File name:

ffdec_22.0.2_nightly3027_setup.exe

Full analysis: https://app.any.run/tasks/07b5d4d6-435c-4bb6-928a-c73c88205181
Verdict: Malicious activity
Analysis date: March 09, 2025, 22:26:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive, 7 sections
MD5:

92D256FA1225812313DB3187A6985760

SHA1:

C2E869038670594D621AAE3FD7F973A1E8FB7C73

SHA256:

615946C60EFC8230866C3B338C5B53827C27808297677F52ED4D161DFEA7C1D2

SSDEEP:

98304:MWh/+ojZmPNV13Go5SrKj9QPZDsiSt9JLIkzPD7Zfgmvdvuf/IqWS7yZLs2epXwz:uBvfM+OHbOh9lWuNt/qK6wHwhy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • There is functionality for taking screenshot (YARA)

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • The process creates files with name similar to system file names

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)

    • Checks for Java to be installed

      • ffdec.exe (PID: 7152)
      • ffdec.exe (PID: 6572)

    • Creates a software uninstall entry

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)

    • Searches for installed software

      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 3768)

  • INFO

    • Checks supported languages

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • ffdec.exe (PID: 7152)
      • javaw.exe (PID: 3888)
      • ffdec.exe (PID: 6572)
      • javaw.exe (PID: 4736)
      • ShellExperienceHost.exe (PID: 3768)

    • Reads the computer name

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • ffdec.exe (PID: 7152)
      • javaw.exe (PID: 3888)
      • ffdec.exe (PID: 6572)
      • javaw.exe (PID: 4736)
      • ShellExperienceHost.exe (PID: 3768)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 1512)
      • BackgroundTransferHost.exe (PID: 6964)
      • BackgroundTransferHost.exe (PID: 3020)
      • BackgroundTransferHost.exe (PID: 5504)
      • BackgroundTransferHost.exe (PID: 1088)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 6964)
      • slui.exe (PID: 6476)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6964)
      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6964)
      • slui.exe (PID: 6476)

    • Creates files in the program directory

      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)
      • javaw.exe (PID: 3888)

    • Create files in a temporary directory

      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)
      • ffdec_22.0.2_nightly3027_setup.exe (PID: 5728)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 3888)
      • javaw.exe (PID: 4736)

    • Manual execution by a user

      • ffdec.exe (PID: 6572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:29 12:07:21+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.42
CodeSize: 37888
InitializedDataSize: 61952
UninitializedDataSize: 129024
EntryPoint: 0x45a4
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
15
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ffdec_22.0.2_nightly3027_setup.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs ffdec.exe no specs javaw.exe icacls.exe no specs conhost.exe no specs ffdec.exe no specs javaw.exe slui.exe shellexperiencehost.exe no specs ffdec_22.0.2_nightly3027_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1088"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1512"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3020"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3768"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
3888"C:\Users\admin\AppData\Local\Temp\ffdec_22.0.2_nightly3027_setup.exe" C:\Users\admin\AppData\Local\Temp\ffdec_22.0.2_nightly3027_setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\ffdec_22.0.2_nightly3027_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3888"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -Xmx4091m -Djava.net.preferIPv4Stack=true -Djna.nosys=true -Djava.util.Arrays.useLegacyMergeSort=true -Dl5j.pid=7152 -Dl5j.encargs=1 -jar "C:\PROGRA~2\FFDec\ffdec.jar"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
ffdec.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4628C:\WINDOWS\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4736"C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -Xmx4091m -Djava.net.preferIPv4Stack=true -Djna.nosys=true -Djava.util.Arrays.useLegacyMergeSort=true -Dl5j.pid=6572 -Dl5j.encargs=1 -jar "C:\PROGRA~2\FFDec\ffdec.jar" C%3A%5CUsers%5Cadmin%5CDesktop%5Cgtaiv.swfC:\Program Files\Java\jre1.8.0_271\bin\javaw.exe
ffdec.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5504"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
4 950
Read events
4 915
Write events
34
Delete events
1

Modification events

(PID) Process:(1512) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1512) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1512) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6964) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6964) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6964) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3020) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1088) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
36
Suspicious files
23
Text files
221
Unknown types
0

Dropped files

PID
Process
Filename
Type
6964BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0ac36734-3142-4525-a8cf-bb8f9aa2ff6d.down_data —
MD5:—
SHA256:—
6964BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:AD65BBA990E9A146C8789184B44B3332
SHA256:C57BBFD31CE81C873E766C5DEEE854B02BFF08020DF9BE1A3B4562BD67CC932D
5728ffdec_22.0.2_nightly3027_setup.exeC:\Users\admin\AppData\Local\Temp\nsdBFC9.tmp\modern-header.bmpimage
MD5:6C89D5A7C988506755C68DE07E6505F2
SHA256:7324B33545FC9FDD9C0FEE0597ABE552982E6FF755B9EC1D7F81927D9450DE9C
5728ffdec_22.0.2_nightly3027_setup.exeC:\Program Files (x86)\FFDec\ffdec.battext
MD5:D1C38A79BEF0B2E148CBF0326A104533
SHA256:ED9F3D97EF0F1447E5CD048725C9DF4AC009CC2C7EC93A2ADE43B36854878690
5728ffdec_22.0.2_nightly3027_setup.exeC:\Program Files (x86)\FFDec\ffdec-cli.jarcompressed
MD5:8F2861481AE21F4761ACD63EB0665BD6
SHA256:993A7F225D70B88CC3F9240ECF5849FE6B3B3FCFC6A2898A7206D3824C275967
5728ffdec_22.0.2_nightly3027_setup.exeC:\Program Files (x86)\FFDec\ffdec-cli.exeexecutable
MD5:8217EC4EFD091713C52FA1BB0B58AC22
SHA256:C03AD5D22008246B9F2523A70830502ED0D01610F4054912B43AE70F58DDDD86
5728ffdec_22.0.2_nightly3027_setup.exeC:\Program Files (x86)\FFDec\license.txttext
MD5:3C34AFDC3ADF82D2448F12715A255122
SHA256:0B383D5A63DA644F628D99C33976EA6487ED89AAA59F0B3257992DEAC1171E6B
5728ffdec_22.0.2_nightly3027_setup.exeC:\Program Files (x86)\FFDec\translator.lnkbinary
MD5:105F02425D24A935B02F927B73C3BEE9
SHA256:7FB1CFE89E1BBA63623171DE93A8C0287ABF17F1EA08E1E99589923EC74E1B96
6964BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a6973f44-04cd-4315-91cf-b041f345a2f3.b0b7f468-2a61-45ab-b0ef-402970d3c4ef.down_metabinary
MD5:23A4FD68AA72E94644677A85A776AF4F
SHA256:74759AF04DE6CB758F3C2F29D76756FA8CF34CD9C12D73B6461D33AA07CB06D6
6964BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0ac36734-3142-4525-a8cf-bb8f9aa2ff6d.b0b7f468-2a61-45ab-b0ef-402970d3c4ef.down_metabinary
MD5:23A4FD68AA72E94644677A85A776AF4F
SHA256:74759AF04DE6CB758F3C2F29D76756FA8CF34CD9C12D73B6461D33AA07CB06D6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
31
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6964
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5256
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1188
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1188
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5256
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5256
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
6964
BackgroundTransferHost.exe
104.126.37.147:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.64
  • 40.126.32.140
  • 20.190.160.132
  • 20.190.160.5
  • 40.126.32.74
  • 20.190.160.66
  • 20.190.160.130
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.147
  • 104.126.37.186
  • 104.126.37.178
  • 104.126.37.179
  • 104.126.37.137
  • 104.126.37.184
  • 104.126.37.152
  • 104.126.37.123
  • 104.126.37.136
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 23.209.214.100
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ffdec_22.0.2_nightly3027_setup.exe