File name:

nxtspkisetup.exe

Full analysis: https://app.any.run/tasks/477bc65c-6812-4475-a6da-1ebcee6db925
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 11, 2025, 19:58:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

C109902E01F79AE7C9A9CF13DFAD38C5

SHA1:

F75122276E625C206F8C6932DDC5B87924BC6228

SHA256:

7E70134B5DC7D4739F4CB3D6118DD2BECBE954DC1C02AA0A0FF0C4503C230403

SSDEEP:

98304:o+cD4dnM0BhHyAYTgv29DA2qd2u3NNGEuql9Hfnjj6A010iTsW4M6ijDEa5jVv2z:jrJiTQwNl5xKXyuWYB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • nxtspkisetup.tmp (PID: 5056)

    • Actions looks like stealing of personal data

      • certutil.exe (PID: 2984)
      • certutil.exe (PID: 5380)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • nxtspkisetup.exe (PID: 6036)
      • nxtspkisetup.exe (PID: 5512)
      • nxtspkisetup.tmp (PID: 5056)
      • TSToolkit.exe (PID: 4920)

    • Reads security settings of Internet Explorer

      • nxtspkisetup.tmp (PID: 5740)
      • nxtscertutil.exe (PID: 1052)

    • Reads the Windows owner or organization settings

      • nxtspkisetup.tmp (PID: 5056)

    • Stops a currently running service

      • sc.exe (PID: 1812)

    • Process drops legitimate windows executable

      • nxtspkisetup.tmp (PID: 5056)

    • The process drops C-runtime libraries

      • nxtspkisetup.tmp (PID: 5056)

    • Creates/Modifies COM task schedule object

      • TSToolkit.exe (PID: 4920)

    • Adds/modifies Windows certificates

      • nxtscertutil.exe (PID: 1052)

    • The process creates files with name similar to system file names

      • TSToolkit.exe (PID: 4920)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • TSToolkit.exe (PID: 4920)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6824)

    • Executes as Windows Service

      • nxTSSvc.exe (PID: 5776)

  • INFO

    • Checks supported languages

      • nxtspkisetup.exe (PID: 6036)
      • nxtspkisetup.tmp (PID: 5740)
      • nxtspkisetup.exe (PID: 5512)
      • nxtspkisetup.tmp (PID: 5056)
      • nxtsutil.exe (PID: 5800)
      • nxtsutil.exe (PID: 1052)
      • nxTSSvc.exe (PID: 5380)
      • TSToolkit.exe (PID: 4920)
      • nxtscertutil.exe (PID: 1052)
      • certutil.exe (PID: 2984)
      • certutil.exe (PID: 5380)
      • nxTS.exe (PID: 2340)
      • nxTSSvc.exe (PID: 5776)

    • Process checks computer location settings

      • nxtspkisetup.tmp (PID: 5740)
      • nxtscertutil.exe (PID: 1052)

    • Reads the computer name

      • nxtspkisetup.tmp (PID: 5740)
      • nxtspkisetup.tmp (PID: 5056)
      • nxtsutil.exe (PID: 5800)
      • nxtsutil.exe (PID: 1052)
      • nxTSSvc.exe (PID: 5380)
      • TSToolkit.exe (PID: 4920)
      • nxtscertutil.exe (PID: 1052)
      • certutil.exe (PID: 2984)
      • nxTS.exe (PID: 2340)
      • certutil.exe (PID: 5380)
      • nxTSSvc.exe (PID: 5776)

    • Create files in a temporary directory

      • nxtspkisetup.exe (PID: 6036)
      • nxtspkisetup.exe (PID: 5512)
      • nxtspkisetup.tmp (PID: 5056)
      • TSToolkit.exe (PID: 4920)

    • The sample compiled with korean language support

      • nxtspkisetup.tmp (PID: 5056)
      • TSToolkit.exe (PID: 4920)

    • The sample compiled with english language support

      • nxtspkisetup.tmp (PID: 5056)
      • TSToolkit.exe (PID: 4920)

    • Creates a software uninstall entry

      • nxtspkisetup.tmp (PID: 5056)
      • TSToolkit.exe (PID: 4920)

    • Compiled with Borland Delphi (YARA)

      • nxtspkisetup.tmp (PID: 5740)
      • nxtspkisetup.exe (PID: 6036)

    • Detects InnoSetup installer (YARA)

      • nxtspkisetup.exe (PID: 6036)
      • nxtspkisetup.tmp (PID: 5740)

    • Creates files in the program directory

      • nxtspkisetup.tmp (PID: 5056)

    • Creates files or folders in the user directory

      • TSToolkit.exe (PID: 4920)
      • certutil.exe (PID: 2984)

    • Reads the machine GUID from the registry

      • nxTS.exe (PID: 2340)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 14:54:16+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Korea Trade Network
FileDescription: SCORE PKI for OpenWeb Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: SCORE PKI for OpenWeb
ProductVersion: 1,0,2,0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
20
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start nxtspkisetup.exe nxtspkisetup.tmp no specs nxtspkisetup.exe nxtspkisetup.tmp sc.exe no specs conhost.exe no specs nxtsutil.exe no specs nxtsutil.exe no specs nxtssvc.exe no specs conhost.exe no specs tstoolkit.exe nxtscertutil.exe no specs certutil.exe conhost.exe no specs certutil.exe conhost.exe no specs nxts.exe no specs sc.exe no specs conhost.exe no specs nxtssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1052"C:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\nxtsutil.exe" /unloadC:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\nxtsutil.exe—nxtspkisetup.tmp
User:
admin
Company:
Korea Trade network Co., Ltd.
Integrity Level:
HIGH
Description:
nxTSUtil
Exit code:
0
Version:
1.0.0.3
Modules
Images
c:\users\admin\appdata\local\temp\is-dm3js.tmp\nxtsutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1052"C:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\nxtscertutil.exe"C:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\nxtscertutil.exe—nxtspkisetup.tmp
User:
admin
Company:
Korea Trade network Co., Ltd.
Integrity Level:
HIGH
Description:
nxTS Certificate Util
Exit code:
0
Version:
1.0.0.3
Modules
Images
c:\users\admin\appdata\local\temp\is-dm3js.tmp\nxtscertutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1812"C:\WINDOWS\system32\sc.exe" stop nxTSsvcC:\Windows\SysWOW64\sc.exe—nxtspkisetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2340"C:\Program Files (x86)\nxTS\nxTS.exe"C:\Program Files (x86)\nxTS\nxTS.exe—nxtspkisetup.tmp
User:
admin
Company:
Korea Trade network Co., Ltd.
Integrity Level:
HIGH
Description:
nxTS
Version:
1,0,2,0
Modules
Images
c:\program files (x86)\nxts\nxts.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2984"C:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\nss\certutil.exe" -A -n "KTNET Global Root CA" -t "CT,C,C" -i nxTSCA.crt -d "sql:C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release"C:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\nss\certutil.exe
nxtscertutil.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-dm3js.tmp\nss\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\temp\is-dm3js.tmp\nss\smime3.dll
4188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certutil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4220\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4920"C:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\TSToolkit.exe"C:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\TSToolkit.exe
nxtspkisetup.tmp
User:
admin
Company:
Korea Trade Network
Integrity Level:
HIGH
Description:
TSTooolkit Setup
Exit code:
0
Version:
2.0.8.5
Modules
Images
c:\users\admin\appdata\local\temp\is-dm3js.tmp\tstoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5056"C:\Users\admin\AppData\Local\Temp\is-KJ4GD.tmp\nxtspkisetup.tmp" /SL5="$902EA,6143567,832512,C:\Users\admin\AppData\Local\Temp\nxtspkisetup.exe" /SPAWNWND=$50344 /NOTIFYWND=$6034E C:\Users\admin\AppData\Local\Temp\is-KJ4GD.tmp\nxtspkisetup.tmp
nxtspkisetup.exe
User:
admin
Company:
Korea Trade Network
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-kj4gd.tmp\nxtspkisetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
Total events
3 265
Read events
3 217
Write events
47
Delete events
1

Modification events

(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:nxTS
Value:
"C:\Program Files (x86)\nxTS\nxTS.exe"
(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8EB2BE32-7E21-40E4-998C-5DA4CA66B284}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.2
(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8EB2BE32-7E21-40E4-998C-5DA4CA66B284}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\nxTS
(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8EB2BE32-7E21-40E4-998C-5DA4CA66B284}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\nxTS\
(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8EB2BE32-7E21-40E4-998C-5DA4CA66B284}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
SCORE PKI for OpenWeb
(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8EB2BE32-7E21-40E4-998C-5DA4CA66B284}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8EB2BE32-7E21-40E4-998C-5DA4CA66B284}_is1
Operation:writeName:Inno Setup: Language
Value:
english
(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8EB2BE32-7E21-40E4-998C-5DA4CA66B284}_is1
Operation:writeName:DisplayName
Value:
SCORE PKI for OpenWeb version 1,0,2,0
(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8EB2BE32-7E21-40E4-998C-5DA4CA66B284}_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\nxTS\unins000.exe"
(PID) Process:(5056) nxtspkisetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8EB2BE32-7E21-40E4-998C-5DA4CA66B284}_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files (x86)\nxTS\unins000.exe" /SILENT
Executable files
55
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5056nxtspkisetup.tmpC:\Program Files (x86)\nxTS\unins000.exeexecutable
MD5:BFF070155F44AB8DC23D3B99ED7CC90F
SHA256:432F335FD0124191185466F979FAEDCABAF65ADC7554C185601A0B7332A981AD
5056nxtspkisetup.tmpC:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\is-PAFSQ.tmpexecutable
MD5:2C4FE48F6E39D3F63E173749B658C9D6
SHA256:EC0E48686F74DF75E510474D4D0F93AA3CE2F4BE90BC76CECB8D13F12A1BAFA4
5056nxtspkisetup.tmpC:\Program Files (x86)\nxTS\is-MH8IH.tmpexecutable
MD5:BFF070155F44AB8DC23D3B99ED7CC90F
SHA256:432F335FD0124191185466F979FAEDCABAF65ADC7554C185601A0B7332A981AD
5056nxtspkisetup.tmpC:\Program Files (x86)\nxTS\is-5R7H1.tmpexecutable
MD5:D7E20029BD0794F4F7D751650A7F4F2F
SHA256:3BC885EEA2C5737D1600D3730A96CB08697C172F729ED7E4464D59442D63F5B0
5056nxtspkisetup.tmpC:\Program Files (x86)\nxTS\is-OIR5A.tmpexecutable
MD5:180F52A2946D7524BD000980E400C751
SHA256:1628B8955F2F83B2B4981FEF5B1BF506C575C3EB338A879EF9C9B8117C6A54EF
5056nxtspkisetup.tmpC:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\nxtsutil.exeexecutable
MD5:180F52A2946D7524BD000980E400C751
SHA256:1628B8955F2F83B2B4981FEF5B1BF506C575C3EB338A879EF9C9B8117C6A54EF
5056nxtspkisetup.tmpC:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\nxtscertutil.exeexecutable
MD5:2C4FE48F6E39D3F63E173749B658C9D6
SHA256:EC0E48686F74DF75E510474D4D0F93AA3CE2F4BE90BC76CECB8D13F12A1BAFA4
5056nxtspkisetup.tmpC:\Users\admin\AppData\Local\Temp\is-DM3JS.tmp\nss\is-2MFQS.tmpexecutable
MD5:F8DA06687FB47CA2C355C38CA2766262
SHA256:64AD18F4D9BEF01B86E39CA1E774DFA37DB46BC8267453C418DD7F723D6D014C
5056nxtspkisetup.tmpC:\Program Files (x86)\nxTS\nxTSSvc.exeexecutable
MD5:2BA6A477F215622CE4FA8E11A79290DA
SHA256:9E85A35F18259BF07D18C7BAF006557D6CCAA48739D053A5DCC21C77A9EA9D8E
5512nxtspkisetup.exeC:\Users\admin\AppData\Local\Temp\is-KJ4GD.tmp\nxtspkisetup.tmpexecutable
MD5:6F38AE8F92F5041EDA8794BB466D8EBB
SHA256:FD37E6C6B8F285D3E5462C44A4B0D0576088895DE9225F2D831A59CB6C627269
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
19
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3268
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3268
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3268
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3268
SIHClient.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.129
  • 20.190.159.2
  • 40.126.31.130
  • 20.190.159.68
  • 40.126.31.69
  • 40.126.31.1
  • 40.126.31.131
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nxtspkisetup.exe