File name:

Client++ Pico.exe

Full analysis: https://app.any.run/tasks/c021dbab-f305-41ae-9a4a-9585b1454d62
Verdict: Malicious activity
Analysis date: May 20, 2025, 13:56:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rust
Indicators:
MD5:

2374A67E47146212459246AF223419FF

SHA1:

D13835A0F493184FB08545F76FF266116F8F89DF

SHA256:

A4FE40CEFFD45CEFA9683445DE0C752742A7796CD8A2A1202AFA0FF2AC574CB0

SSDEEP:

98304:2FgYm6EsS0IQWf17VXXj79wp0zL5f+KWKg/x9myYJDzmCfaIsXtNj73qN6V1hfDo:zvHre+gB3wUCP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 3020)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Client++ Pico.exe (PID: 2568)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Executable content was dropped or overwritten

      • Client++ Pico.exe (PID: 2568)
      • MicrosoftEdgeUpdate.exe (PID: 3020)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5428)

    • Process drops legitimate windows executable

      • Client++ Pico.exe (PID: 2568)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5428)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 5428)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2108)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5512)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1628)
      • MicrosoftEdgeUpdate.exe (PID: 4488)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 3020)

  • INFO

    • Checks supported languages

      • Client++ Pico.exe (PID: 2568)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5428)
      • MicrosoftEdgeUpdate.exe (PID: 4488)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5512)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2108)
      • MicrosoftEdgeUpdate.exe (PID: 3020)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1628)
      • MicrosoftEdgeUpdate.exe (PID: 6816)
      • MicrosoftEdgeUpdate.exe (PID: 6676)
      • MicrosoftEdgeUpdate.exe (PID: 3332)

    • Reads the computer name

      • Client++ Pico.exe (PID: 2568)
      • MicrosoftEdgeUpdate.exe (PID: 4488)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5512)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2108)
      • MicrosoftEdgeUpdate.exe (PID: 3020)
      • MicrosoftEdgeUpdate.exe (PID: 6816)
      • MicrosoftEdgeUpdate.exe (PID: 6676)
      • MicrosoftEdgeUpdate.exe (PID: 3332)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1628)

    • Reads the machine GUID from the registry

      • Client++ Pico.exe (PID: 2568)

    • Checks proxy server information

      • Client++ Pico.exe (PID: 2568)
      • MicrosoftEdgeUpdate.exe (PID: 6676)
      • MicrosoftEdgeUpdate.exe (PID: 6816)

    • Application based on Rust

      • Client++ Pico.exe (PID: 2568)

    • Create files in a temporary directory

      • Client++ Pico.exe (PID: 2568)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5428)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • The sample compiled with english language support

      • Client++ Pico.exe (PID: 2568)
      • MicrosoftEdgeUpdate.exe (PID: 3020)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5428)

    • Reads the software policy settings

      • Client++ Pico.exe (PID: 2568)
      • MicrosoftEdgeUpdate.exe (PID: 6816)
      • MicrosoftEdgeUpdate.exe (PID: 6676)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 3020)
      • MicrosoftEdgeUpdate.exe (PID: 6676)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6816)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
12
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start client++ pico.exe sppextcomobj.exe no specs slui.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
896C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1616"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1628"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.185.21
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.185.21\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2108"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.185.21
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.185.21\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2568"C:\Users\admin\AppData\Local\Temp\Client++ Pico.exe" C:\Users\admin\AppData\Local\Temp\Client++ Pico.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\client++ pico.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3020C:\Users\admin\AppData\Local\Temp\EUF222.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EUF222.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.21
Modules
Images
c:\users\admin\appdata\local\temp\euf222.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
3332"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource taggedmi /sessionid "{27EF111A-2271-4270-B74B-23DBA1764A0A}"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.21
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4488"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.21
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
5428C:\Users\admin\AppData\Local\Temp\\MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
Client++ Pico.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.185.21
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5512"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.185.21
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.185.21\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
6 976
Read events
5 749
Write events
1 193
Delete events
34

Modification events

(PID) Process:(3020) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(3020) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(3020) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(3020) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.185.21
(PID) Process:(3020) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(3020) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.185.21
(PID) Process:(3020) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.185.21\MicrosoftEdgeUpdateCore.exe"
(PID) Process:(5512) MicrosoftEdgeUpdateComRegisterShell64.exeKey:HKEY_CLASSES_ROOT\CLSID\{81093D63-7825-417B-BFC8-ADC63FA4E53D}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(5512) MicrosoftEdgeUpdateComRegisterShell64.exeKey:HKEY_CLASSES_ROOT\CLSID\{5EA43877-C6D8-4885-B77A-C0BB27E94372}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(5512) MicrosoftEdgeUpdateComRegisterShell64.exeKey:HKEY_CLASSES_ROOT\CLSID\{AF41D186-598E-49DD-A801-1B87D2F8941A}\InprocHandler32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
202
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5428MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF222.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:0ED41F5910128213C23EDC35DB3D46D3
SHA256:EF7E0E4E9CBD804356C897156436EF50C5F3F7C3D223E412CC1F66315CC36D6A
5428MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF222.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:31F9E08922765BA2913632F758BC7423
SHA256:C2988C13F66CE033FEF65F3AF20A00FAF555047E710DC6C282C124C848C1EB88
5428MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF222.tmp\msedgeupdate.dllexecutable
MD5:9CB2B82FBDDE7133369F0D8618DBA139
SHA256:0AA838B27DA61C7BD94E073B35CB5CF1CF0762D74CCC0214D052F7327D52AE06
5428MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF222.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:23A351591308D49BFE2625D302820715
SHA256:7610B2C0BF22563E850E185864D9244EEE94C853E6595CD18AC59B6D603AF651
2568Client++ Pico.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:AFE19B551BEF3007E6C67AF7A3C726EF
SHA256:0685C3054BBC59A1B1502257D0DAFDF4DEC22F0965ADA2EA88939B4F729B795C
5428MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF222.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:8CAFE7A2695F6E148AD96296F4D08694
SHA256:749816A17965CD8F250081914490144BD9E057D7D13044C6E2C9339EDF30F5F4
5428MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF222.tmp\psmachine.dllexecutable
MD5:E454864035FEBE2CDD04685BDE98228E
SHA256:D441F6E6862E2AF4799AD29960F7D952FF73FED68AC579D314199C076D8B7D0B
5428MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF222.tmp\msedgeupdateres_bn.dllexecutable
MD5:A164B4C542D58D702E81E05024D95459
SHA256:F332FD86EA630AFB90BC9D50925B25BD85037E18F186AA45C047FC179CCD77A4
5428MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF222.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:433681CA511D96F96479AC2CCA102522
SHA256:DA5F97895EFB9698657EA213E6D0CAB53FFE6BEE32933CA2341406FAF64DFCBC
5428MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF222.tmp\psmachine_arm64.dllexecutable
MD5:FF7F9138228E82A7E79FDF4C44576E28
SHA256:AE8E48B5A0DB9EAD202BBEE7623AFCC8FFAF64B27DD1D641C2F7C18F3C896C0E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
24
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5964
svchost.exe
GET
—
23.48.23.66:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6eb5dca7-2768-4016-8dbe-9762e2b79397?P1=1748354228&P2=404&P3=2&P4=NvNrDZJAZFh6NRJvmhPK36IGHQoWtpe0SqPwJiQOpjKJURHOACRaLn%2fjs2xuqVO7RPzyM53fIVJFFjv3K5VOPg%3d%3d
unknown
—
—
whitelisted
5964
svchost.exe
HEAD
200
23.48.23.66:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6eb5dca7-2768-4016-8dbe-9762e2b79397?P1=1748354228&P2=404&P3=2&P4=NvNrDZJAZFh6NRJvmhPK36IGHQoWtpe0SqPwJiQOpjKJURHOACRaLn%2fjs2xuqVO7RPzyM53fIVJFFjv3K5VOPg%3d%3d
unknown
—
—
whitelisted
1272
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1272
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2568
Client++ Pico.exe
144.6.249.106:443
files.cuffuffles.dev
The University of Tasmania
AU
unknown
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
files.cuffuffles.dev
  • 144.6.249.106
unknown
login.live.com
  • 40.126.32.136
  • 40.126.32.140
  • 20.190.160.65
  • 20.190.160.2
  • 40.126.32.138
  • 20.190.160.5
  • 20.190.160.66
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
config.edge.skype.com
  • 13.107.43.16
whitelisted
msedge.api.cdp.microsoft.com
  • 4.151.228.221
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 23.48.23.66
  • 23.48.23.7
whitelisted

Threats

PID
Process
Class
Message
5964
svchost.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Client++ Pico.exe