File name:

LocalServiceComponents.exe

Full analysis: https://app.any.run/tasks/85c562f7-485c-4b54-9595-3b1dd2007f76
Verdict: Malicious activity
Analysis date: August 16, 2024, 09:57:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

AF41E440DA9A5521E6C37131ED03E588

SHA1:

95051FF072D7ECD8CB3A35930799475DE4E18CE4

SHA256:

54098BCFB2096D6E8C1FD1136B68E6CFF0FDAB44AFC87F92172A14070DF83FD6

SSDEEP:

98304:WmoTOTzqJIIW2LXqs+YDnFWZGjugC0d2DN2PhNLD6Ov6Co1fgnp4+uXxD29fi9Lh:s7/R1cjbckOw+loPFfU0hxm5ha

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • LocalServiceComponents.tmp (PID: 6580)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • LocalServiceComponents.exe (PID: 6456)
      • LocalServiceComponents.exe (PID: 6556)
      • LocalServiceComponents.tmp (PID: 6580)

    • Reads security settings of Internet Explorer

      • LocalServiceComponents.tmp (PID: 6476)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 2092)

    • Executable content was dropped or overwritten

      • LocalServiceComponents.exe (PID: 6456)
      • LocalServiceComponents.exe (PID: 6556)
      • LocalServiceComponents.tmp (PID: 6580)

    • Reads the date of Windows installation

      • LocalServiceComponents.tmp (PID: 6476)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 2092)

    • Reads the Windows owner or organization settings

      • LocalServiceComponents.tmp (PID: 6580)

    • The process drops C-runtime libraries

      • LocalServiceComponents.tmp (PID: 6580)

    • Process drops legitimate windows executable

      • LocalServiceComponents.tmp (PID: 6580)

    • Creates file in the systems drive root

      • LocalServiceControl.exe (PID: 6804)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 6576)
      • LocalServiceControl.exe (PID: 2092)
      • LocalServiceControl.exe (PID: 6304)
      • LocalServiceControl.exe (PID: 6452)

    • There is functionality for taking screenshot (YARA)

      • LocalServiceControl.exe (PID: 6804)

    • Application launched itself

      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 2092)

  • INFO

    • Checks supported languages

      • LocalServiceComponents.exe (PID: 6456)
      • LocalServiceComponents.exe (PID: 6556)
      • LocalServiceComponents.tmp (PID: 6476)
      • LocalServiceComponents.tmp (PID: 6580)
      • LocalServiceControl.exe (PID: 6804)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 2092)
      • LocalServiceControl.exe (PID: 6576)
      • LocalServiceControl.exe (PID: 6304)
      • LocalServiceControl.exe (PID: 6452)

    • Create files in a temporary directory

      • LocalServiceComponents.exe (PID: 6456)
      • LocalServiceComponents.exe (PID: 6556)
      • LocalServiceComponents.tmp (PID: 6580)

    • Reads the computer name

      • LocalServiceComponents.tmp (PID: 6476)
      • LocalServiceComponents.tmp (PID: 6580)
      • LocalServiceControl.exe (PID: 6804)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 6576)
      • LocalServiceControl.exe (PID: 2092)
      • LocalServiceControl.exe (PID: 6304)
      • LocalServiceControl.exe (PID: 6452)

    • Process checks computer location settings

      • LocalServiceComponents.tmp (PID: 6476)
      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 2092)

    • Creates files in the program directory

      • LocalServiceComponents.tmp (PID: 6580)
      • LocalServiceControl.exe (PID: 6804)

    • Manual execution by a user

      • LocalServiceControl.exe (PID: 6484)
      • LocalServiceControl.exe (PID: 6576)
      • LocalServiceControl.exe (PID: 2092)

    • Creates a software uninstall entry

      • LocalServiceComponents.tmp (PID: 6580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 14848
UninitializedDataSize: -
EntryPoint: 0x9b24
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.40
ProductVersionNumber: 1.0.0.40
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: LocalServiceComponents Setup
FileVersion: 1.0.0.40
LegalCopyright:
ProductName: LocalServiceComponents
ProductVersion: 1.0.0.40
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
11
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start localservicecomponents.exe localservicecomponents.tmp no specs localservicecomponents.exe localservicecomponents.tmp THREAT localservicecontrol.exe rundll32.exe no specs localservicecontrol.exe localservicecontrol.exe localservicecontrol.exe localservicecontrol.exe localservicecontrol.exe

Process information

PID
CMD
Path
Indicators
Parent process
2092"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6304"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
LocalServiceControl.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6452"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
LocalServiceControl.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6456"C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
LocalServiceComponents Setup
Exit code:
0
Version:
1.0.0.40
Modules
Images
c:\users\admin\appdata\local\temp\localservicecomponents.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6476"C:\Users\admin\AppData\Local\Temp\is-OALIH.tmp\LocalServiceComponents.tmp" /SL5="$C0044,14923999,53760,C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" C:\Users\admin\AppData\Local\Temp\is-OALIH.tmp\LocalServiceComponents.tmp—LocalServiceComponents.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.50.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-oalih.tmp\localservicecomponents.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6484"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6556"C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" /SPAWNWND=$302C0 /NOTIFYWND=$C0044 C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe
LocalServiceComponents.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
LocalServiceComponents Setup
Exit code:
0
Version:
1.0.0.40
Modules
Images
c:\users\admin\appdata\local\temp\localservicecomponents.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6576"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6580"C:\Users\admin\AppData\Local\Temp\is-N5FID.tmp\LocalServiceComponents.tmp" /SL5="$402AE,14923999,53760,C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" /SPAWNWND=$302C0 /NOTIFYWND=$C0044 C:\Users\admin\AppData\Local\Temp\is-N5FID.tmp\LocalServiceComponents.tmp
LocalServiceComponents.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.50.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-n5fid.tmp\localservicecomponents.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6600C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
9 705
Read events
9 672
Write events
33
Delete events
0

Modification events

(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LocalServiceControl
Operation:writeName:URL Protocol
Value:
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:LocalServiceControl
Value:
C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
Value:
HIGHDPIAWARE
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.3.5 (a)
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\LocalServiceComponents
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\LocalServiceComponents\
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
LocalServiceComponents
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:DisplayName
Value:
LocalServiceComponents
(PID) Process:(6580) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\LocalServiceComponents\unins000.exe"
Executable files
151
Suspicious files
1
Text files
23
Unknown types
2

Dropped files

PID
Process
Filename
Type
6456LocalServiceComponents.exeC:\Users\admin\AppData\Local\Temp\is-OALIH.tmp\LocalServiceComponents.tmpexecutable
MD5:9D321C7096F4BCAEB6F3D8D1636E1744
SHA256:43202B0DE2E718D35CDF7EB8B34DD35BF3FAE85C0ECD2108830230A121284322
6580LocalServiceComponents.tmpC:\Users\admin\AppData\Local\Temp\is-JLVHI.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
6580LocalServiceComponents.tmpC:\Users\admin\AppData\Local\Temp\is-JLVHI.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-J9T1G.tmpexecutable
MD5:905C6DC64BBC773C4CFF4B6ED21D214C
SHA256:1D7DC226DD83782EACC3F190078F65861B6510AF2D2286164C7348D1C50DC952
6580LocalServiceComponents.tmpC:\Users\admin\AppData\Local\Temp\is-JLVHI.tmp\ISTask.dllexecutable
MD5:86A1311D51C00B278CB7F27796EA442E
SHA256:E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\LocalServiceConfig.jsontext
MD5:A664E0EAA33AB36ADFEA9D14EDA1551D
SHA256:018D6E7217124E12517293B344A2B7460A673C8D630C83C08CF1DCE7ACC689A5
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\unins000.exeexecutable
MD5:905C6DC64BBC773C4CFF4B6ED21D214C
SHA256:1D7DC226DD83782EACC3F190078F65861B6510AF2D2286164C7348D1C50DC952
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-QVA0F.tmpexecutable
MD5:10AFDFD674FEFA35B2296D2B38B45972
SHA256:BD2E0A24083D0A4833564322306B60C1B7893FC57D5E88159BA0405208D1459A
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-DQI7J.tmptext
MD5:A664E0EAA33AB36ADFEA9D14EDA1551D
SHA256:018D6E7217124E12517293B344A2B7460A673C8D630C83C08CF1DCE7ACC689A5
6580LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-2888D.tmpexecutable
MD5:B6F0005F355A81AB41F9C5A6D95DC6C4
SHA256:64725ABAC858253D3FC8A09255929484CF8C16EC8F04652CF2EFEA329BF9930C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
45
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1360
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6996
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7048
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4088
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1292
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4088
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
2.23.209.186:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1360
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1360
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.23.209.186
  • 2.23.209.185
  • 2.23.209.187
  • 2.23.209.178
  • 2.23.209.179
  • 2.23.209.183
  • 2.23.209.177
  • 2.23.209.175
  • 2.23.209.176
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.76
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
th.bing.com
  • 2.23.209.156
  • 2.23.209.166
  • 2.23.209.168
  • 2.23.209.158
  • 2.23.209.167
  • 2.23.209.162
  • 2.23.209.160
  • 2.23.209.150
  • 2.23.209.148
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
Process
Message
LocalServiceControl.exe
QCoreApplication::applicationDirPath: Please instantiate the QApplication object first
LocalServiceControl.exe
5
LocalServiceControl.exe
"No such file or directory"
LocalServiceControl.exe
WriteLocalFile: "C:\\Users\\admin\\WebComponents\\local.json"
LocalServiceControl.exe
QCoreApplication::applicationDirPath: Please instantiate the QApplication object first
LocalServiceControl.exe
5
LocalServiceControl.exe
"No such file or directory"
LocalServiceControl.exe
WriteLocalFile: "C:\\Users\\admin\\WebComponents\\local.json"
LocalServiceControl.exe
QCoreApplication::applicationDirPath: Please instantiate the QApplication object first
LocalServiceControl.exe
5
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LocalServiceComponents.exe