File name:

Wub_x64.exe

Full analysis: https://app.any.run/tasks/f4fa1c31-4487-4d86-a9d1-79dc528fb68f
Verdict: Malicious activity
Analysis date: February 23, 2025, 22:27:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

4DE68A46A3C3D4104AA3609C9004238B

SHA1:

AB69DCA72F1CC0CA0A1A74DE5CCAA62BF95591AD

SHA256:

B34F463E49EE79001E38C0A2BB70AF2A54C0EDA036934EEDCC22440220D7809E

SSDEEP:

24576:2Qpsfo0qwnq9siaZAtz9IHPrFw+kpBiLXMB2QCaELqUSn+23xZB0AC:2Ysfoqnq9daZKz94PrFw+kpBiLXMB2Q2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Wub_x64.exe (PID: 556)
      • Wub_x64.exe (PID: 2736)
      • Wub_x64.exe (PID: 6260)

    • Creates or modifies Windows services

      • Wub_x64.exe (PID: 6260)

    • Changes the Windows auto-update feature

      • Wub_x64.exe (PID: 6260)

    • Changes the autorun value in the registry

      • reg.exe (PID: 6692)

  • SUSPICIOUS

    • Creates or modifies Windows services

      • Wub_x64.exe (PID: 6260)
      • Wub_x64.exe (PID: 2736)

    • Modifies existing scheduled task

      • schtasks.exe (PID: 3540)
      • schtasks.exe (PID: 6772)
      • schtasks.exe (PID: 2972)
      • schtasks.exe (PID: 3732)
      • schtasks.exe (PID: 6972)
      • schtasks.exe (PID: 3608)
      • schtasks.exe (PID: 5464)
      • schtasks.exe (PID: 396)
      • schtasks.exe (PID: 4384)
      • schtasks.exe (PID: 6556)
      • schtasks.exe (PID: 6672)
      • schtasks.exe (PID: 7028)
      • schtasks.exe (PID: 4500)
      • schtasks.exe (PID: 6716)
      • schtasks.exe (PID: 5488)
      • schtasks.exe (PID: 5320)
      • schtasks.exe (PID: 188)
      • schtasks.exe (PID: 4392)
      • schtasks.exe (PID: 3364)
      • schtasks.exe (PID: 6204)
      • schtasks.exe (PID: 6376)
      • schtasks.exe (PID: 6824)
      • schtasks.exe (PID: 5916)
      • schtasks.exe (PID: 5972)
      • schtasks.exe (PID: 2324)
      • schtasks.exe (PID: 5992)
      • schtasks.exe (PID: 6772)
      • schtasks.exe (PID: 2076)
      • schtasks.exe (PID: 6904)
      • schtasks.exe (PID: 7028)
      • schtasks.exe (PID: 7128)
      • schtasks.exe (PID: 5888)

    • Application launched itself

      • Wub_x64.exe (PID: 6260)
      • Skype.exe (PID: 5640)

    • Uses REG/REGEDIT.EXE to modify registry

      • Skype.exe (PID: 5640)

    • Detected use of alternative data streams (AltDS)

      • Skype.exe (PID: 5640)

    • Reads security settings of Internet Explorer

      • Skype.exe (PID: 5640)

    • Process uses IPCONFIG to get network configuration information

      • cmd.exe (PID: 1216)

  • INFO

    • Checks supported languages

      • Wub_x64.exe (PID: 6260)
      • Wub_x64.exe (PID: 2736)
      • Skype.exe (PID: 5640)
      • Skype.exe (PID: 4516)
      • Skype.exe (PID: 2164)
      • Skype.exe (PID: 6824)
      • Skype.exe (PID: 6916)
      • Skype.exe (PID: 5888)

    • Create files in a temporary directory

      • Wub_x64.exe (PID: 6260)
      • Skype.exe (PID: 5640)

    • Reads the computer name

      • Wub_x64.exe (PID: 2736)
      • Skype.exe (PID: 5640)
      • Skype.exe (PID: 4516)
      • Skype.exe (PID: 6824)
      • Skype.exe (PID: 6916)
      • Wub_x64.exe (PID: 6260)

    • Reads mouse settings

      • Wub_x64.exe (PID: 2736)
      • Wub_x64.exe (PID: 6260)

    • Manual execution by a user

      • Skype.exe (PID: 5640)
      • cmd.exe (PID: 1216)

    • Reads CPU info

      • Skype.exe (PID: 5640)

    • Checks proxy server information

      • Skype.exe (PID: 5640)

    • Process checks computer location settings

      • Skype.exe (PID: 5640)
      • Skype.exe (PID: 6916)
      • Skype.exe (PID: 5888)

    • Creates files or folders in the user directory

      • Skype.exe (PID: 5640)
      • Skype.exe (PID: 6916)
      • Skype.exe (PID: 6824)

    • Reads the machine GUID from the registry

      • Skype.exe (PID: 5640)

    • Reads the software policy settings

      • Skype.exe (PID: 5640)

    • The sample compiled with english language support

      • Wub_x64.exe (PID: 6260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2010:04:16 07:47:52+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 9
CodeSize: 613376
InitializedDataSize: 231424
UninitializedDataSize: -
EntryPoint: 0x1d47c
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.0
ProductVersionNumber: 1.6.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
FileVersion: 1.6.0.0
Comments: Windows Update Blocker v1.6
FileDescription: Windows Update Blocker v1.6
LegalCopyright: Copyright © 2016-2020 www.sordum.org All Rights Reserved.
CompanyName: www.sordum.org
ProductVersion: 1.6.0.0
OriginalFileName: Wub.exe
Coder: By BlueLife
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
222
Monitored processes
90
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start wub_x64.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs wub_x64.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs skype.exe skype.exe no specs skype.exe no specs skype.exe reg.exe conhost.exe no specs skype.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs skype.exe no specs cmd.exe no specs conhost.exe no specs ipconfig.exe no specs wub_x64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\WINDOWS\System32\schtasks.exe" /change /tn "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /disableC:\Windows\System32\schtasks.exe—Wub_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
396"C:\WINDOWS\System32\schtasks.exe" /change /tn "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /disableC:\Windows\System32\schtasks.exe—Wub_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
556"C:\Users\admin\AppData\Local\Temp\Wub_x64.exe" C:\Users\admin\AppData\Local\Temp\Wub_x64.exe—explorer.exe
User:
admin
Company:
www.sordum.org
Integrity Level:
MEDIUM
Description:
Windows Update Blocker v1.6
Exit code:
3221226540
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\wub_x64.exe
c:\windows\system32\ntdll.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
836\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1216"C:\WINDOWS\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll
1448\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2040C:\WINDOWS\system32\reg.exe QUERY HKCU\Software\Microsoft\Skype /v RestartForUpdateC:\Windows\SysWOW64\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
9 419
Read events
9 384
Write events
12
Delete events
23

Modification events

(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv
Operation:writeName:Start
Value:
3
(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Operation:writeName:TrayIconVisibility
Value:
0
(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WaaSMedicSvc
Operation:writeName:Start
Value:
4
(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WaaSMedicSvc
Operation:delete valueName:WubLock
Value:
(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WaaSMedicSvc
Operation:writeName:WubLock
Value:
1
(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UsoSvc
Operation:writeName:Start
Value:
3
(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UsoSvc
Operation:delete valueName:WubLock
Value:
(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:NoAutoUpdate
Value:
1
(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv
Operation:writeName:Start
Value:
4
(PID) Process:(6260) Wub_x64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv
Operation:delete valueName:WubLock
Value:
Executable files
0
Suspicious files
30
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
6260Wub_x64.exeC:\Users\admin\AppData\Local\Temp\aut56AF.tmpbinary
MD5:4BF876B14B5E2BFEA79D7450E28AD3F1
SHA256:794D43AEF1F207C7EBC71588F412214F6DBE02A66DCC1F47DC9F407A2B11FCB6
6260Wub_x64.exeC:\Users\admin\AppData\Local\Temp\Wub.inibinary
MD5:DD7DABB59279B6893AD4140E3AA18CC9
SHA256:DB08397EDFCF77229975498CB9D29EB9B99F5449F22755A9019085A2935B0CDB
5640Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Crashpad\settings.datbinary
MD5:9D0439A794AA96ABD6AFF504C86C7F31
SHA256:5DBC3A5DAF431973E245D83AB51B128E9C4CC2F3ECD61C45C88DB161ACC25B7B
6260Wub_x64.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:4EBD7B702B806725AD4B3AE751F9FC00
SHA256:A31591834F86ED09610A65D728922EEF481FA3A5F86B5130C407ED4126EB4FB2
6260Wub_x64.exeC:\Users\admin\AppData\Local\Temp\thqtzrftext
MD5:DCCD1B51F8612D0599D4A6C9DF69D5E3
SHA256:4286F58FD908577130E8E91C846BCA73D7F54999C70D7A7259529A66EFF1A436
5640Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acltext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
6260Wub_x64.exeC:\Windows\System32\GroupPolicy\gpt.initext
MD5:617078BCAAA2FF95E4438D83A49CE878
SHA256:42EC7933F10ABA61202B3FC7D3C02D47CFD0C953A8F2CB0E39DF3069697F99EF
5640Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.oldtext
MD5:46EED8B7CAAD25F7F453617DA0FB0857
SHA256:5BC1DE0E32F2969386351B2BE088F13B6CC3DF7693EE9E92FEEF59DB6AF1FB92
2736Wub_x64.exeC:\Windows\Temp\aut9DAA.tmpbinary
MD5:4BF876B14B5E2BFEA79D7450E28AD3F1
SHA256:794D43AEF1F207C7EBC71588F412214F6DBE02A66DCC1F47DC9F407A2B11FCB6
5640Skype.exeC:\Users\admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dictext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
53
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
736
svchost.exe
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
736
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
DE
binary
312 b
whitelisted
5892
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
DE
binary
471 b
whitelisted
2972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
QA
binary
419 b
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
DE
binary
471 b
whitelisted
2972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
QA
binary
408 b
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.177:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
736
svchost.exe
23.48.23.177:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
736
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.34:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.177
  • 23.48.23.167
  • 23.48.23.168
  • 23.48.23.166
  • 23.48.23.161
  • 23.48.23.174
  • 23.48.23.162
  • 23.48.23.169
  • 23.48.23.159
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.bing.com
  • 92.123.104.34
  • 92.123.104.38
  • 92.123.104.31
  • 92.123.104.32
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.69
  • 40.126.31.129
  • 20.190.159.71
  • 20.190.159.75
  • 40.126.31.0
  • 20.190.159.0
  • 20.190.159.64
  • 40.126.31.130
  • 40.126.31.1
  • 20.190.159.130
  • 40.126.31.67
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Wub_x64.exe