File name:

FakeAV.exe

Full analysis: https://app.any.run/tasks/c40ce10b-1164-49c9-92dc-31365e6ce3dd
Verdict: Malicious activity
Analysis date: March 24, 2025, 14:32:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

0A87DC22CFBBC05178CEABED8F51E9C3

SHA1:

DAB26E2AEB3BEC3D745BB7286981AE39749FCDC4

SHA256:

A99CDC43E635906A6F45DAE3EF07186A6E786AC3620E4D30CBF716C64DEF240D

SSDEEP:

49152:fIM7lSg6s9KC/U4Z/y8Mlpns95ySa6sxR7LpgCTZ7IvTpn8rL4VVMpPmWZ4fxmiV:fI6LxJZVMlpns9wTJB9Iln0oNxDC2S5w

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • svc-enmm.exe (PID: 7376)

    • UAC/LUA settings modification

      • svc-enmm.exe (PID: 7376)

    • Antivirus name has been found in the command line (generic signature)

      • reg.exe (PID: 7688)
      • reg.exe (PID: 6404)

    • Changes image file execution options

      • svc-enmm.exe (PID: 7376)
      • reg.exe (PID: 7708)
      • reg.exe (PID: 7688)
      • reg.exe (PID: 6412)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • FakeAV.exe (PID: 5968)
      • svc-enmm.exe (PID: 3896)
      • svc-enmm.exe (PID: 7376)
      • ShellExperienceHost.exe (PID: 8180)

    • Starts itself from another location

      • FakeAV.exe (PID: 5968)

    • Executable content was dropped or overwritten

      • FakeAV.exe (PID: 5968)

    • Hides command output

      • cmd.exe (PID: 7220)

    • Starts CMD.EXE for commands execution

      • FakeAV.exe (PID: 5968)

    • Application launched itself

      • svc-enmm.exe (PID: 3896)

    • Stops a currently running service

      • sc.exe (PID: 7468)
      • sc.exe (PID: 7532)
      • sc.exe (PID: 7496)
      • sc.exe (PID: 6332)
      • sc.exe (PID: 6348)
      • sc.exe (PID: 6364)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7476)
      • sc.exe (PID: 7512)
      • sc.exe (PID: 7564)
      • sc.exe (PID: 7544)
      • sc.exe (PID: 7596)
      • sc.exe (PID: 7616)
      • sc.exe (PID: 6340)
      • sc.exe (PID: 6388)
      • sc.exe (PID: 6372)
      • sc.exe (PID: 6380)
      • sc.exe (PID: 6396)
      • sc.exe (PID: 6356)

    • Creates or modifies Windows services

      • svc-enmm.exe (PID: 7376)

    • Checks for external IP

      • svc-enmm.exe (PID: 7376)
      • svchost.exe (PID: 2196)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4124)

    • Uses REG/REGEDIT.EXE to modify registry

      • svc-enmm.exe (PID: 7376)
      • svc-enmm.exe (PID: 6284)

  • INFO

    • Creates files or folders in the user directory

      • FakeAV.exe (PID: 5968)
      • svc-enmm.exe (PID: 7376)

    • Checks supported languages

      • FakeAV.exe (PID: 5968)
      • svc-enmm.exe (PID: 3896)
      • svc-enmm.exe (PID: 7376)
      • ShellExperienceHost.exe (PID: 8180)
      • RUXIMICS.exe (PID: 5008)

    • Reads the computer name

      • FakeAV.exe (PID: 5968)
      • svc-enmm.exe (PID: 3896)
      • svc-enmm.exe (PID: 7376)
      • PLUGScheduler.exe (PID: 4124)
      • ShellExperienceHost.exe (PID: 8180)

    • Reads CPU info

      • FakeAV.exe (PID: 5968)
      • svc-enmm.exe (PID: 3896)
      • svc-enmm.exe (PID: 7376)

    • Process checks computer location settings

      • FakeAV.exe (PID: 5968)
      • svc-enmm.exe (PID: 3896)

    • Checks proxy server information

      • svc-enmm.exe (PID: 7376)
      • mshta.exe (PID: 7436)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 4124)

    • Manual execution by a user

      • svc-enmm.exe (PID: 6284)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:02:20 06:05:05+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 708608
InitializedDataSize: 942080
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
326
Monitored processes
57
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start fakeav.exe svc-enmm.exe no specs cmd.exe no specs conhost.exe no specs svc-enmm.exe mshta.exe sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs reg.exe reg.exe conhost.exe no specs conhost.exe no specs svchost.exe shellexperiencehost.exe no specs sppextcomobj.exe no specs slui.exe no specs plugscheduler.exe no specs ruximics.exe no specs svc-enmm.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3896C:\Users\admin\AppData\Roaming\svc-enmm.exeC:\Users\admin\AppData\Roaming\svc-enmm.exe—FakeAV.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\svc-enmm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
4124"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
5008%ProgramFiles%\RUXIM\RUXIMICS.EXE /nonetworkC:\Program Files\RUXIM\RUXIMICS.exe—PLUGScheduler.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Reusable UX Interaction Manager
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\ruximics.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
5968"C:\Users\admin\AppData\Local\Temp\FakeAV.exe" C:\Users\admin\AppData\Local\Temp\FakeAV.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\fakeav.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6284"C:\Users\admin\AppData\Roaming\svc-enmm.exe" C:\Users\admin\AppData\Roaming\svc-enmm.exe—explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\svc-enmm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\shlwapi.dll
6332sc.exe stop bckwfsC:\Windows\SysWOW64\sc.exe—svc-enmm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
6340sc.exe config bckwfs start= disabledC:\Windows\SysWOW64\sc.exe—svc-enmm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
6348sc.exe stop wuauservC:\Windows\SysWOW64\sc.exe—svc-enmm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
6356sc.exe config wuauserv start= disabledC:\Windows\SysWOW64\sc.exe—svc-enmm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\rpcrt4.dll
Total events
4 192
Read events
4 120
Write events
72
Delete events
0

Modification events

(PID) Process:(7376) svc-enmm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Settings
Operation:writeName:UID
Value:
owyqyyeeca
(PID) Process:(7376) svc-enmm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Settings
Operation:writeName:net
Value:
_5
(PID) Process:(7376) svc-enmm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MZP_BEST
Value:
C:\Users\admin\AppData\Roaming\svc-enmm.exe
(PID) Process:(7376) svc-enmm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Settings
Operation:writeName:Config
Value:
E9070300010018000E0020002D0083020000000000000000000000000000000000000000E9070300010018000E0020002D008302E9070300010018000E0020002D008302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000B80B0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7376) svc-enmm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc.dll
Operation:writeName:Debugger
Value:
c:\windows\vsjitdebugger.exe
(PID) Process:(7376) svc-enmm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSseces
Operation:writeName:Debugger
Value:
c:\windows\vsjitdebugger.exe
(PID) Process:(7376) svc-enmm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSconfig.exe
Operation:writeName:Debugger
Value:
c:\windows\vsjitdebugger.exe
(PID) Process:(7376) svc-enmm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui
Operation:writeName:Debugger
Value:
c:\windows\vsjitdebugger.exe
(PID) Process:(7376) svc-enmm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun
Operation:writeName:Debugger
Value:
c:\windows\vsjitdebugger.exe
(PID) Process:(7376) svc-enmm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpuxsrv.exe
Operation:writeName:Debugger
Value:
c:\windows\vsjitdebugger.exe
Executable files
1
Suspicious files
87
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7376svc-enmm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\ID0CVBX1.htmhtml
MD5:7D7E33E5FD30BBC6341A4985DEAE75A9
SHA256:643B66B9720941A7DA848A1A766F124AD830D92598A4E37B084F5C9EC8E6D1FF
4124PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.042.etlbinary
MD5:C1F87CF12DD702D2185E703BA004D216
SHA256:9D993487866C9538DC19F281A6346E1796E7478C7C164D61437AF6E698C66125
4124PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.050.etlbinary
MD5:C8834D365FAE073DEDE1F1620454CE71
SHA256:C6DD793EEE1D5551CA507A3C5BFFECA82DD3E29C63C2C6DD218A7D4BFB37046B
4124PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.045.etlbinary
MD5:89BD161BF7B46C9078937CF832786737
SHA256:2B83DF5532E9F54ED301C8F82E2CDD489799C8D5222A2D44C97DCB151A96FAA9
4124PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.047.etlbinary
MD5:FED961067F664B5381B65A534B7AB728
SHA256:652F31A8284AE812D1D9D24192BC800976BF74C240591C6AC443A28C4709FB7C
4124PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.046.etlbinary
MD5:A7A21FBC9D00F33F186B34A50E170C13
SHA256:64CAC91E46D4FC832958232A658431CBF9D8D9F265653ACA2BEB32428D4688EC
4124PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.044.etlbinary
MD5:B53B2070E686FFB1FBC8B06994E7C8D7
SHA256:A3ABD06F4E40CB700B1908AB6BCD2E27455E13EF076E0BF2345BB2FA369EF802
4124PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.049.etlbinary
MD5:5EA68411BF8E9EAF4621BAF73F61449E
SHA256:9D4CA5A1D871F819C139A498BB910A63576C2FE6367853544F8D172D8B6EBFF7
4124PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.048.etlbinary
MD5:A23907B6FDD47DCABFDFD7CF2FCD7671
SHA256:0C9C33FE9E984A2E5A70EBA51F36B9929A86199E424AF2F8080E1267B87DC970
4124PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.043.etlbinary
MD5:8A2BDE0EAFA7E946196A1B114AB636E9
SHA256:1C338CBDD9316D7FD8F208341466FEDC554A04D489B3A86C736EC3831A2F2BA2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
68
DNS requests
30
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.54.128:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7376
svc-enmm.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7072
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7072
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7084
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
95.101.54.128:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7376
svc-enmm.exe
158.101.44.242:80
checkip.dyndns.org
ORACLE-BMC-31898
US
whitelisted
7436
mshta.exe
205.234.215.211:80
—
SERVERCENTRAL
US
unknown
2152
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 95.101.54.128
  • 95.101.54.122
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.129
  • 20.190.159.71
  • 20.190.159.130
  • 40.126.31.67
  • 20.190.159.4
  • 40.126.31.1
  • 20.190.159.75
  • 40.126.31.3
  • 20.190.160.2
  • 20.190.160.67
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
checkip.dyndns.org
  • 158.101.44.242
  • 132.226.8.169
  • 132.226.247.73
  • 193.122.6.168
  • 193.122.130.0
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
7376
svc-enmm.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
7376
svc-enmm.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FakeAV.exe