File name:

airtm.exe

Full analysis: https://app.any.run/tasks/80635e17-0b4e-4159-8459-1daab8e3e597
Verdict: Malicious activity
Analysis date: March 24, 2025, 11:19:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

6802BFFEB68F32F25DAA2FD21817BACC

SHA1:

64E8201BC57B1ED1B0F336413C7702BEDFB78C24

SHA256:

61F612DCC8784E630A441647CBFD4D70EF95705FFA510465BA53D619FAFD00BC

SSDEEP:

98304:1xb2i3vqeLnc1ZaDPHUFK/uXbQx2U00qu0kheuJSFdVWsyqEVKhHs7UJDZ2pli9V:6KVNnTy9KNUfuMl9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • airtm.exe (PID: 7856)
      • python-3.13.2-amd64.exe (PID: 1760)
      • msiexec.exe (PID: 7844)
      • python-3.13.2-amd64.exe (PID: 7640)

    • Executable content was dropped or overwritten

      • airtm.exe (PID: 7856)
      • airtm.exe (PID: 7924)
      • python-3.13.2-amd64.exe (PID: 3300)
      • python-3.13.2-amd64.exe (PID: 1760)
      • python-3.13.2-amd64.exe (PID: 7640)

    • The process drops C-runtime libraries

      • airtm.exe (PID: 7856)
      • python-3.13.2-amd64.exe (PID: 1760)
      • python-3.13.2-amd64.exe (PID: 7640)
      • msiexec.exe (PID: 7844)

    • Application launched itself

      • airtm.exe (PID: 7856)

    • Process drops python dynamic module

      • airtm.exe (PID: 7856)
      • msiexec.exe (PID: 7844)

    • Loads Python modules

      • airtm.exe (PID: 7924)

    • Starts CMD.EXE for commands execution

      • airtm.exe (PID: 7924)

    • Reads security settings of Internet Explorer

      • python-3.13.2-amd64.exe (PID: 1760)

    • Searches for installed software

      • python-3.13.2-amd64.exe (PID: 1760)
      • dllhost.exe (PID: 7412)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7380)

    • Starts itself from another location

      • python-3.13.2-amd64.exe (PID: 1760)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7844)

  • INFO

    • Checks supported languages

      • airtm.exe (PID: 7856)
      • python-3.13.2-amd64.exe (PID: 3300)
      • airtm.exe (PID: 7924)
      • python-3.13.2-amd64.exe (PID: 1760)
      • python-3.13.2-amd64.exe (PID: 7640)
      • msiexec.exe (PID: 7844)

    • Reads the computer name

      • airtm.exe (PID: 7856)
      • python-3.13.2-amd64.exe (PID: 1760)
      • python-3.13.2-amd64.exe (PID: 7640)

    • The sample compiled with english language support

      • airtm.exe (PID: 7856)
      • airtm.exe (PID: 7924)
      • python-3.13.2-amd64.exe (PID: 3300)
      • python-3.13.2-amd64.exe (PID: 1760)
      • msiexec.exe (PID: 7844)
      • python-3.13.2-amd64.exe (PID: 7640)

    • Create files in a temporary directory

      • airtm.exe (PID: 7856)
      • python-3.13.2-amd64.exe (PID: 3300)
      • python-3.13.2-amd64.exe (PID: 1760)

    • Checks proxy server information

      • airtm.exe (PID: 7924)

    • Process checks computer location settings

      • python-3.13.2-amd64.exe (PID: 1760)

    • PyInstaller has been detected (YARA)

      • airtm.exe (PID: 7856)

    • Creates files or folders in the user directory

      • python-3.13.2-amd64.exe (PID: 1760)

    • Manages system restore points

      • SrTasks.exe (PID: 7552)

    • Reads the machine GUID from the registry

      • python-3.13.2-amd64.exe (PID: 7640)

    • Reads the software policy settings

      • msiexec.exe (PID: 7844)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:03:24 10:50:39+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 178688
InitializedDataSize: 153600
UninitializedDataSize: -
EntryPoint: 0xc380
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
12
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start airtm.exe conhost.exe no specs airtm.exe cmd.exe no specs python-3.13.2-amd64.exe python-3.13.2-amd64.exe python-3.13.2-amd64.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
1760"C:\Users\admin\AppData\Local\Temp\{06CDC7F1-09E9-4C81-92BC-97C878F7A6C8}\.cr\python-3.13.2-amd64.exe" -burn.clean.room="C:\Temp\PythonInstaller\python-3.13.2-amd64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=736 /quiet InstallAllUsers=1 PrependPath=1 /log "C:\Temp\PythonInstaller\python_install.log"C:\Users\admin\AppData\Local\Temp\{06CDC7F1-09E9-4C81-92BC-97C878F7A6C8}\.cr\python-3.13.2-amd64.exe
python-3.13.2-amd64.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.13.2 (64-bit)
Version:
3.13.2150.0
Modules
Images
c:\users\admin\appdata\local\temp\{06cdc7f1-09e9-4c81-92bc-97c878f7a6c8}\.cr\python-3.13.2-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3300"C:\Temp\PythonInstaller\python-3.13.2-amd64.exe" /quiet InstallAllUsers=1 PrependPath=1 /log "C:\Temp\PythonInstaller\python_install.log"C:\Temp\PythonInstaller\python-3.13.2-amd64.exe
cmd.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.13.2 (64-bit)
Version:
3.13.2150.0
Modules
Images
c:\temp\pythoninstaller\python-3.13.2-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7372C:\WINDOWS\system32\cmd.exe /c ""C:\Temp\PythonInstaller\python-3.13.2-amd64.exe" /quiet InstallAllUsers=1 PrependPath=1 /log "C:\Temp\PythonInstaller\python_install.log""C:\Windows\System32\cmd.exe—airtm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
7380C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7412C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
7552C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7640"C:\Users\admin\AppData\Local\Temp\{41FED61A-A38A-4C1C-A688-B55DD12828E5}\.be\python-3.13.2-amd64.exe" -q -burn.elevated BurnPipe.{D4BC239F-1218-47E1-A7B4-DDDCC521BAB2} {7343F839-DFEB-4FB7-B546-69E97A19D75F} 1760C:\Users\admin\AppData\Local\Temp\{41FED61A-A38A-4C1C-A688-B55DD12828E5}\.be\python-3.13.2-amd64.exe
python-3.13.2-amd64.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
HIGH
Description:
Python 3.13.2 (64-bit)
Version:
3.13.2150.0
Modules
Images
c:\users\admin\appdata\local\temp\{41fed61a-a38a-4c1c-a688-b55dd12828e5}\.be\python-3.13.2-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7836\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7844C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7856"C:\Users\admin\AppData\Local\Temp\airtm.exe" C:\Users\admin\AppData\Local\Temp\airtm.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\airtm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
15 782
Read events
14 333
Write events
1 403
Delete events
46

Modification events

(PID) Process:(7640) python-3.13.2-amd64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000D63FB8A3AE9CDB01D81D00003C1D0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000B1CA6FA4AE9CDB01F41C0000F41D0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000B1CA6FA4AE9CDB01F41C0000F41D0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000075A79A4AE9CDB01F41C0000F41D0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000D63FB8A3AE9CDB01F41C0000F41D0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000005B9274A4AE9CDB01F41C0000F41D0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
480000000000000069C10AA5AE9CDB01F41C0000F41D0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7380) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000001D1719A5AE9CDB01D41C000010100000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7380) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000006B7A1BA5AE9CDB01D41C000054120000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7380) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000006B7A1BA5AE9CDB01D41C00007C180000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
66
Suspicious files
67
Text files
653
Unknown types
0

Dropped files

PID
Process
Filename
Type
7856airtm.exeC:\Users\admin\AppData\Local\Temp\_MEI78562\_lzma.pydexecutable
MD5:3E73BC69EFB418E76D38BE5857A77027
SHA256:6F48E7EBA363CB67F3465A6C91B5872454B44FC30B82710DFA4A4489270CE95C
7856airtm.exeC:\Users\admin\AppData\Local\Temp\_MEI78562\libcrypto-3.dllexecutable
MD5:123AD0908C76CCBA4789C084F7A6B8D0
SHA256:4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
7856airtm.exeC:\Users\admin\AppData\Local\Temp\_MEI78562\base_library.zipcompressed
MD5:FDDF015F617223C569038938DAAA9D8F
SHA256:65833D8D887F1197FA25ECF755BC04B1E2DAA49831625DBC5F20927C436C7641
7856airtm.exeC:\Users\admin\AppData\Local\Temp\_MEI78562\_socket.pydexecutable
MD5:69C4A9A654CF6D1684B73A431949B333
SHA256:8DAEFAFF53E6956F5AEA5279A7C71F17D8C63E2B0D54031C3B9E82FCB0FB84DB
7412dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7856airtm.exeC:\Users\admin\AppData\Local\Temp\_MEI78562\libssl-3.dllexecutable
MD5:4FF168AAA6A1D68E7957175C8513F3A2
SHA256:2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
7856airtm.exeC:\Users\admin\AppData\Local\Temp\_MEI78562\_decimal.pydexecutable
MD5:F465C15E7BACEAC920DC58A5FB922C1C
SHA256:F4A486A0CA6A53659159A404614C7E7EDCCB6BFBCDEB844F6CEE544436A826CB
7924airtm.exeC:\Temp\PythonInstaller\python-3.13.2-amd64.exeexecutable
MD5:40D2C830EEDEE3DD78F4B707F04FD1D2
SHA256:9AAA1075D0BD3E8ABD0623D2D05DE692FF00780579E1B232F259028BAC19BB51
7856airtm.exeC:\Users\admin\AppData\Local\Temp\_MEI78562\python313.dllexecutable
MD5:501080884BED38CB8801A307C9D7B7B4
SHA256:BF68CF819A1E865170430C10E91C18B427AEF88DB1DA1742020443864AA2B749
7856airtm.exeC:\Users\admin\AppData\Local\Temp\_MEI78562\select.pydexecutable
MD5:2663E22900AB5791C6687A264473AE1E
SHA256:BAEE284995B22D495FD12FA8378077E470978DB1522C61BFB9AF37FB827F33D1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
31
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7972
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7844
msiexec.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTOQYLFSE5GO%2FpaRVfYu7d9gZEbQAQU2UEpsA8PY2zvadf1zSmepEhqMOYCEzMAAAAEllBL0tvuy4gAAAAAAAQ%3D
unknown
—
—
whitelisted
7844
msiexec.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTDHsfuqfubd3pihvq4mgQVWgHWNwQUyH7SaoUqG8oZmAQHJ89QEE9oqKICEzMAAAAHh6M0o3uljhwAAAAAAAc%3D
unknown
—
—
whitelisted
7844
msiexec.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ0NE46krjtIffEj0l00lckKsLufgQUJEWZoXeQKnzDyoOwbmQWhCr4LGcCEzMAAqUUWCjwxly7WnsAAAACpRQ%3D
unknown
—
—
whitelisted
7488
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7488
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5024
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7924
airtm.exe
151.101.128.223:443
www.python.org
FASTLY
US
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.python.org
  • 151.101.128.223
  • 151.101.192.223
  • 151.101.64.223
  • 151.101.0.223
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.132
  • 20.190.160.22
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.14
  • 20.190.160.64
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
airtm.exe