File name:

quicksoftware-dl.exe

Full analysis: https://app.any.run/tasks/0f1098c5-c641-4d10-aadb-fc95fe4195e8
Verdict: Malicious activity
Analysis date: May 24, 2025, 12:34:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

ADD26F07028D142EDB4EC2B018C9D62A

SHA1:

76D903040626DB9DB94552A0FE880E3FA75E863E

SHA256:

B12DE74429CCE391832B921C1E60D797C9E629BE3949A7BF24DBF871AC60B1D7

SSDEEP:

3072:ylZMtTwu1DZN9VVF1VlVrabVFXzaVS4TgIz4O9m5DtXU:y/MtJN9VVF1VlVSTXzaVS4TgIz4iqDm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • quicksoftware-dl.exe (PID: 6584)

    • The process creates files with name similar to system file names

      • quicksoftware-dl.exe (PID: 6584)

    • Executable content was dropped or overwritten

      • quicksoftware-dl.exe (PID: 6584)
      • aria2c.exe (PID: 6388)
      • python-3.13.3-amd64.exe (PID: 5400)
      • python-3.13.3-amd64.exe (PID: 6808)
      • python-3.13.3-amd64.exe (PID: 5984)

    • Reads security settings of Internet Explorer

      • quicksoftware-dl.exe (PID: 6584)
      • python-3.13.3-amd64.exe (PID: 5400)

    • There is functionality for taking screenshot (YARA)

      • quicksoftware-dl.exe (PID: 6584)
      • python-3.13.3-amd64.exe (PID: 5400)

    • Starts CMD.EXE for commands execution

      • quicksoftware-dl.exe (PID: 6584)

    • Drops 7-zip archiver for unpacking

      • aria2c.exe (PID: 6388)

    • Searches for installed software

      • python-3.13.3-amd64.exe (PID: 5400)
      • dllhost.exe (PID: 728)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6372)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 5188)
      • python-3.13.3-amd64.exe (PID: 5400)

    • The process drops C-runtime libraries

      • python-3.13.3-amd64.exe (PID: 5400)
      • msiexec.exe (PID: 5188)

    • Starts itself from another location

      • python-3.13.3-amd64.exe (PID: 5400)

    • Process drops python dynamic module

      • msiexec.exe (PID: 5188)

  • INFO

    • Checks supported languages

      • quicksoftware-dl.exe (PID: 6584)
      • aria2c.exe (PID: 6388)
      • python-3.13.3-amd64.exe (PID: 6808)
      • python-3.13.3-amd64.exe (PID: 5400)
      • python-3.13.3-amd64.exe (PID: 5984)

    • Reads the computer name

      • quicksoftware-dl.exe (PID: 6584)
      • aria2c.exe (PID: 6388)
      • python-3.13.3-amd64.exe (PID: 5400)
      • python-3.13.3-amd64.exe (PID: 5984)

    • The sample compiled with english language support

      • quicksoftware-dl.exe (PID: 6584)
      • aria2c.exe (PID: 6388)
      • python-3.13.3-amd64.exe (PID: 6808)
      • python-3.13.3-amd64.exe (PID: 5400)
      • msiexec.exe (PID: 5188)

    • Create files in a temporary directory

      • quicksoftware-dl.exe (PID: 6584)
      • python-3.13.3-amd64.exe (PID: 5400)
      • python-3.13.3-amd64.exe (PID: 6808)

    • Reads the software policy settings

      • quicksoftware-dl.exe (PID: 6584)
      • slui.exe (PID: 4428)
      • slui.exe (PID: 5204)

    • Reads the machine GUID from the registry

      • quicksoftware-dl.exe (PID: 6584)
      • aria2c.exe (PID: 6388)

    • Checks proxy server information

      • quicksoftware-dl.exe (PID: 6584)
      • slui.exe (PID: 5204)

    • Creates files or folders in the user directory

      • quicksoftware-dl.exe (PID: 6584)

    • Creates a new folder

      • cmd.exe (PID: 4112)

    • Manual execution by a user

      • python-3.13.3-amd64.exe (PID: 6808)

    • Process checks computer location settings

      • python-3.13.3-amd64.exe (PID: 5400)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5188)

    • Manages system restore points

      • SrTasks.exe (PID: 6480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:08 23:05:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 184832
UninitializedDataSize: 2048
EntryPoint: 0x358d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
18
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start quicksoftware-dl.exe sppextcomobj.exe no specs slui.exe svchost.exe cmd.exe no specs conhost.exe no specs aria2c.exe conhost.exe no specs rundll32.exe no specs slui.exe python-3.13.3-amd64.exe python-3.13.3-amd64.exe python-3.13.3-amd64.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
728C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
736C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1764\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—aria2c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2568C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4112"cmd.exe" /c mkdir downloaded-filesC:\Windows\SysWOW64\cmd.exe—quicksoftware-dl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4428"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5188C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5204C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5400"C:\Users\admin\AppData\Local\Temp\{2A161F1A-E678-414C-BF36-E2033BB1380C}\.cr\python-3.13.3-amd64.exe" -burn.clean.room="C:\Users\admin\Desktop\downloaded-files\python-3.13.3-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 C:\Users\admin\AppData\Local\Temp\{2A161F1A-E678-414C-BF36-E2033BB1380C}\.cr\python-3.13.3-amd64.exe
python-3.13.3-amd64.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.13.3 (64-bit)
Version:
3.13.3150.0
Modules
Images
c:\users\admin\appdata\local\temp\{2a161f1a-e678-414c-bf36-e2033bb1380c}\.cr\python-3.13.3-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
27 645
Read events
24 323
Write events
3 259
Delete events
63

Modification events

(PID) Process:(6584) quicksoftware-dl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6584) quicksoftware-dl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6584) quicksoftware-dl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5984) python-3.13.3-amd64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000002B0DE894A8CCDB0160170000E40F0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(728) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000002B0DE894A8CCDB01D802000090080000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(728) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000068384095A8CCDB01D802000090080000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(728) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000005DD53D95A8CCDB01D802000090080000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(728) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000005DD53D95A8CCDB01D802000090080000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(728) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000F4524795A8CCDB01D802000090080000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(728) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
Executable files
86
Suspicious files
198
Text files
1 899
Unknown types
1

Dropped files

PID
Process
Filename
Type
6388aria2c.exeC:\Users\admin\Desktop\downloaded-files\vlc-3.0.21-win64.exe.aria2__tempbinary
MD5:F3D70F5D8BC08C783EFA80E54C10E4D3
SHA256:6F45DAD11CE1ED5079D36466BE0B2D374DB7826C1C22AF1FE78F542E63768E1D
6584quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsxBCEA.tmp\nsDialogs.dllexecutable
MD5:8F0E7415F33843431DF308BB8E06AF81
SHA256:BB49F15FA83452370047A7801E39FC7F64E70C7545B8999BB85AA4749EAA048B
6584quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\54C62B182F5BF07FA8427C07B0A3AAF8_786EA6C36BF7ABFF201B638497282D19binary
MD5:079FC5FB79627ADD094B5DCB665397E7
SHA256:E0CB54DB14A85E0F2F244E91D97A1F3B25D2759EE790C94DA9BAB28FF103F67D
6584quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsxBCEA.tmp\INetC.dllexecutable
MD5:40D7ECA32B2F4D29DB98715DD45BFAC5
SHA256:85E03805F90F72257DD41BFDAA186237218BBB0EC410AD3B6576A88EA11DCCB9
6584quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsxBCEA.tmp\System.dllexecutable
MD5:9B38A1B07A0EBC5C7E59E63346ECC2DB
SHA256:C881253DAFCF1322A771139B1A429EC1E78C507CA81A218A20DC1A4B25ABBFE7
6584quicksoftware-dl.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\aria2c[1].exeexecutable
MD5:6C5EA5A82D756BCA4A9610C8D2260D2F
SHA256:B9CD71B275AF11B63C33457B0F43F2F2675937070C563E195F223EFD7FA4C74B
6584quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsxBCEA.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
6584quicksoftware-dl.exeC:\Users\admin\AppData\Local\Temp\nsxBCEA.tmp\modern-header.bmpimage
MD5:583C38FB0F5AF5FE584D9A9B01D6A3E7
SHA256:4C9E804CE1A391F8E603B7B9C732A6529C1E81BE4D12F125C8562EA9D49095C2
6584quicksoftware-dl.exeC:\Users\admin\Desktop\aria2script.txttext
MD5:F71E3833F698C3C62409469692A5446B
SHA256:CFC2233ED169E5BEA2B1D9F04538F24B602B8ECC9016896300A6D5D5C59C7627
6584quicksoftware-dl.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\54C62B182F5BF07FA8427C07B0A3AAF8_786EA6C36BF7ABFF201B638497282D19binary
MD5:2EAA0859782ED877B89881411A4D2CA1
SHA256:A2F3DFD9E9644901A5807E03AF713A1FCE517D79B2170CA1C4048302E15A3326
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
60
DNS requests
50
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6584
quicksoftware-dl.exe
GET
200
18.173.205.57:80
http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTUkpS%2BK0oZhSMx%2FmmCZ76UqdjUxQQUJhR%2B4NzXpvfi1AQn32HxwuznMsoCEFv%2BMpErdkO9Fsl4vDuI1mA%3D
unknown
—
—
whitelisted
6584
quicksoftware-dl.exe
GET
200
18.173.205.57:80
http://ocsps.ssl.com/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBQMDtATfnJO6JAXDQoHl8pAaJdhTQQU3QQJB6L1en1SUxKSle44gCUNplkCCAmX7RCdHwf8
unknown
—
—
whitelisted
756
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
756
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
756
lsass.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.46
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.2
  • 40.126.31.130
  • 20.190.159.73
  • 40.126.31.71
  • 40.126.31.69
  • 20.190.159.130
  • 40.126.31.129
  • 20.190.159.131
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
files.webdevtest.ftp.sh
  • 139.84.173.225
unknown
ocsps.ssl.com
  • 18.173.205.57
  • 18.173.205.113
  • 18.173.205.76
  • 18.173.205.43
whitelisted
7-zip.org
  • 49.12.202.237
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.ftp .sh Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
quicksoftware-dl.exe