File name:

WindowFX_6.13_Jasi2169_Patch.exe

Full analysis: https://app.any.run/tasks/e9bcdc07-e782-4a14-be2b-0fc4f0cc4fe1
Verdict: Malicious activity
Analysis date: September 27, 2024, 18:54:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

A5265565B35994C39C8376C917E8D779

SHA1:

FE072800BACBD3122CD5F894D96C3B79558696A2

SHA256:

9DB21AE510C459CD0F7FF4DA24A8362D8B3D0B41CEF6A64AE408CE3AC9CDB039

SSDEEP:

98304:wWjYBdIWuGSOGfNT0FSyvktAaC3fAoEkAaXY90YAsUf1WcbTDJLx7b/1b+uQ+9K2:pUZukc06RNlFUDuWB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • cmd.exe (PID: 1984)
      • net.exe (PID: 5940)

  • SUSPICIOUS

    • The process exported the data from the registry

      • irsetup.exe (PID: 2020)

    • Executable content was dropped or overwritten

      • irsetup.exe (PID: 2020)
      • Stardock WindowFX v6.13.exe (PID: 2208)
      • WindowFX_6.13_Jasi2169_Patch.exe (PID: 2488)

    • Executes as Windows Service

      • WindowFXSRV.exe (PID: 3584)

    • Process drops legitimate windows executable

      • irsetup.exe (PID: 2020)

    • Starts CMD.EXE for commands execution

      • WindowFX_6.13_Jasi2169_Patch.exe (PID: 2488)

  • INFO

    • Manual execution by a user

      • Stardock WindowFX v6.13.exe (PID: 4664)
      • Stardock WindowFX v6.13.exe (PID: 2208)
      • WindowFXConfig.exe (PID: 2776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:08:25 01:27:24+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 4302336
InitializedDataSize: 4324352
UninitializedDataSize: -
EntryPoint: 0x41c572
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: WindowFX_6.13_Jasi2169_Patch
FileVersion: 1.0.0.0
InternalName: WindowFX_6.13_Jasi2169_Patch.exe
LegalCopyright: Copyright © 2023
LegalTrademarks: -
OriginalFileName: WindowFX_6.13_Jasi2169_Patch.exe
ProductName: WindowFX_6.13_Jasi2169_Patch
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
21
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start windowfx_6.13_jasi2169_patch.exe stardock windowfx v6.13.exe no specs stardock windowfx v6.13.exe irsetup.exe reg.exe no specs conhost.exe no specs getmachinesid.exe no specs conhost.exe no specs windowfxconfig.exe windowfxsrv.exe no specs conhost.exe no specs windowfxsrv.exe no specs wfx32.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs deelevate64.exe no specs windowfxconfig.exe no specs sddisplay.exe no specs windowfx_6.13_jasi2169_patch.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe" NVIDIAC:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe
irsetup.exe
User:
admin
Integrity Level:
HIGH
Description:
WindowFX 6 Configuration app
Exit code:
0
Version:
6.1.3.0
Modules
Images
c:\program files (x86)\stardock\windowfx\windowfxconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
752C:\WINDOWS\system32\net1 stop WindowFXC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
1656\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1984"cmd" /c net stop WindowFXC:\Windows\SysWOW64\cmd.exe—WindowFX_6.13_Jasi2169_Patch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2020"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:2189346 "__IRAFN:C:\Users\admin\Desktop\Stardock WindowFX v6.13.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-1693682860-607145093-2874071422-1001"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Stardock WindowFX v6.13.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
9.5.3.0
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_0\irsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2208"C:\Users\admin\Desktop\Stardock WindowFX v6.13.exe" C:\Users\admin\Desktop\Stardock WindowFX v6.13.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
9.5.3.0
Modules
Images
c:\users\admin\desktop\stardock windowfx v6.13.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2372"C:\Program Files (x86)\Stardock\WindowFX\WindowFXSRV.exe" -installC:\Program Files (x86)\Stardock\WindowFX\WindowFXSRV.exe—irsetup.exe
User:
admin
Company:
Stardock Corporation
Integrity Level:
HIGH
Description:
WindowFX Service. Part of Stardock WindowFX 6 Do not redistribute
Exit code:
0
Version:
6.0.5.0
Modules
Images
c:\program files (x86)\stardock\windowfx\windowfxsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2488"C:\Users\admin\AppData\Local\Temp\WindowFX_6.13_Jasi2169_Patch.exe" C:\Users\admin\AppData\Local\Temp\WindowFX_6.13_Jasi2169_Patch.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
WindowFX_6.13_Jasi2169_Patch
Exit code:
1073807364
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\windowfx_6.13_jasi2169_patch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2776"C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe" C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowFX 6 Configuration app
Exit code:
1073807364
Version:
6.1.3.0
Modules
Images
c:\program files (x86)\stardock\windowfx\windowfxconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
3292\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—GetMachineSID.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 455
Read events
16 383
Write events
69
Delete events
3

Modification events

(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
0202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000E00000010000000030000000F000000000000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Operation:writeName:MRUListEx
Value:
040000000000000005000000020000000100000003000000FFFFFFFF
(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\Shell
Operation:writeName:SniffedFolderType
Value:
Documents
(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:Mode
Value:
4
(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:LogicalViewMode
Value:
1
(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:FFlags
Value:
(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:IconSize
Value:
16
(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:Sort
Value:
000000000000000000000000000000000100000030F125B7EF471A10A5F102608C9EEBAC0A00000001000000
(PID) Process:(2488) WindowFX_6.13_Jasi2169_Patch.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}
Operation:writeName:ColInfo
Value:
00000000000000000000000000000000FDDFDFFD100000000000000000000000040000001800000030F125B7EF471A10A5F102608C9EEBAC0A0000001001000030F125B7EF471A10A5F102608C9EEBAC0E0000007800000030F125B7EF471A10A5F102608C9EEBAC040000007800000030F125B7EF471A10A5F102608C9EEBAC0C00000050000000
Executable files
82
Suspicious files
24
Text files
219
Unknown types
0

Dropped files

PID
Process
Filename
Type
2020irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPGimage
MD5:3220A6AEFB4FC719CC8849F060859169
SHA256:988CF422CBF400D41C48FBE491B425A827A1B70691F483679C1DF02FB9352765
2020irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPGimage
MD5:AC40DED6736E08664F2D86A65C47EF60
SHA256:F35985FE1E46A767BE7DCEA35F8614E1EDD60C523442E6C2C2397D1E23DBD3EA
2020irsetup.exeC:\Users\admin\AppData\Local\Temp\sdWebResults.xmltext
MD5:B9DCC4AF8C3AE8125B4CA0BFFD3B58F4
SHA256:7996CE1DAD32B190033362AD5296AF720179B70E3526D334B8A148388A214D45
2020irsetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\260EF0C182C75809024BB75385DB127Abinary
MD5:BB4ED2652660B33BB6D43E04467EE726
SHA256:EE396A9CA7A27DD1056530FC22D9FF8F4555273AE2080C09B8CF7BE1180EC512
2020irsetup.exeC:\Program Files (x86)\Stardock\WindowFX\Uninstall\uniD213.tmpbinary
MD5:56112310F6BE5457335E0452B060C49F
SHA256:66153DE050E41BEDDD6058069707550B82015763BC3C4B9323EC4FABF72D2AAB
2020irsetup.exeC:\Program Files (x86)\Stardock\WindowFX\Uninstall\uninstall.xmlxml
MD5:E201368CA5D516EA0BEA65A030A9AFFB
SHA256:03F649FEE1CBA41FBEACFD4B2199410A196C1B2B4B76BE755B83195494649853
2020irsetup.exeC:\Program Files (x86)\Stardock\WindowFX\lua5.1.dllexecutable
MD5:80D93D38BADECDD2B134FE4699721223
SHA256:C572A6103AF1526F97E708A229A532FD02100A52B949F721052107F1F55E0C59
2020irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.datbinary
MD5:01A78435F5DF795996245B336EE5A4DA
SHA256:88ECC99925D5EBF29CA3159C4B7B25E5D798999BA58EA9958825122B5ADFD250
2020irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exeexecutable
MD5:55BBF335F75F2A2FE0A5DAF603964D41
SHA256:723ADAE0E69127A6BFBC65C5EF552A351264205EA5E2BC3B80E505FEAA5D0E43
2020irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\Encoding.lmdexecutable
MD5:6EEC47AB86D212FE3ED0F56985C8E817
SHA256:D0B2FA60E707982899ECD8C4DC462721C82491245B26721A7C0E840C5F557AED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
51
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2064
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5084
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2020
irsetup.exe
GET
200
195.138.255.18:80
http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgT1UmEztRGhN1JcBziQjemItA%3D%3D
unknown
—
—
whitelisted
188
WindowFXConfig.exe
GET
200
152.199.19.74:80
http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D
unknown
—
—
whitelisted
188
WindowFXConfig.exe
GET
200
152.199.19.74:80
http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D
unknown
—
—
whitelisted
188
WindowFXConfig.exe
GET
200
192.229.221.95:80
http://s1.symcb.com/pca3-g5.crl
unknown
—
—
whitelisted
3332
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
188
WindowFXConfig.exe
GET
200
152.199.19.74:80
http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEEClNK624QZdQH5L3WsEheo%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4324
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2952
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2064
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2064
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.68
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.72
  • 20.190.160.20
  • 40.126.32.133
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WindowFX_6.13_Jasi2169_Patch.exe