
LocalServiceComponents
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:DisplayName
Value:
LocalServiceComponents
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\LocalServiceComponents\unins000.exe"
Executable files
151
Suspicious files
1
Text files
23
Unknown types
2

Dropped files

PID
Process
Filename
Type
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-J9T1G.tmpexecutable
MD5:905C6DC64BBC773C4CFF4B6ED21D214C
SHA256:1D7DC226DD83782EACC3F190078F65861B6510AF2D2286164C7348D1C50DC952
6580LocalServiceComponents.tmpC:\Users\admin\AppData\Local\Temp\is-JLVHI.tmp\_isetup\_RegDLL.tmpexecutable
MD5:0EE914C6F0BB93996C75941E1AD629C6
SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\unins000.exeexecutable
MD5:905C6DC64BBC773C4CFF4B6ED21D214C
SHA256:1D7DC226DD83782EACC3F190078F65861B6510AF2D2286164C7348D1C50DC952
6556LocalServiceComponents.exeC:\Users\admin\AppData\Local\Temp\is-N5FID.tmp\LocalServiceComponents.tmpexecutable
MD5:9D321C7096F4BCAEB6F3D8D1636E1744
SHA256:43202B0DE2E718D35CDF7EB8B34DD35BF3FAE85C0ECD2108830230A121284322
6580LocalServiceComponents.tmpC:\Users\admin\AppData\Local\Temp\is-JLVHI.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
6456LocalServiceComponents.exeC:\Users\admin\AppData\Local\Temp\is-OALIH.tmp\LocalServiceComponents.tmpexecutable
MD5:9D321C7096F4BCAEB6F3D8D1636E1744
SHA256:43202B0DE2E718D35CDF7EB8B34DD35BF3FAE85C0ECD2108830230A121284322
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-L039R.tmpexecutable
MD5:219EFDC76271482EBFF0963E73221E84
SHA256:7B5BF711E78253C2DF39F1E0E1A8F926C952A071B42E9DB3F3CB7AFB190449A3
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-LCUUP.tmpexecutable
MD5:CEB25B8C43E4DC3257AE3CEF9C937671
SHA256:E1F95D02E9C621B5E15600DF81F1CBD853ED823BA1197F85BAE17924AA0C2EB8
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-DQI7J.tmptext
MD5:A664E0EAA33AB36ADFEA9D14EDA1551D
SHA256:018D6E7217124E12517293B344A2B7460A673C8D630C83C08CF1DCE7ACC689A5
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\AudioIntercom.dllexecutable
MD5:B6F0005F355A81AB41F9C5A6D95DC6C4
SHA256:64725ABAC858253D3FC8A09255929484CF8C16EC8F04652CF2EFEA329BF9930C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
45
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1360
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6996
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7048
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4088
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1292
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4088
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
2.23.209.186:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1360
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1360
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.23.209.186
  • 2.23.209.185
  • 2.23.209.187
  • 2.23.209.178
  • 2.23.209.179
  • 2.23.209.183
  • 2.23.209.177
  • 2.23.209.175
  • 2.23.209.176
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.76
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
th.bing.com
  • 2.23.209.156
  • 2.23.209.166
  • 2.23.209.168
  • 2.23.209.158
  • 2.23.209.167
  • 2.23.209.162
  • 2.23.209.160
  • 2.23.209.150
  • 2.23.209.148
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
Process
Message
LocalServiceControl.exe
QCoreApplication::applicationDirPath: Please instantiate the QApplication object first
LocalServiceControl.exe
5
LocalServiceControl.exe
"No such file or directory"
LocalServiceControl.exe
WriteLocalFile: "C:\\Users\\admin\\WebComponents\\local.json"
LocalServiceControl.exe
QCoreApplication::applicationDirPath: Please instantiate the QApplication object first
LocalServiceControl.exe
5
LocalServiceControl.exe
"No such file or directory"
LocalServiceControl.exe
WriteLocalFile: "C:\\Users\\admin\\WebComponents\\local.json"
LocalServiceControl.exe
QCoreApplication::applicationDirPath: Please instantiate the QApplication object first
LocalServiceControl.exe
5
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LocalServiceComponents.exe