File name:

Faronics_DFS.zip

Full analysis: https://app.any.run/tasks/f6e20c87-b3f0-461a-9c00-0e3317e60b06
Verdict: Malicious activity
Analysis date: December 19, 2024, 22:41:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

68DAE0B63E600D35F45979378C83343C

SHA1:

C289C2F6A6E42007F26262E9E6568D4CEE5CC655

SHA256:

A18B25E22C36A51E84745023198A6B98E363CC72A1DA8FFEE89CB61D44E876C0

SSDEEP:

98304:c+OmPBb1CJY+Id80IjLleiaaNU/dK9iWXUesrNJU47cY1ioV2R0nwLmx3h906+mJ:+d/YDOoFl04gBuAIwUXm0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • DeepFreeze_C.exe (PID: 4224)

    • Using BCDEDIT.EXE to modify recovery options

      • DeepFreeze_C.exe (PID: 4224)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 6548)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • DFStd.exe (PID: 6920)
      • DeepFreeze_C.exe (PID: 4224)
      • _T~WUCLI.exe (PID: 6956)
      • _T~WUCLI.exe (PID: 1412)

    • Executable content was dropped or overwritten

      • DFStd.exe (PID: 6920)
      • _T~WUCLI.exe (PID: 6956)
      • DeepFreeze_C.exe (PID: 4224)
      • _T~WUCLI.exe (PID: 1412)

    • Detected use of alternative data streams (AltDS)

      • _T~WUCLI.exe (PID: 6956)
      • _T~WUCLI.exe (PID: 1412)

    • Process drops legitimate windows executable

      • _T~WUCLI.exe (PID: 6956)
      • _T~WUCLI.exe (PID: 1412)

    • The process creates files with name similar to system file names

      • _T~WUCLI.exe (PID: 6956)
      • _T~WUCLI.exe (PID: 1412)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 7044)
      • DismHost.exe (PID: 6260)

    • Creates files in the driver directory

      • DeepFreeze_C.exe (PID: 4224)

    • Creates or modifies Windows services

      • DeepFreeze_C.exe (PID: 4224)

    • Starts CMD.EXE for commands execution

      • DeepFreeze_C.exe (PID: 4224)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4268)

    • Drops a system driver (possible attempt to evade defenses)

      • DeepFreeze_C.exe (PID: 4224)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6356)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6356)
      • DFStd.exe (PID: 6920)
      • _T~WUCLI.exe (PID: 6956)
      • _T~WUCLI.exe (PID: 1412)
      • DeepFreeze_C.exe (PID: 4224)

    • Manual execution by a user

      • DFStd.exe (PID: 6868)
      • DFStd.exe (PID: 6920)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6356)

    • Reads the computer name

      • DFStd.exe (PID: 6920)
      • _T~WUCLI.exe (PID: 6956)
      • DismHost.exe (PID: 7044)
      • DismHost.exe (PID: 6260)
      • DFServ.exe (PID: 6844)
      • FrzState2k.exe (PID: 6908)
      • PLUGScheduler.exe (PID: 4268)

    • Checks supported languages

      • DFStd.exe (PID: 6920)
      • _T~WUCLI.exe (PID: 6956)
      • _T~WUCLI.exe (PID: 1412)
      • DismHost.exe (PID: 7044)
      • DismHost.exe (PID: 6260)
      • DFServ.exe (PID: 6844)
      • PLUGScheduler.exe (PID: 4268)

    • Create files in a temporary directory

      • DFStd.exe (PID: 6920)
      • _T~WUCLI.exe (PID: 6956)
      • DeepFreeze_C.exe (PID: 4224)
      • _T~WUCLI.exe (PID: 1412)
      • mofcomp.exe (PID: 2632)
      • mofcomp.exe (PID: 6736)

    • Sends debugging messages

      • _T~WUCLI.exe (PID: 6956)
      • _T~WUCLI.exe (PID: 1412)
      • DismHost.exe (PID: 7044)
      • DismHost.exe (PID: 6260)

    • Reads Environment values

      • DismHost.exe (PID: 7044)

    • UPX packer has been detected

      • DFStd.exe (PID: 6920)
      • DeepFreeze_C.exe (PID: 4224)

    • Creates files in the program directory

      • DFStd.exe (PID: 6920)
      • DeepFreeze_C.exe (PID: 4224)
      • PLUGScheduler.exe (PID: 4268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:08:24 13:38:04
ZipCRC: 0xf799afb8
ZipCompressedSize: 12229092
ZipUncompressedSize: 17961904
ZipFileName: Faronics_DFS/DFStd.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
291
Monitored processes
31
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs dfstd.exe no specs dfstd.exe _t~wucli.exe conhost.exe no specs dismhost.exe tiworker.exe no specs deepfreeze_c.exe _t~wucli.exe conhost.exe no specs dismhost.exe cmd.exe no specs conhost.exe no specs mofcomp.exe no specs mofcomp.exe no specs mofcomp.exe no specs regsvr32.exe no specs regsvr32.exe no specs dfserv.exe no specs bcdedit.exe no specs conhost.exe no specs dflocker64.exe no specs plugscheduler.exe no specs regsvr32.exe no specs regsvr32.exe no specs reagentc.exe no specs conhost.exe no specs frzstate2k.exe bcdedit.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132mofcomp FaronicsWebProduct.mof C:\Windows\SysWOW64\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1412"C:\Users\admin\AppData\Local\Temp\_T~WUCLI.exe" -q -text -logfile "C:\DFInstall.log" C:\Users\admin\AppData\Local\Temp\_T~WUCLI.exe
DeepFreeze_C.exe
User:
admin
Company:
Faronics Corporation
Integrity Level:
HIGH
Description:
Deep Freeze Windows Update Command Line Utility
Exit code:
0
Version:
8,71,220,5734
Modules
Images
c:\users\admin\appdata\local\temp\_t~wucli.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2088\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2448C:\WINDOWS\system32\regsvr32.exe /s /u "C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\DeepFreezeAdapter.dll"C:\Windows\SysWOW64\regsvr32.exe—DeepFreeze_C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
5
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2556"C:\WINDOWS\TEMP\DFLocker64.exe"C:\Windows\Temp\DFLocker64.exe—DFServ.exe
User:
SYSTEM
Company:
Faronics Corporation
Integrity Level:
SYSTEM
Description:
Deep Freeze Show Message Helper
Exit code:
0
Version:
8,71,20,5734
Modules
Images
c:\windows\temp\dflocker64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2632mofcomp FaronicsWebProduct_v1.mof C:\Windows\SysWOW64\wbem\mofcomp.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3992\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—bcdedit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4224C:\WINDOWS\Temp\DeepFreeze_C.exe /silent /nocloudagentC:\Windows\Temp\DeepFreeze_C.exe
DFStd.exe
User:
admin
Company:
Faronics Corporation
Integrity Level:
HIGH
Description:
Workstation install program for Deep Freeze Cloud
Exit code:
1073807364
Version:
8,71,20,5734
Modules
Images
c:\windows\temp\deepfreeze_c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4268"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4872cmd.exe /c cd "C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0" & mofcomp FaronicsWebProduct.mof >> "%TEMP%\mof.log" & mofcomp FaronicsWebProduct_v1.mof >> "%TEMP%\mof.log" & mofcomp DeepFreezeWorkstation.mof >> "%TEMP%\mof.log"C:\Windows\SysWOW64\cmd.exe—DeepFreeze_C.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
71 161
Read events
70 982
Write events
66
Delete events
113

Modification events

(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Faronics_DFS.zip
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7120) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31150695
(PID) Process:(7120) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
Executable files
117
Suspicious files
56
Text files
18
Unknown types
8

Dropped files

PID
Process
Filename
Type
6356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6356.42990\Faronics_DFS\Documentation\Deutsch\Deep Freeze Standard Benutzerhandbuch.urlbinary
MD5:44CC280F6869F8A1D28770A752437CD2
SHA256:2593A4A6A82A8558F4E2BEA001643A55FC6A2E7955F50295DEA3F3538C99236C
6356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6356.42990\Faronics_DFS\DFStd.exeexecutable
MD5:1FD10393197F95E322BAF28B5E6C9584
SHA256:3AFF5169EEB9CED019B158169B300C344032BBD8FCEDAA0C1686C48C7AB108BD
6356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6356.42990\Faronics_DFS\Documentation\Francais\Data Igloo Manuel de l'utilisateur.urlbinary
MD5:872381DC88E9248E51ECD9B8602D3935
SHA256:3ED7D402D7F754FA4D774D47521CBBDEA734AED37E54FBA4D3AE32A59AC08AB2
6356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6356.42990\Faronics_DFS\Documentation\Japanese\Data Igloo User Guide.urlurl
MD5:93DFF501D597EBDF8141B6C5F267EA2F
SHA256:E09937D664933D16F2CBC5958D046B6DBC0527C5BCE3D87D21CCDFE3D706A569
6356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6356.42990\Faronics_DFS\Documentation\English\Data Igloo User Guide.urlurl
MD5:5954FE160C4533AB2113261D327F2C5F
SHA256:A72F11F35CBEEC043F08468CD4D8E8605FB0907A85D3D36ABF65F39A5481EEEB
6356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6356.42990\Faronics_DFS\Documentation\Japanese\Deep Freeze Standard User Guide.urlurl
MD5:F143037F4CDAD5E228840F4C855D8DA6
SHA256:4BAA1E3D54352386C5B9D62DEFA3989D7CB46D290BACD8E0FC3D4AEC51B823BE
6356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6356.42990\Faronics_DFS\Documentation\Espanol\Deep Freeze Standard Guiüa de usuario.urlurl
MD5:632D44C61955F3DB1680529FDBF077B4
SHA256:79BABE9CD9DAF02AE2BED1A6A4196EEBB49FE4748845B00674D18A32DF3CBE25
6356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6356.42990\Faronics_DFS\Documentation\Francais\Deep Freeze Standard Manuel de l'utilisateur.urlbinary
MD5:5C078540122FEC4C04685284BC39D691
SHA256:5A9E03416841356767528DCC9F68C622FA531C3D2AC6DB1822A3E9272E3884EB
6920DFStd.exeC:\Users\admin\AppData\Local\Temp\_T~WUCLI.exeexecutable
MD5:E8BB32DF046E4CCD3E0E7FFF49838E0C
SHA256:3668C6943C03C7ADE552124D44AD4ABE7A9D23E6103F98B727124B98CFEDB4E7
6356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6356.42990\Faronics_DFS\Documentation\Simplified Chinese\Data Igloo User Guide.urlbinary
MD5:25D8067B7F9C836AE1AE6072013DE0B5
SHA256:DA306FD5213575EC947DDA29590046A4068A2D612A3E63754A15E1C02C605986
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
56
DNS requests
33
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5564
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5564
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3420
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5728
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5728
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5072
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1140
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5564
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5564
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.209.133:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.bing.com
  • 2.23.209.133
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.130
  • 2.23.209.149
  • 2.23.209.187
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.73
  • 40.126.31.69
  • 20.190.159.23
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.160.22
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.72
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.68
  • 40.126.32.133
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
Process
Message
_T~WUCLI.exe
PID=6956 TID=6960 DismApi.dll: Parent process command line: "C:\Users\admin\AppData\Local\Temp\_T~WUCLI.exe" -q -text -logfile "C:\DFInstall.log" - DismInitializeInternal
_T~WUCLI.exe
PID=6956 TID=6960 Input parameters: LogLevel: 0, LogFilePath: (null), ScratchDirectory: (null) - DismInitializeInternal
_T~WUCLI.exe
PID=6956 TID=6960 DismApi.dll: - DismInitializeInternal
_T~WUCLI.exe
PID=6956 TID=6960 DismApi.dll: <----- Starting DismApi.dll session -----> - DismInitializeInternal
_T~WUCLI.exe
PID=6956 TID=6960 Enter DismInitializeInternal - DismInitializeInternal
_T~WUCLI.exe
PID=6956 TID=6960 DismApi.dll: - DismInitializeInternal
_T~WUCLI.exe
PID=6956 TID=6960 DismApi.dll: Host machine information: OS Version=10.0.19045, Running architecture=x86, Number of processors=4 - DismInitializeInternal
_T~WUCLI.exe
PID=6956 TID=6960 DismApi.dll: API Version 10.0.19041.3758 - DismInitializeInternal
_T~WUCLI.exe
PID=6956 TID=6960 Initialized SessionTable - DismInitializeInternal
_T~WUCLI.exe
PID=6956 TID=6960 Initialized GlobalConfig - DismInitializeInternal
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Faronics_DFS.zip