File name:

keepAwakeSetup.exe

Full analysis: https://app.any.run/tasks/8f5e130a-d433-432b-bbcb-253ee4f3995b
Verdict: Malicious activity
Analysis date: February 11, 2025, 09:15:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
advancedinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

4BEC0D6BD4EFD7B5B60C61A273EA8A65

SHA1:

DBFB1FE15DAEF0AB2EC67ACF061AA51075F42A8C

SHA256:

8637E826424DD0A47B3315F41CB9E366458768E58385B98F5C5FEEDBDE372616

SSDEEP:

98304:5HkfbLN0QNmcmA61y7KZ5MBxbOXbT1w2azfX89M+D4FjHDS+c2qmz5Pv3FMuCgck:8lwU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a new scheduled task via Registry

      • msiexec.exe (PID: 5240)

    • Create files in the Startup directory

      • msiexec.exe (PID: 6552)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 7000)
      • keep-awake.exe (PID: 5488)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4672)
      • powershell.exe (PID: 6872)
      • powershell.exe (PID: 4188)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6872)
      • powershell.exe (PID: 4188)

  • SUSPICIOUS

    • ADVANCEDINSTALLER mutex has been found

      • keepAwakeSetup.exe (PID: 6368)

    • Reads the Windows owner or organization settings

      • keepAwakeSetup.exe (PID: 6368)
      • msiexec.exe (PID: 6552)

    • Reads security settings of Internet Explorer

      • keepAwakeSetup.exe (PID: 6368)
      • msiexec.exe (PID: 6644)

    • Checks Windows Trust Settings

      • keepAwakeSetup.exe (PID: 6368)

    • Executable content was dropped or overwritten

      • keepAwakeSetup.exe (PID: 6368)
      • keep-awake.exe (PID: 6848)
      • tray_windows_release.exe (PID: 1620)

    • Application launched itself

      • keepAwakeSetup.exe (PID: 6368)

    • There is functionality for taking screenshot (YARA)

      • keepAwakeSetup.exe (PID: 6368)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 7000)
      • keep-awake.exe (PID: 5488)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 7000)

    • Process drops legitimate windows executable

      • keepAwakeSetup.exe (PID: 6368)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 7000)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 7000)
      • keep-awake.exe (PID: 5488)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 4672)
      • keep-awake.exe (PID: 6848)
      • keep-awake.exe (PID: 5488)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 4672)

    • Get information on the list of running processes

      • keep-awake.exe (PID: 6848)
      • cmd.exe (PID: 7080)
      • cmd.exe (PID: 3796)
      • keep-awake.exe (PID: 5488)

    • The process hides Powershell's copyright startup banner

      • keep-awake.exe (PID: 5488)

    • Uses powercfg.exe to modify the power settings

      • powershell.exe (PID: 6872)
      • powershell.exe (PID: 4188)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 1752)

  • INFO

    • Checks supported languages

      • keepAwakeSetup.exe (PID: 6368)
      • msiexec.exe (PID: 6552)
      • msiexec.exe (PID: 6644)
      • keepAwakeSetup.exe (PID: 6916)
      • msiexec.exe (PID: 7000)
      • msiexec.exe (PID: 5240)
      • keep-awake.exe (PID: 6848)
      • tray_windows_release.exe (PID: 1620)
      • keep-awake.exe (PID: 5488)
      • tray_windows_release.exe (PID: 2996)

    • Reads the computer name

      • keepAwakeSetup.exe (PID: 6368)
      • msiexec.exe (PID: 6644)
      • msiexec.exe (PID: 5240)
      • msiexec.exe (PID: 7000)
      • msiexec.exe (PID: 6552)
      • tray_windows_release.exe (PID: 1620)
      • keep-awake.exe (PID: 6848)
      • tray_windows_release.exe (PID: 2996)
      • keep-awake.exe (PID: 5488)

    • Checks proxy server information

      • keepAwakeSetup.exe (PID: 6368)

    • Reads the machine GUID from the registry

      • keepAwakeSetup.exe (PID: 6368)

    • The sample compiled with english language support

      • keepAwakeSetup.exe (PID: 6368)
      • msiexec.exe (PID: 6552)

    • Create files in a temporary directory

      • keepAwakeSetup.exe (PID: 6368)
      • powershell.exe (PID: 4672)
      • keep-awake.exe (PID: 6848)
      • tray_windows_release.exe (PID: 1620)
      • tray_windows_release.exe (PID: 2996)
      • msiexec.exe (PID: 7000)

    • Reads the software policy settings

      • keepAwakeSetup.exe (PID: 6368)
      • powershell.exe (PID: 4672)

    • Reads Environment values

      • msiexec.exe (PID: 6644)
      • keepAwakeSetup.exe (PID: 6368)
      • msiexec.exe (PID: 7000)
      • keep-awake.exe (PID: 6848)
      • keep-awake.exe (PID: 5488)

    • Creates files or folders in the user directory

      • keepAwakeSetup.exe (PID: 6368)
      • tray_windows_release.exe (PID: 1620)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6552)

    • Process checks computer location settings

      • keepAwakeSetup.exe (PID: 6368)
      • msiexec.exe (PID: 6644)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6552)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 4672)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 4672)

    • Reads product name

      • keep-awake.exe (PID: 6848)
      • keep-awake.exe (PID: 5488)

    • Manual execution by a user

      • keep-awake.exe (PID: 5488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:10 11:15:23+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.41
CodeSize: 2915328
InitializedDataSize: 1225728
UninitializedDataSize: -
EntryPoint: 0x233890
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.3.0
ProductVersionNumber: 1.0.3.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: TBT CAPITAL LTD
FileDescription: Keep Awake Installer
FileVersion: 1.0.3
InternalName: keepAwakeSetup
LegalCopyright: Copyright (C) 2025 TBT CAPITAL LTD
OriginalFileName: keepAwakeSetup.exe
ProductName: Keep Awake
ProductVersion: 1.0.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
37
Malicious processes
3
Suspicious processes
7

Behavior graph

Click at the process to see the details
start keepawakesetup.exe msiexec.exe msiexec.exe no specs keepawakesetup.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs keep-awake.exe tray_windows_release.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs keep-awake.exe tray_windows_release.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs powershell.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powershell.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs keepawakesetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\WINDOWS\system32\powercfg.exe" /change standby-timeout-dc 0C:\Windows\System32\powercfg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1412"C:\WINDOWS\system32\powercfg.exe" /change standby-timeout-ac 30C:\Windows\System32\powercfg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1416\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tray_windows_release.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1556"C:\WINDOWS\system32\powercfg.exe" /change standby-timeout-dc 15C:\Windows\System32\powercfg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1620C:\Users\admin\.cache\node-systray\1.0.5\tray_windows_release.exeC:\Users\admin\.cache\node-systray\1.0.5\tray_windows_release.exe
keep-awake.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\.cache\node-systray\1.0.5\tray_windows_release.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1752C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\delete_msi.bat" "C:\Windows\SysWOW64\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1916\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2412\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2996C:\Users\admin\.cache\node-systray\1.0.5\tray_windows_release.exeC:\Users\admin\.cache\node-systray\1.0.5\tray_windows_release.exe—keep-awake.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\.cache\node-systray\1.0.5\tray_windows_release.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3796C:\WINDOWS\system32\cmd.exe /d /s /c "tasklist"C:\Windows\System32\cmd.exe—keep-awake.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
19 270
Read events
19 173
Write events
86
Delete events
11

Modification events

(PID) Process:(6552) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
981900009174687A657CDB01
(PID) Process:(6552) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
8DB04372324D93CF15AFFFE3D6F5231E9B19DDFC4FD348708FBFAEF574C4032C
(PID) Process:(6552) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6552) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(6552) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\138b2d.rbs
Value:
31161445
(PID) Process:(6552) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\138b2d.rbsLow
Value:
(PID) Process:(6552) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\750FAFCA7ECE17445AC9AF9BF6D70EB5
Operation:writeName:D7D6FF5297440A54DACD2755EB9F81AA
Value:
C:\Program Files (x86)\Keep Awake\
(PID) Process:(6552) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6AF48FD23BCF4F43BC37B32D7767B90
Operation:writeName:D7D6FF5297440A54DACD2755EB9F81AA
Value:
02:\Software\TBT CAPITAL LTD\Keep Awake\Version
(PID) Process:(6552) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2512E69D25E83A41BB56A5769AC541E
Operation:writeName:D7D6FF5297440A54DACD2755EB9F81AA
Value:
C:\Program Files (x86)\Keep Awake\keep-awake.exe
(PID) Process:(6552) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19E9774EEB17F754787C0F8E6297652A
Operation:writeName:D7D6FF5297440A54DACD2755EB9F81AA
Value:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Keep Awake\
Executable files
31
Suspicious files
40
Text files
41
Unknown types
0

Dropped files

PID
Process
Filename
Type
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\{25FF6D7D-4479-45A0-ADDC-7255BEF918AA}\EF918AA\keepAwake.msi —
MD5:—
SHA256:—
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\shi736E.tmpexecutable
MD5:84A34BF3486F7B9B7035DB78D78BDD1E
SHA256:F85911C910B660E528D2CF291BAA40A92D09961996D6D84E7A53A7095C7CD96E
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\MSI73BD.tmpexecutable
MD5:DE574F7F5256F98F356A2D620C4A2288
SHA256:E831A5AEBC7BD941FA815A9441E552A0BA699F9BD5454036A68CCBB42200353A
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\MSI74F9.tmpexecutable
MD5:DE574F7F5256F98F356A2D620C4A2288
SHA256:E831A5AEBC7BD941FA815A9441E552A0BA699F9BD5454036A68CCBB42200353A
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\MSI743B.tmpexecutable
MD5:DE574F7F5256F98F356A2D620C4A2288
SHA256:E831A5AEBC7BD941FA815A9441E552A0BA699F9BD5454036A68CCBB42200353A
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\MSI7519.tmpexecutable
MD5:DE574F7F5256F98F356A2D620C4A2288
SHA256:E831A5AEBC7BD941FA815A9441E552A0BA699F9BD5454036A68CCBB42200353A
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6368\completiimage
MD5:C23AF89757665BC0386FD798A61B2112
SHA256:031ED0378F819926D7B5B2C6C9367A0FB1CBAE40E1A3959E2652FE30A47D52F2
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6368\infoimage
MD5:8595D2A2D58310B448729E28649443D6
SHA256:27F13C4829994B214BB1A26EEF474DA67C521FD429536CB8421BA2F7C3E02B5F
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6368\insticonimage
MD5:EAC3781BA9FB0502D6F16253EB67B2B4
SHA256:F864E8640C98B65C6C1B9B66A850661E8397ED6E66B06F4424396275488AF1BE
6368keepAwakeSetup.exeC:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_6368\dialog.jpgimage
MD5:ABF1076064505DEE794FA7AED67252B8
SHA256:FB0D133F05DE6AA6A7A3491AE532191A60C438B35D9FF7BFEC9E63131F6F0C73
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
42
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.146:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6368
keepAwakeSetup.exe
GET
200
142.250.181.227:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
7124
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6604
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6604
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6368
keepAwakeSetup.exe
GET
200
142.250.181.227:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
444
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.146:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6368
keepAwakeSetup.exe
104.21.58.140:443
keepawake.app
CLOUDFLARENET
—
unknown
6368
keepAwakeSetup.exe
142.250.181.227:80
c.pki.goog
GOOGLE
US
whitelisted
444
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
92.123.104.38:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.146
  • 23.48.23.141
  • 23.48.23.137
  • 23.48.23.138
  • 23.48.23.139
  • 23.48.23.143
  • 23.48.23.147
  • 23.48.23.194
  • 23.48.23.135
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
keepawake.app
  • 104.21.58.140
  • 172.67.160.89
unknown
c.pki.goog
  • 142.250.181.227
whitelisted
www.bing.com
  • 92.123.104.38
  • 92.123.104.41
  • 92.123.104.37
  • 92.123.104.33
  • 92.123.104.44
  • 92.123.104.35
  • 92.123.104.43
  • 92.123.104.39
  • 92.123.104.36
  • 184.86.251.6
  • 184.86.251.17
  • 184.86.251.15
  • 184.86.251.31
  • 184.86.251.12
  • 184.86.251.4
  • 184.86.251.18
  • 184.86.251.14
  • 184.86.251.10
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.0
  • 40.126.31.3
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.130
  • 20.190.159.68
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
keepAwakeSetup.exe