File name:

8813bd0f5dc33f31a6984f8287aefde22cf793715652a82af08497374cc37656.zip

Full analysis: https://app.any.run/tasks/ac49412a-31f0-44b2-9dec-b70b87b17f1f
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Analysis date: June 17, 2025, 18:45:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
asyncrat
rat
arch-exec
netreactor
xworm
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

437E701EC10BA5C92945530BB063495B

SHA1:

C21344CD5A0578331F74031E2B417F45E689B034

SHA256:

8F4C095292D2F032BC7FB36EF508B4EE878015A1DC66E5081E10D53BCB9D1F9A

SSDEEP:

24576:cfxxjdqavaHqKztmrMjhwtksYJoQLrMzKeivutX8VIPgNx8K:cfxBdqavaHqKztmrMjhwOsYJ5vsKeivX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • ASYNCRAT has been found (auto)

      • WinRAR.exe (PID: 3752)
      • WinRAR.exe (PID: 6344)
      • AV25097 Delivery Note.scr (PID: 6492)
    • Generic archive extractor

      • WinRAR.exe (PID: 3752)
    • Uses Task Scheduler to run other applications

      • AV25097 Delivery Note.scr (PID: 6492)
      • AV25097 Delivery Note.scr (PID: 4832)
      • AV25097 Delivery Note.scr (PID: 1812)
      • AV25097 Delivery Note.scr (PID: 4892)
      • AV25097 Delivery Note.scr (PID: 6612)
      • AV25097 Delivery Note.scr (PID: 4544)
      • AV25097 Delivery Note.scr (PID: 728)
    • Create files in the Startup directory

      • RegSvcs.exe (PID: 3936)
    • XWORM has been detected (YARA)

      • RegSvcs.exe (PID: 3936)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • AV25097 Delivery Note.scr (PID: 6492)
      • RegSvcs.exe (PID: 3936)
    • Reads security settings of Internet Explorer

      • AV25097 Delivery Note.scr (PID: 6492)
      • WinRAR.exe (PID: 6344)
      • AV25097 Delivery Note.scr (PID: 1812)
      • AV25097 Delivery Note.scr (PID: 4832)
      • AV25097 Delivery Note.scr (PID: 4892)
      • AV25097 Delivery Note.scr (PID: 6612)
      • AV25097 Delivery Note.scr (PID: 4544)
      • AV25097 Delivery Note.scr (PID: 728)
    • Starts application with an unusual extension

      • WinRAR.exe (PID: 6344)
    • Connects to unusual port

      • RegSvcs.exe (PID: 3936)
  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 6344)
      • AV25097 Delivery Note.scr (PID: 6492)
      • AV25097 Delivery Note.scr (PID: 1812)
      • AV25097 Delivery Note.scr (PID: 4832)
      • AV25097 Delivery Note.scr (PID: 4544)
      • AV25097 Delivery Note.scr (PID: 4892)
      • AV25097 Delivery Note.scr (PID: 6612)
      • AV25097 Delivery Note.scr (PID: 3588)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6344)
    • Checks supported languages

      • AV25097 Delivery Note.scr (PID: 6492)
      • AV25097 Delivery Note.scr (PID: 1812)
      • AV25097 Delivery Note.scr (PID: 4832)
      • RegSvcs.exe (PID: 3936)
      • AV25097 Delivery Note.scr (PID: 4544)
      • AV25097 Delivery Note.scr (PID: 4892)
      • AV25097 Delivery Note.scr (PID: 728)
      • AV25097 Delivery Note.scr (PID: 6612)
      • AV25097 Delivery Note.scr (PID: 3588)
      • RegSvcs.exe (PID: 5012)
      • RegSvcs.exe (PID: 6264)
      • RegSvcs.exe (PID: 4052)
      • RegSvcs.exe (PID: 4888)
      • RegSvcs.exe (PID: 6700)
      • RegSvcs.exe (PID: 5060)
    • Reads the computer name

      • AV25097 Delivery Note.scr (PID: 6492)
      • AV25097 Delivery Note.scr (PID: 1812)
      • AV25097 Delivery Note.scr (PID: 4832)
      • RegSvcs.exe (PID: 3936)
      • AV25097 Delivery Note.scr (PID: 4544)
      • AV25097 Delivery Note.scr (PID: 4892)
      • AV25097 Delivery Note.scr (PID: 3588)
      • AV25097 Delivery Note.scr (PID: 728)
      • AV25097 Delivery Note.scr (PID: 6612)
      • RegSvcs.exe (PID: 5012)
      • RegSvcs.exe (PID: 6264)
      • RegSvcs.exe (PID: 4052)
      • RegSvcs.exe (PID: 6700)
      • RegSvcs.exe (PID: 5060)
      • RegSvcs.exe (PID: 4888)
    • Reads the machine GUID from the registry

      • AV25097 Delivery Note.scr (PID: 6492)
      • AV25097 Delivery Note.scr (PID: 1812)
      • AV25097 Delivery Note.scr (PID: 4832)
      • RegSvcs.exe (PID: 3936)
      • AV25097 Delivery Note.scr (PID: 4544)
      • AV25097 Delivery Note.scr (PID: 4892)
      • AV25097 Delivery Note.scr (PID: 3588)
      • AV25097 Delivery Note.scr (PID: 728)
      • AV25097 Delivery Note.scr (PID: 6612)
      • RegSvcs.exe (PID: 6264)
      • RegSvcs.exe (PID: 5012)
      • RegSvcs.exe (PID: 6700)
      • RegSvcs.exe (PID: 4052)
      • RegSvcs.exe (PID: 4888)
      • RegSvcs.exe (PID: 5060)
    • Creates files or folders in the user directory

      • AV25097 Delivery Note.scr (PID: 6492)
      • RegSvcs.exe (PID: 3936)
    • .NET Reactor protector has been detected

      • AV25097 Delivery Note.scr (PID: 6492)
      • AV25097 Delivery Note.scr (PID: 1812)
    • Process checks computer location settings

      • AV25097 Delivery Note.scr (PID: 6492)
      • AV25097 Delivery Note.scr (PID: 1812)
      • AV25097 Delivery Note.scr (PID: 4832)
      • AV25097 Delivery Note.scr (PID: 4892)
      • AV25097 Delivery Note.scr (PID: 4544)
      • AV25097 Delivery Note.scr (PID: 6612)
      • AV25097 Delivery Note.scr (PID: 728)
    • Create files in a temporary directory

      • AV25097 Delivery Note.scr (PID: 6492)
      • AV25097 Delivery Note.scr (PID: 1812)
      • AV25097 Delivery Note.scr (PID: 4832)
      • AV25097 Delivery Note.scr (PID: 4544)
      • AV25097 Delivery Note.scr (PID: 4892)
      • AV25097 Delivery Note.scr (PID: 6612)
      • AV25097 Delivery Note.scr (PID: 728)
    • Launching a file from the Startup directory

      • RegSvcs.exe (PID: 3936)
    • Reads the software policy settings

      • slui.exe (PID: 2216)
    • Checks proxy server information

      • slui.exe (PID: 2216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(3936) RegSvcs.exe
C2196.251.87.81:7040
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
Mutexvc0DI1nBHFOhuBXk
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:06:17 18:44:24
ZipCRC: 0x5a645fbb
ZipCompressedSize: 449701
ZipUncompressedSize: 449687
ZipFileName: 8813bd0f5dc33f31a6984f8287aefde22cf793715652a82af08497374cc37656.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
35
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ASYNCRAT winrar.exe no specs #ASYNCRAT winrar.exe slui.exe #ASYNCRAT av25097 delivery note.scr av25097 delivery note.scr no specs av25097 delivery note.scr no specs schtasks.exe no specs conhost.exe no specs #XWORM regsvcs.exe av25097 delivery note.scr no specs av25097 delivery note.scr no specs av25097 delivery note.scr no specs av25097 delivery note.scr no specs av25097 delivery note.scr no specs schtasks.exe no specs conhost.exe no specs regsvcs.exe no specs schtasks.exe no specs conhost.exe no specs regsvcs.exe no specs schtasks.exe no specs conhost.exe no specs regsvcs.exe no specs schtasks.exe no specs conhost.exe no specs regsvcs.exe no specs schtasks.exe no specs conhost.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs schtasks.exe no specs conhost.exe no specs regsvcs.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728"C:\Users\admin\AppData\Local\Temp\Rar$DIa6344.31281\AV25097 Delivery Note.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa6344.31281\AV25097 Delivery Note.scrWinRAR.exe
User:
admin
Company:
Crescendo Visualworks
Integrity Level:
MEDIUM
Description:
Allegro Graph • Symphony Edition
Exit code:
0
Version:
4.2.1845.62
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia6344.31281\av25097 delivery note.scr
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1028"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeAV25097 Delivery Note.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1232"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cRXmQXIhUkHn" /XML "C:\Users\admin\AppData\Local\Temp\tmp9D25.tmp"C:\Windows\SysWOW64\schtasks.exeAV25097 Delivery Note.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1356"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cRXmQXIhUkHn" /XML "C:\Users\admin\AppData\Local\Temp\tmpD8D7.tmp"C:\Windows\SysWOW64\schtasks.exeAV25097 Delivery Note.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1812"C:\Users\admin\Desktop\AV25097 Delivery Note.scr" /SC:\Users\admin\Desktop\AV25097 Delivery Note.screxplorer.exe
User:
admin
Company:
Crescendo Visualworks
Integrity Level:
MEDIUM
Description:
Allegro Graph • Symphony Edition
Exit code:
0
Version:
4.2.1845.62
Modules
Images
c:\users\admin\desktop\av25097 delivery note.scr
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeschtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeschtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2148"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeAV25097 Delivery Note.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2216C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2664"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeAV25097 Delivery Note.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
8 382
Read events
8 349
Write events
20
Delete events
13

Modification events

(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\8813bd0f5dc33f31a6984f8287aefde22cf793715652a82af08497374cc37656.zip
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(3752) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
4
Suspicious files
1
Text files
7
Unknown types
1

Dropped files

PID
Process
Filename
Type
6492AV25097 Delivery Note.scrC:\Users\admin\AppData\Roaming\cRXmQXIhUkHn.exeexecutable
MD5:54A08AFB7D4946DFDD48D907BD2AF047
SHA256:CA081D2E9E512E1516EDC180262C4309DDA83AD714A281ABD26FC1A658BCED01
3936RegSvcs.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClean.lnklnk
MD5:ED96231E2BC6D97E6EF97CC30208BC59
SHA256:7901057598C1A87D047ADEF9C61248334B08C63FDFF3A366324A341342FC92A2
4544AV25097 Delivery Note.scrC:\Users\admin\AppData\Local\Temp\tmpD8D7.tmpxml
MD5:268472AEA210321442C3A2878FCF1F7A
SHA256:6CD87E6B81810988638D6B97A43DB1735391B756B1C9859D9B7501EEA5F9EFA8
6344WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6344.31281\AV25097 Delivery Note.screxecutable
MD5:54A08AFB7D4946DFDD48D907BD2AF047
SHA256:CA081D2E9E512E1516EDC180262C4309DDA83AD714A281ABD26FC1A658BCED01
6612AV25097 Delivery Note.scrC:\Users\admin\AppData\Local\Temp\tmpDD3C.tmpxml
MD5:268472AEA210321442C3A2878FCF1F7A
SHA256:6CD87E6B81810988638D6B97A43DB1735391B756B1C9859D9B7501EEA5F9EFA8
3936RegSvcs.exeC:\Users\admin\AppData\Roaming\XClean.exeexecutable
MD5:6279D136310C22894F605938B4CB93D8
SHA256:FB7D514B3322810463655473D2D7C704D3405C1C9DD81F0D4D423518EF416987
4892AV25097 Delivery Note.scrC:\Users\admin\AppData\Local\Temp\tmpDA7C.tmpxml
MD5:268472AEA210321442C3A2878FCF1F7A
SHA256:6CD87E6B81810988638D6B97A43DB1735391B756B1C9859D9B7501EEA5F9EFA8
728AV25097 Delivery Note.scrC:\Users\admin\AppData\Local\Temp\tmpE55A.tmpxml
MD5:268472AEA210321442C3A2878FCF1F7A
SHA256:6CD87E6B81810988638D6B97A43DB1735391B756B1C9859D9B7501EEA5F9EFA8
4832AV25097 Delivery Note.scrC:\Users\admin\AppData\Local\Temp\tmpB8FA.tmpxml
MD5:268472AEA210321442C3A2878FCF1F7A
SHA256:6CD87E6B81810988638D6B97A43DB1735391B756B1C9859D9B7501EEA5F9EFA8
1812AV25097 Delivery Note.scrC:\Users\admin\AppData\Local\Temp\tmpAE4C.tmpxml
MD5:268472AEA210321442C3A2878FCF1F7A
SHA256:6CD87E6B81810988638D6B97A43DB1735391B756B1C9859D9B7501EEA5F9EFA8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
34
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1200
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1636
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1636
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
1268
svchost.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4544
RUXIMICS.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1200
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1200
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.110
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.1
  • 40.126.31.2
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.73
  • 40.126.31.71
  • 40.126.31.130
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info