File name:

exe

Full analysis: https://app.any.run/tasks/1216eba5-129a-46ff-b71a-4eb48ec3938d
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 25, 2026, 21:50:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generic
websocket
valleyrat
rat
silverfox
winos
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

3F684AE77A19BC016E80E2E4FA500F1C

SHA1:

183D10DEDC1102AFD8C2E3A5B94C0D555BEECCC5

SHA256:

6357059BA1B68376B11311CD1679F93E3709F48C8E6E9E84E88D4C27EBC00E1A

SSDEEP:

98304:nxy/GsoANCdh5KATKe+HGleSlezwYRPT/7Xhy3Z2ZvZU8AASFKyuNcP6wbUy2uvJ:F8pV6DvpFt69kuoCodoJLiAUmg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic malicious agent network activity observed

      • svchost.exe (PID: 1236)

    • GENERIC has been detected (SURICATA)

      • svchost.exe (PID: 1236)

    • Starts CMD.EXE for self-deleting

      • exe.exe (PID: 4136)

  • SUSPICIOUS

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6672)

    • Starts CMD.EXE with output disabled

      • cmd.exe (PID: 6672)

    • File deletion via cmd.exe

      • cmd.exe (PID: 6672)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6672)

    • Executable content was dropped or overwritten

      • svchost.exe (PID: 1236)

    • Application launched itself

      • svchost.exe (PID: 1236)

    • Self-deletion pattern has been detected

      • exe.exe (PID: 4136)

    • Reads the date of Windows installation

      • exe.exe (PID: 4136)

  • INFO

    • Reads the computer name

      • exe.exe (PID: 4136)

    • Checks supported languages

      • exe.exe (PID: 4136)

    • Reads security settings of Internet Explorer

      • exe.exe (PID: 4136)
      • svchost.exe (PID: 1236)

    • Process checks computer location settings

      • exe.exe (PID: 4136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ValleyRat

(PID) Processunknown
C2 (1)198.176.61.77
(PID) Processunknown
C2 (1)198.176.61.77
No Malware configuration.

TRiD

.exe | DOS Executable Borland Pascal 7.0x (33.4)
.exe | Generic Win/DOS Executable (32.8)
.exe | DOS Executable Generic (32.8)
.vxd | VXD Driver (0.5)
.dbf | Sybase iAnywhere database files (0.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: -
CodeSize: 1101824
InitializedDataSize: 27033600
UninitializedDataSize: -
EntryPoint: 0x101aa0
OSVersion: -
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.9.2.2172
ProductVersionNumber: 5.9.2.2172
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: Tencent
FileDescription: WeGame
FileVersion: 5.9.2.2172
LegalCopyright: Copyright (C) 2017 –2025 Tencent. All Rights Reserved.
LegalTrademarks: Tencent
OriginalFileName: WeGame
ProductName: WeGame
ProductVersion: 5.9.2.2172
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
6
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
#GENERIC svchost.exe exe.exe no specs conhost.exe no specs exe.exe cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1236C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2308"C:\Users\admin\AppData\Local\Temp\exe.exe" C:\Users\admin\AppData\Local\Temp\exe.exe—explorer.exe
User:
admin
Company:
Tencent
Integrity Level:
MEDIUM
Description:
WeGame
Exit code:
3221226540
Version:
5.9.2.2172
Modules
Images
c:\users\admin\appdata\local\temp\exe.exe
c:\windows\system32\ntdll.dll
3324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4136"C:\Users\admin\AppData\Local\Temp\exe.exe" C:\Users\admin\AppData\Local\Temp\exe.exe
explorer.exe
User:
admin
Company:
Tencent
Integrity Level:
HIGH
Description:
WeGame
Exit code:
0
Version:
5.9.2.2172
Modules
Images
c:\users\admin\appdata\local\temp\exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
6672"C:\Windows\System32\cmd.exe" /c timeout 2 & del /f /q "C:\Users\admin\AppData\Local\Temp\exe.exe"C:\Windows\System32\cmd.exe—exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
7668timeout 2 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
4 198
Read events
3 830
Write events
165
Delete events
203

Modification events

(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Bluetooth\Microsoft Compatibility system
Operation:writeName:SD
Value:
01000480B0000000BC000000000000001400000002009C0007000000001018009F011F0001020000000000052000000020020000001014009F011F00010100000000000512000000001014008900120001010000000000050B0000000010140089001200010100000000000513000000001014008900120001010000000000051400000000101400FF011F00010100000000000512000000000014008900120001010000000000051200000000000000010100000000000512000000010100000000000512000000
(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Bluetooth\Microsoft Compatibility system
Operation:writeName:Id
Value:
{392B3EE9-06A4-4806-83DE-DC97E6209BAE}
(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Bluetooth\Microsoft Compatibility system
Operation:writeName:Index
Value:
1
(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{392B3EE9-06A4-4806-83DE-DC97E6209BAE}
Operation:writeName:Path
Value:
\Microsoft\Windows\Bluetooth\Microsoft Compatibility system
(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{392B3EE9-06A4-4806-83DE-DC97E6209BAE}
Operation:writeName:Hash
Value:
3917D96C329449CA5E388B6357DDE2DFBE5330A6140CC1B06F01907E49EBE398
(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{392B3EE9-06A4-4806-83DE-DC97E6209BAE}
Operation:writeName:Schema
Value:
65538
(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{392B3EE9-06A4-4806-83DE-DC97E6209BAE}
Operation:delete valueName:Version
Value:
(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{392B3EE9-06A4-4806-83DE-DC97E6209BAE}
Operation:delete valueName:Date
Value:
(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{392B3EE9-06A4-4806-83DE-DC97E6209BAE}
Operation:delete valueName:SecurityDescriptor
Value:
(PID) Process:(1236) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{392B3EE9-06A4-4806-83DE-DC97E6209BAE}
Operation:delete valueName:Source
Value:
Executable files
2
Suspicious files
2
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1236svchost.exeC:\Program Files\Common Files\nvgpu_x64.exeexecutable
MD5:5DD0D3F9CEFF27280918CB638C5C4AA8
SHA256:2C94ED377D842C28196449594FDC1CD43EC7E172F065526CA33957EC1D180370
1236svchost.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\setup[1].exebinary
MD5:3FFDF2702745255365572279F6796594
SHA256:D6C85E49E5A7BA426990E9C2DE86603C9EA3245B3A55073C6914D7087A0F91EA
1236svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Workxml
MD5:C6086D02F8CE044F5FA07A98303DC7EB
SHA256:8901D9C9AEA465DA4EA7AA874610A90B8CF0A71EBA0E321CF9675FCEEE0B54A0
1236svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Workxml
MD5:EF6955DF8EB757D7FCAF9C1B495DE851
SHA256:D300F20F06DA441DB8F4A732CC4CEB4580C5EB8CD543926A30B51696ED5AA377
1236svchost.exeC:\Program Files\Common Files\nvml.dllexecutable
MD5:EEB72D6F524E0355DC05C04D951B654D
SHA256:DD74A790C9528D45711318B04DAE069468D2ABCA085E1E177CDA5417FF539821
1236svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Workxml
MD5:4838EE953DAB2C7A1BF57E0C6620A79D
SHA256:22C798E00C4793749EAC39CFB6EA3DD75112FD4453A3706E839038A64504D45D
1236svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\Bluetooth\Microsoft Compatibility systemxml
MD5:DD8AEEFDE0772DDE149630422852C093
SHA256:969627B1FF7958CCA4619F85E2A54D5DDDA84C68792A6D179A4D8DCFDCECC0F2
1236svchost.exeC:\Program Files\Common Files\nvml.binbinary
MD5:71C470B0487409FBDFDB300F09DE8F14
SHA256:EC8397AEED779E6F40FD7C6889AB5B5DA7DB6731BB677924501D596E119AE3B6
1236svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskxml
MD5:4E7AC12C676C7192EB4A188431B4013B
SHA256:0EE0669F0AC7B108FCB215E88011743FE48A0A1F2035247C411DE74BC9D0F5F0
1236svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scanxml
MD5:11954764DE4745B35A42219A7C5E2DCA
SHA256:997FCF971A38394C30D9E5CA0C6B36E782630E83B52D2664C56F1DEFBA54CB6C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
25
DNS requests
19
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5392
svchost.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
5168
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5168
SIHClient.exe
GET
200
135.233.95.135:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
5168
SIHClient.exe
GET
200
74.178.76.128:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
5168
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5392
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5392
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5392
svchost.exe
GET
200
20.106.86.13:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
text
5.80 Kb
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
text
7.04 Kb
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/FlightSettings/FSService?ProcessorClockSpeed=3094&IsRetailOS=1&OEMManufacturerName=DELL&FlightingPolicyValue=3&EnablePreviewBuilds=4294967295&OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&ManagePreviewBuilds=3&BranchReadinessLevelSource=0&AttrDataVer=186&ProcessorCores=6&BranchReadinessLevelRaw=16&TotalPhysicalRAM=6144&TPMVersion=0&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&DeviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&App=FSS&AppVer=10.0&SmartActiveHoursState=1&ActiveHoursStart=20&SecureBootCapable=0&ActiveHoursEnd=13&DeviceFamily=Windows.Desktop
US
text
87.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5392
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
1236
svchost.exe
198.176.61.77:80
—
HKCICL-AS-AP Hong Kong Communications International Co., Limited
HK
malicious
4784
svchost.exe
198.176.61.77:80
—
HKCICL-AS-AP Hong Kong Communications International Co., Limited
HK
malicious
5392
svchost.exe
20.106.86.13:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5392
svchost.exe
2.16.241.12:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5392
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted
google.com
  • 192.178.183.139
  • 192.178.183.102
  • 192.178.183.101
  • 192.178.183.100
  • 192.178.183.113
  • 192.178.183.138
whitelisted
settings-win.data.microsoft.com
  • 20.106.86.13
  • 51.124.78.146
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 23.216.77.6
  • 23.216.77.20
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.5
  • 20.190.160.67
  • 20.190.160.2
  • 40.126.32.74
  • 40.126.32.134
  • 20.190.160.130
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 135.233.95.135
whitelisted

Threats

PID
Process
Class
Message
1236
svchost.exe
A Network Trojan was detected
LOADER [ANY.RUN] Win32/Generic User-agent observed (Downloader)
1236
svchost.exe
A Network Trojan was detected
LOADER [ANY.RUN] Win32/Generic related HTTP GET request (/getinstall64)
4784
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
4784
svchost.exe
Generic Protocol Command Decode
SURICATA HTTP Request line incomplete
5392
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
4784
svchost.exe
Generic Protocol Command Decode
SURICATA HTTP request field missing colon
4784
svchost.exe
Generic Protocol Command Decode
SURICATA HTTP URI terminated by non-compliant character
4784
svchost.exe
Generic Protocol Command Decode
SURICATA HTTP METHOD terminated by non-compliant character
4784
svchost.exe
Generic Protocol Command Decode
SURICATA HTTP request header invalid
No debug info