File name:

INIS_EX_SHA2_64bit_3.3.2.40.exe

Full analysis: https://app.any.run/tasks/6f374476-3af1-441b-b782-53d860f03e40
Verdict: Malicious activity
Analysis date: May 03, 2025, 02:25:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

087D430EB42EE66CDDC8944896AE6FA5

SHA1:

452ACFEF9603E2CBCFCB3957D0114A6B6DE52D97

SHA256:

5AF428A29BCA004EDD4F17C57A8C654472CC25C72999F03DCCF3FE1149FC22AE

SSDEEP:

98304:OjcTvUegNGo1/+QfPlZxsCMG5VOz9+tc84uTz6CdrVq4k4R9aIpKZpPaybAc4U5t:OeHqVGkJB5ZFGwU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)
      • iniline_crosswebex_Install-x64.exe (PID: 7848)

    • Executing a file with an untrusted certificate

      • iniline_crosswebex_Install-x64.exe (PID: 7848)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)
      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)

    • Executable content was dropped or overwritten

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)
      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)
      • regsvr32.exe (PID: 7820)
      • iniline_crosswebex_Install-x64.exe (PID: 7848)

    • Application launched itself

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)
      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)

    • The process drops C-runtime libraries

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)

    • Creates a software uninstall entry

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 7788)
      • regsvr32.exe (PID: 7820)
      • regsvr32.exe (PID: 7888)

    • Process drops legitimate windows executable

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)

    • Reads security settings of Internet Explorer

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)

    • There is functionality for taking screenshot (YARA)

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)

    • Creates or modifies Windows services

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)

    • Executes as Windows Service

      • IniClientSvc_x64.exe (PID: 7920)

  • INFO

    • Create files in a temporary directory

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)
      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)

    • The sample compiled with korean language support

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)
      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)
      • regsvr32.exe (PID: 7820)

    • Checks supported languages

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)
      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)
      • INISAFETrayEX.exe (PID: 7752)
      • iniline_crosswebex_Install-x64.exe (PID: 7848)
      • IniClientSvc_x64.exe (PID: 7920)
      • INISAFEAdminUtil.exe (PID: 7960)

    • Process checks computer location settings

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)

    • The sample compiled with english language support

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)
      • regsvr32.exe (PID: 7820)

    • Reads Environment values

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)
      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)

    • Creates files in the program directory

      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)
      • iniline_crosswebex_Install-x64.exe (PID: 7848)

    • Reads the machine GUID from the registry

      • INISAFETrayEX.exe (PID: 7752)
      • INISAFEAdminUtil.exe (PID: 7960)
      • IniClientSvc_x64.exe (PID: 7920)

    • Creates files or folders in the user directory

      • regsvr32.exe (PID: 7820)

    • Reads the computer name

      • INISAFETrayEX.exe (PID: 7752)
      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7632)
      • INIS_EX_SHA2_64bit_3.3.2.40.exe (PID: 7484)
      • IniClientSvc_x64.exe (PID: 7920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:08:05 00:46:27+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 117760
UninitializedDataSize: 1024
EntryPoint: 0x3217
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.3.2.40
ProductVersionNumber: 3.3.2.40
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Korean
CharacterSet: Windows, Korea (Shift - KSC 5601)
Comments: -
CompanyName: Initech, Inc.
FileDescription: INISAFE CrossWeb EX V3 (64bit) Installer
FileVersion: 3.3.2.40
LegalCopyright: Initech
LegalTrademarks: INISAFE CrossWeb EX V3 (64bit) is a trademark of Initech(64bit)
ProductName: INISAFE CrossWeb EX V3 (64bit)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
14
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inis_ex_sha2_64bit_3.3.2.40.exe inis_ex_sha2_64bit_3.3.2.40.exe webproccheck.exe no specs inisafetrayex.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe iniline_crosswebex_install-x64.exe regsvr32.exe no specs regsvr32.exe no specs iniclientsvc_x64.exe no specs inisafeadminutil.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7344C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7484"C:\Users\admin\AppData\Local\Temp\INIS_EX_SHA2_64bit_3.3.2.40.exe" C:\Users\admin\AppData\Local\Temp\INIS_EX_SHA2_64bit_3.3.2.40.exe
explorer.exe
User:
admin
Company:
Initech, Inc.
Integrity Level:
MEDIUM
Description:
INISAFE CrossWeb EX V3 (64bit) Installer
Exit code:
0
Version:
3.3.2.40
Modules
Images
c:\users\admin\appdata\local\temp\inis_ex_sha2_64bit_3.3.2.40.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7632"C:\Users\admin\AppData\Local\Temp\INIS_EX_SHA2_64bit_3.3.2.40.exe" /UAC:702B0 /NCRC C:\Users\admin\AppData\Local\Temp\INIS_EX_SHA2_64bit_3.3.2.40.exe
INIS_EX_SHA2_64bit_3.3.2.40.exe
User:
admin
Company:
Initech, Inc.
Integrity Level:
HIGH
Description:
INISAFE CrossWeb EX V3 (64bit) Installer
Exit code:
0
Version:
3.3.2.40
Modules
Images
c:\users\admin\appdata\local\temp\inis_ex_sha2_64bit_3.3.2.40.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7668WebProcCheck.exeC:\Program Files\INITECH\INISAFE Web EX Client\WebProcCheck.exe—INIS_EX_SHA2_64bit_3.3.2.40.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3222601730
Modules
Images
c:\program files\initech\inisafe web ex client\webproccheck.exe
c:\windows\system32\ntdll.dll
7752"C:\Program Files\INITECH\INISAFE Web EX Client\INISAFETrayEX.exe" /RegServerC:\Program Files\INITECH\INISAFE Web EX Client\INISAFETrayEX.exe—INIS_EX_SHA2_64bit_3.3.2.40.exe
User:
admin
Company:
INITECH (C)
Integrity Level:
HIGH
Description:
INISAFE CrossWeb EX Client Tray
Exit code:
0
Version:
1, 3, 0, 7
Modules
Images
c:\program files\initech\inisafe web ex client\inisafetrayex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7776Regsvr32 /s "C:\Program Files\INITECH\INISAFE Web EX Client\INIExtensionForCS.dll"C:\Windows\SysWOW64\regsvr32.exe—INIS_EX_SHA2_64bit_3.3.2.40.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7788 /s "C:\Program Files\INITECH\INISAFE Web EX Client\INIExtensionForCS.dll"C:\Windows\System32\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7808Regsvr32 /s "C:\Program Files\INITECH\INISAFE Web EX Client\INISAFEWeb60.dll"C:\Windows\SysWOW64\regsvr32.exe—INIS_EX_SHA2_64bit_3.3.2.40.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7820 /s "C:\Program Files\INITECH\INISAFE Web EX Client\INISAFEWeb60.dll"C:\Windows\System32\regsvr32.exe
regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7848"C:\Program Files\INITECH\INISAFE Web EX Client\iniline_crosswebex_Install-x64.exe" /SC:\Program Files\INITECH\INISAFE Web EX Client\iniline_crosswebex_Install-x64.exe
INIS_EX_SHA2_64bit_3.3.2.40.exe
User:
admin
Company:
iniLINE Co., Ltd.
Integrity Level:
HIGH
Description:
iniLINE CrossEX 64bit
Exit code:
0
Version:
1.0.1.1101
Modules
Images
c:\program files\initech\inisafe web ex client\iniline_crosswebex_install-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
585 706
Read events
585 668
Write events
37
Delete events
1

Modification events

(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery
Operation:writeName:AutoRecover
Value:
2
(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery
Operation:writeName:AutoRecover
Value:
25
(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7DAA4A48-E2DA-48e8-A133-653F364D5A23}
Operation:writeName:AppPath
Value:
C:\Program Files\INITECH\INISAFE Web EX Client
(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7DAA4A48-E2DA-48e8-A133-653F364D5A23}
Operation:writeName:AppName
Value:
INISAFETrayEX.exe
(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7DAA4A48-E2DA-48e8-A133-653F364D5A23}
Operation:writeName:Policy
Value:
3
(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC0DE793-496A-D310-86C1-388B04D2E9D5}
Operation:writeName:AppPath
Value:
C:\Program Files\INITECH\INISAFE Web EX Client
(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC0DE793-496A-D310-86C1-388B04D2E9D5}
Operation:writeName:AppName
Value:
INISAFEWeb60.dll
(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CC0DE793-496A-D310-86C1-388B04D2E9D5}
Operation:writeName:Policy
Value:
3
(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWebEX64
Operation:writeName:UninstallString
Value:
C:\Program Files\INITECH\INISAFE Web EX Client\UnINIS_EX64.exe
(PID) Process:(7632) INIS_EX_SHA2_64bit_3.3.2.40.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWebEX64
Operation:writeName:DisplayName
Value:
INISAFE CrossWeb EX V3 (64bit)
Executable files
67
Suspicious files
39
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
7632INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Program Files\NPKI\KISA\FF8A46723358E8488822AA1768DA1648098B3591_3.derbinary
MD5:9F6C1F0F07AC1921F915BBD5C72CD82A
SHA256:956057517FF3BB35049342288C1C9DCE852DACA652B465E9747253B5F93B1F5E
7484INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Users\admin\AppData\Local\Temp\nsrBA5B.tmp\UAC.LNGtext
MD5:1E72C0B7743619809B7CDA824D2A1ECF
SHA256:F2E214452E69EDAF602E30D06EE186D072B1D2EC04B813B458C1E31B56ECE16B
7632INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Program Files\NPKI\KISA\BFB627D8035A76654C6101415631E58B7B3AD9CC_4.derbinary
MD5:689B17C654E0E0E099551642F75A86D8
SHA256:6FDB3F76C8B801A75338D8A50A7C02879F6198B57E594D318D3832900FEDCD79
7632INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Users\admin\AppData\Local\Temp\nsnBD97.tmp\UAC.LNGtext
MD5:1E72C0B7743619809B7CDA824D2A1ECF
SHA256:F2E214452E69EDAF602E30D06EE186D072B1D2EC04B813B458C1E31B56ECE16B
7632INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Windows\SysWOW64\ISF_CheckSFilter.dllexecutable
MD5:FF34E6243C5DCC08CA882D7F22B2F1D8
SHA256:F37E2F10FC8CACF6ABB22BDB641F3BC63C6CDA18E8659FAA8DFA549DFE4450A4
7632INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Windows\SysWOW64\msvcp71.dllexecutable
MD5:561FA2ABB31DFA8FAB762145F81667C2
SHA256:DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
7632INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Windows\SysWOW64\MFC71.dllexecutable
MD5:F35A584E947A5B401FEB0FE01DB4A0D7
SHA256:4DA5EFDC46D126B45DAEEE8BC69C0BA2AA243589046B7DFD12A7E21B9BEE6A32
7632INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Program Files\INITECH\INISAFE Web EX Client\WebProcCheck.exeexecutable
MD5:0E06F271836171406912083077206CA5
SHA256:B04D22F4CFCAB52265B85AE170B866071691D213D0632795635EC77DEACDB880
7632INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Users\admin\AppData\Local\Temp\nsnBD97.tmp\System.dllexecutable
MD5:6F5257C0B8C0EF4D440F4F4FCE85FB1B
SHA256:B7CCB923387CC346731471B20FC3DF1EAD13EC8C2E3147353C71BB0BD59BC8B1
7632INIS_EX_SHA2_64bit_3.3.2.40.exeC:\Program Files\INITECH\INISAFE Web EX Client\WebProcCheck_2025050322526executable
MD5:0E06F271836171406912083077206CA5
SHA256:B04D22F4CFCAB52265B85AE170B866071691D213D0632795635EC77DEACDB880
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
27
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4628
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4628
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4156
SystemSettings.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4156
SystemSettings.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1196
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4628
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
4628
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
cxcs.microsoft.net
  • 23.215.18.136
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.201
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
INIS_EX_SHA2_64bit_3.3.2.40.exe