File name:

decrypted.exe

Full analysis: https://app.any.run/tasks/fee84a7a-5382-4539-9e04-f4cbb74ee6d9
Verdict: Malicious activity
Analysis date: January 20, 2025, 14:21:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
pastebin
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

921240D91C53F4B9F07C6DFEA91BFCB1

SHA1:

88D44A68B726BACCC3BF2F9FB2AB31DD2D8AE75A

SHA256:

B39020A8E369DF9CD3F14FB80EE2FB0FE0E54C347B6A9F7B004636763BDAD31E

SSDEEP:

98304:krq3BdwbBNNaprvZB9TenZOVMYoYBtERcxnXPRYl9DjyxzNRw6zFXxA6LBgBq8KB:3aYJ93M6OhW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • decrypted.exe (PID: 6572)
      • decrypted.exe (PID: 6660)

    • Antivirus name has been found in the command line (generic signature)

      • find.exe (PID: 3524)
      • cmd.exe (PID: 748)
      • tasklist.exe (PID: 6652)
      • find.exe (PID: 6640)
      • cmd.exe (PID: 4876)
      • tasklist.exe (PID: 5240)
      • cmd.exe (PID: 5576)
      • tasklist.exe (PID: 128)
      • find.exe (PID: 1684)
      • find.exe (PID: 6176)
      • cmd.exe (PID: 6216)
      • tasklist.exe (PID: 5128)
      • find.exe (PID: 6268)
      • cmd.exe (PID: 640)
      • tasklist.exe (PID: 6172)

    • Starts CMD.EXE for self-deleting

      • electronics.exe (PID: 6772)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • decrypted.tmp (PID: 6596)
      • decrypted.exe (PID: 6572)
      • decrypted.exe (PID: 6660)
      • decrypted.tmp (PID: 6688)
      • electronics.exe (PID: 6352)

    • Reads security settings of Internet Explorer

      • decrypted.tmp (PID: 6596)

    • Reads the Windows owner or organization settings

      • decrypted.tmp (PID: 6596)
      • decrypted.tmp (PID: 6688)

    • Process drops legitimate windows executable

      • decrypted.tmp (PID: 6688)

    • Get information on the list of running processes

      • decrypted.tmp (PID: 6688)
      • cmd.exe (PID: 748)
      • cmd.exe (PID: 6736)
      • cmd.exe (PID: 4876)
      • cmd.exe (PID: 5576)
      • cmd.exe (PID: 6216)
      • cmd.exe (PID: 640)

    • Starts CMD.EXE for commands execution

      • decrypted.tmp (PID: 6688)
      • electronics.exe (PID: 6772)

    • Starts the AutoIt3 executable file

      • decrypted.tmp (PID: 6688)
      • cmd.exe (PID: 7116)

    • Hides command output

      • cmd.exe (PID: 7116)

    • Connects to unusual port

      • MSBuild.exe (PID: 5496)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7116)

    • The executable file from the user directory is run by the CMD process

      • electronics.exe (PID: 6352)

  • INFO

    • Checks supported languages

      • decrypted.exe (PID: 6572)
      • decrypted.tmp (PID: 6596)
      • decrypted.exe (PID: 6660)
      • decrypted.tmp (PID: 6688)
      • electronics.exe (PID: 6772)
      • MSBuild.exe (PID: 5496)
      • electronics.exe (PID: 6352)

    • Create files in a temporary directory

      • decrypted.exe (PID: 6572)
      • decrypted.exe (PID: 6660)
      • decrypted.tmp (PID: 6688)

    • Process checks computer location settings

      • decrypted.tmp (PID: 6596)

    • Reads the computer name

      • decrypted.tmp (PID: 6596)
      • decrypted.tmp (PID: 6688)
      • electronics.exe (PID: 6772)

    • Creates files or folders in the user directory

      • decrypted.tmp (PID: 6688)

    • The sample compiled with english language support

      • decrypted.tmp (PID: 6688)
      • electronics.exe (PID: 6352)

    • Reads mouse settings

      • electronics.exe (PID: 6772)
      • electronics.exe (PID: 6352)

    • Reads the machine GUID from the registry

      • electronics.exe (PID: 6772)
      • MSBuild.exe (PID: 5496)

    • Reads CPU info

      • electronics.exe (PID: 6352)

    • Reads Windows Product ID

      • electronics.exe (PID: 6352)

    • Disables trace logs

      • MSBuild.exe (PID: 5496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 2.6.5.0
ProductVersionNumber: 2.6.5.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Strong Technology, LLC
FileDescription: StrongVPN
FileVersion: 2.6.5.0
LegalCopyright: Copyright (c) Strong Technology, LLC. All rights reserved.
OriginalFileName: StrongVPN.exe
ProductName: Dokan Library 1.4.1.1000 Bundle
ProductVersion: 2.6.5.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
34
Malicious processes
5
Suspicious processes
6

Behavior graph

Click at the process to see the details
start decrypted.exe decrypted.tmp decrypted.exe decrypted.tmp cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs electronics.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs electronics.exe msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
128tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
640"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"C:\Windows\System32\cmd.exe—decrypted.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
748"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"C:\Windows\System32\cmd.exe—decrypted.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1684find /I "avgui.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
3524find /I "avastui.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
3808find /I "opssvc.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
4500\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4824\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4876"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"C:\Windows\System32\cmd.exe—decrypted.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
5000tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
3 748
Read events
3 733
Write events
15
Delete events
0

Modification events

(PID) Process:(6352) electronics.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:fghfbbc
Value:
"C:\hcghfce\AutoIt3.exe" C:\hcghfce\fghfbbc.a3x
(PID) Process:(5496) MSBuild.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5496) MSBuild.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5496) MSBuild.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5496) MSBuild.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5496) MSBuild.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5496) MSBuild.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5496) MSBuild.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5496) MSBuild.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5496) MSBuild.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
21
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6660decrypted.exeC:\Users\admin\AppData\Local\Temp\is-B6CC7.tmp\decrypted.tmpexecutable
MD5:7C35C50516EBD185413079CC451B68F0
SHA256:FE0CBA282AFFC76E473F680E791251A8E107033C6FCF27B16DC7F2B37336D529
6596decrypted.tmpC:\Users\admin\AppData\Local\Temp\is-J7VRG.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6688decrypted.tmpC:\Users\admin\AppData\Local\Temp\is-CPGUT.tmp\NetLimiter.dllexecutable
MD5:129FE24FDC8E1BD620A5075DDE9BB0C6
SHA256:A270D34CF38DF7BB7B9D1EB7DF3BBFE20E7716C353EC4CCE4E37C399639CBF4D
6688decrypted.tmpC:\Users\admin\AppData\Local\Temp\is-CPGUT.tmp\is-V8KHT.tmpexecutable
MD5:129FE24FDC8E1BD620A5075DDE9BB0C6
SHA256:A270D34CF38DF7BB7B9D1EB7DF3BBFE20E7716C353EC4CCE4E37C399639CBF4D
6688decrypted.tmpC:\Users\admin\AppData\Local\Temp\is-CPGUT.tmp\Nager.Country.dllexecutable
MD5:F5ED02F2C70D431833D2C9005B7E72EE
SHA256:3A05B8DB929946580F20FE980CEDDFA867471FEB27F384AFC47B680391A70AF9
6688decrypted.tmpC:\Users\admin\AppData\Local\Temp\is-CPGUT.tmp\is-K8S39.tmpexecutable
MD5:0ADF6F32F4D14F9B0BE9AA94F7EFB279
SHA256:8BE4A2270F8B2BEA40F33F79869FDCCA34E07BB764E63B81DED49D90D2B720DD
6688decrypted.tmpC:\Users\admin\AppData\Local\Temp\is-CPGUT.tmp\is-OS8VD.tmpexecutable
MD5:4D6698D42C349CFEAC5A9FA564054B61
SHA256:B52831344AEA06E914A69E5018C94537645EC9D4FE61511ABFF6DA6335D01352
6688decrypted.tmpC:\Users\admin\AppData\Local\Temp\is-CPGUT.tmp\NetLimiter.Runtime.dllexecutable
MD5:4D6698D42C349CFEAC5A9FA564054B61
SHA256:B52831344AEA06E914A69E5018C94537645EC9D4FE61511ABFF6DA6335D01352
6688decrypted.tmpC:\Users\admin\AppData\Local\Temp\is-CPGUT.tmp\is-T2T27.tmpexecutable
MD5:00053FF3B5744853B9EBF90AF4FDD816
SHA256:C5A119EC89471194B505140FBA13001FA05F81C4B4725B80BB63CCB4E1408C1E
6688decrypted.tmpC:\Users\admin\AppData\Local\Temp\is-CPGUT.tmp\is-DPHLA.tmpexecutable
MD5:83EF97A69BA8CAC0A2A8107E316C67D0
SHA256:4CAB94B0B49E3E2E3A08371BBA361A2FC115DF09993EE7E90FED0652CB359566
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
14
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6536
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6996
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6996
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.16.110.121:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1076
svchost.exe
23.213.170.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
880
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6536
backgroundTaskHost.exe
20.223.36.55:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6536
backgroundTaskHost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.16.110.121
  • 2.16.110.123
  • 2.16.110.171
whitelisted
go.microsoft.com
  • 23.213.170.81
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.71
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.2
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
decrypted.exe