File name:

7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe

Full analysis: https://app.any.run/tasks/63a98acc-6906-4058-aae8-caee8a0313ac
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Malware Trends Tracker     >>>
Analysis date: January 07, 2026, 10:16:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
autoit
stealer
hawkeye
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

296B56BAB8938AAD82F0D398B9FCD78C

SHA1:

DD3ECBCCBDB25EE00DBA8F8FE638257569053A4C

SHA256:

7203BCEA7E54CC9CA01DD80EC17F92B0D7EF478DD27A761FDC48FBE2D5B1C13F

SSDEEP:

49152:3sj8LlaqK/2z8LhfzLO88ST2aJ/G91LOEujqYjaeCgHEfH2BHQZE7FlzRH2Zi0JB:cj8LlMLYlhYjajyedydFZ5AJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe (PID: 7476)
      • winmgr21.exe (PID: 7972)
      • RegAsm.exe (PID: 8048)

    • Uses Task Scheduler to run other applications

      • winmgr21.exe (PID: 7972)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 8160)
      • RegAsm.exe (PID: 5712)

    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 8048)
      • RegAsm.exe (PID: 5712)

    • HAWKEYE has been detected (YARA)

      • RegAsm.exe (PID: 8048)

  • SUSPICIOUS

    • Starts itself from another location

      • 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe (PID: 7476)

    • Executable content was dropped or overwritten

      • 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe (PID: 7476)
      • RegAsm.exe (PID: 8048)

    • There is functionality for taking screenshot (YARA)

      • winmgr21.exe (PID: 7972)

    • Application launched itself

      • RegAsm.exe (PID: 8048)

    • Possible stealing of email data

      • RegAsm.exe (PID: 8160)

    • Possible stealing from browsers

      • RegAsm.exe (PID: 5712)

    • Process drops legitimate windows executable

      • RegAsm.exe (PID: 8048)

    • Possible stealing of FTP data

      • RegAsm.exe (PID: 8048)

  • INFO

    • Launching a file from a Registry key

      • 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe (PID: 7476)
      • winmgr21.exe (PID: 7972)
      • RegAsm.exe (PID: 8048)

    • Reads the computer name

      • 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe (PID: 7476)
      • winmgr21.exe (PID: 7972)
      • winmgr21.exe (PID: 8008)
      • RegAsm.exe (PID: 8160)
      • RegAsm.exe (PID: 8048)
      • RegAsm.exe (PID: 5712)

    • Reads mouse settings

      • 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe (PID: 7476)
      • winmgr21.exe (PID: 7972)
      • winmgr21.exe (PID: 8008)

    • The sample compiled with chinese language support

      • 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe (PID: 7476)

    • Creates files in the program directory

      • 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe (PID: 7476)
      • winmgr21.exe (PID: 7972)
      • RegAsm.exe (PID: 8160)
      • RegAsm.exe (PID: 5712)
      • RegAsm.exe (PID: 8048)

    • Checks supported languages

      • 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe (PID: 7476)
      • winmgr21.exe (PID: 7972)
      • winmgr21.exe (PID: 8008)
      • RegAsm.exe (PID: 8048)
      • RegAsm.exe (PID: 8160)
      • RegAsm.exe (PID: 5712)
      • Important.exe (PID: 7408)

    • Manual execution by a user

      • winmgr21.exe (PID: 8008)
      • Important.exe (PID: 7408)

    • The process uses AutoIt

      • winmgr21.exe (PID: 7972)

    • Reads the machine GUID from the registry

      • winmgr21.exe (PID: 7972)
      • RegAsm.exe (PID: 8048)
      • RegAsm.exe (PID: 5712)

    • Create files in a temporary directory

      • RegAsm.exe (PID: 5712)

    • The sample compiled with english language support

      • RegAsm.exe (PID: 8048)

    • Disables trace logs

      • RegAsm.exe (PID: 8048)

    • Checks proxy server information

      • RegAsm.exe (PID: 8048)
      • slui.exe (PID: 7664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:01:15 16:09:54+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 529920
InitializedDataSize: 1667584
UninitializedDataSize: -
EntryPoint: 0x17850
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 9.0.0.0
ProductVersionNumber: 9.0.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: CHENGDU YIWO Tech Development Co., Ltd
FileDescription: EaseUS Data Recovery Wizard
FileVersion: 9.0.0
InternalName: Data Recovery Wizard
LegalCopyright: Copyright (c) 2004-2015 EaseUS.ALL RIGHTS RESERVED.
OriginalFileName: EaseUS Data Recovery Wizard
ProductName: EaseUS Data Recovery Wizard
ProductVersion: 9.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
204
Monitored processes
63
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe winmgr21.exe winmgr21.exe no specs #HAWKEYE regasm.exe schtasks.exe no specs conhost.exe no specs regasm.exe regasm.exe important.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs slui.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1148\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1412C:\WINDOWS\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /fC:\Windows\SysWOW64\schtasks.exe—winmgr21.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1836\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2460C:\WINDOWS\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /fC:\Windows\SysWOW64\schtasks.exe—winmgr21.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2936C:\WINDOWS\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /fC:\Windows\SysWOW64\schtasks.exe—winmgr21.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2952C:\WINDOWS\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /fC:\Windows\SysWOW64\schtasks.exe—winmgr21.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3100C:\WINDOWS\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /fC:\Windows\SysWOW64\schtasks.exe—winmgr21.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3520C:\WINDOWS\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /fC:\Windows\SysWOW64\schtasks.exe—winmgr21.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
5 635
Read events
5 618
Write events
17
Delete events
0

Modification events

(PID) Process:(7476) 7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:2
Value:
C:\ProgramData\winmgr21.exe
(PID) Process:(7972) winmgr21.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:2
Value:
C:\ProgramData\winmgr21.exe
(PID) Process:(8048) RegAsm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:e58494ba81888876514df0d106b49971
Value:
C:\ProgramData\Important.exe
(PID) Process:(8048) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(8048) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(8048) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(8048) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(8048) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(8048) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(8048) RegAsm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
3
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5712RegAsm.exeC:\Users\admin\AppData\Local\Temp\bhv35A8.tmp —
MD5:—
SHA256:—
74767203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exeC:\Users\admin\Desktop\7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe:Zone.Identifiertext
MD5:6C72A5FCDB3C81DCC440E3616F704C5D
SHA256:CCC0133D8F43D3021EB667F86AE939F7F8EC83E727B8334F9E0FACCCD6D01063
7972winmgr21.exeC:\ProgramData\winmgr21.exe:Zone.Identifiertext
MD5:6C72A5FCDB3C81DCC440E3616F704C5D
SHA256:CCC0133D8F43D3021EB667F86AE939F7F8EC83E727B8334F9E0FACCCD6D01063
74767203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exeC:\ProgramData\winmgr21.exeexecutable
MD5:B0FFEBF945DAD993D7C8A51C81C9387F
SHA256:378A143B7EB4F9915171B3E72B69D9E6D66FFB966B45899A84591156464367C2
5712RegAsm.exeC:\ProgramData\Browsers.txttext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
8048RegAsm.exeC:\ProgramData\Important.exeexecutable
MD5:A64DACA3CFBCD039DF3EC29D3EDDD001
SHA256:403752009F29381D5E4036B8BE94589C89188F9CE8EF5F86959EAAADA019ED36
8048RegAsm.exeC:\ProgramData\DESKTOP-JGLLJLD_1_7_5_16_1.jpgimage
MD5:3B23E7805D2B6BF40CCFD94F68901409
SHA256:37A03D2D1495A15CC4C2B70E8366065214763C01FC015C21FC8D2202C1E66AA3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
44
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6768
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=562&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
unknown
—
—
whitelisted
4660
RUXIMICS.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/RUXIM?os=Windows&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3623&OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&FlightRing=Retail&AttrDataVer=186&App=RUXIM&AppVer=&DeviceFamily=Windows.Desktop
unknown
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
95.101.54.128:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4660
RUXIMICS.exe
GET
200
95.101.54.128:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
792
svchost.exe
GET
200
95.101.54.128:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
792
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4660
RUXIMICS.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.160.20:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
unknown
792
svchost.exe
GET
200
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaasMedic?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&appVer=10.0.19041.3758&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4
unknown
text
3.41 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
792
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4660
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
792
svchost.exe
95.101.54.128:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
95.101.54.128:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
4660
RUXIMICS.exe
95.101.54.128:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
792
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
6768
MoUsoCoreWorker.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 95.101.54.128
  • 95.101.54.122
whitelisted
www.microsoft.com
  • 23.59.18.102
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.0
  • 40.126.31.69
  • 40.126.31.131
  • 40.126.31.71
  • 40.126.31.73
  • 40.126.31.3
  • 20.190.159.130
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
vaibaht.com
  • —
unknown
slscr.update.microsoft.com
  • 135.232.92.137
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
self.events.data.microsoft.com
  • 40.79.189.58
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7203bcea7e54cc9ca01dd80ec17f92b0d7ef478dd27a761fdc48fbe2d5b1c13f.exe