File name:

HFS-2.X通杀自动搜索版本.exe

Full analysis: https://app.any.run/tasks/6d3116f2-71ec-49f5-a1e3-7b1e9cd0ea0b
Verdict: Malicious activity
Analysis date: April 20, 2025, 21:50:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

1EA6A21EA2D6AA5803293FC389EA2296

SHA1:

9575A411B49B9C103E332ABB50647734CE9ED854

SHA256:

B6CA0A08B398951FDF0F3E9DFD850773168A14BE71C1A6185D4199E34B263C31

SSDEEP:

98304:1cdJZgYftJg1YWlJzsNq3ymTbOfggNRU5YgUFk3PkRpl49YjW/gZH/DmC2powOm1:Nx6mFBXZhK7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops python dynamic module

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)
      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)

    • Loads Python modules

      • HFS-2.X通杀自动搜索版本.exe (PID: 1272)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6788)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6608)

    • Application launched itself

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)
      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)

    • The process drops C-runtime libraries

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)
      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)

    • Executable content was dropped or overwritten

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)
      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)

    • Process drops legitimate windows executable

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)
      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)

    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 5332)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4152)

  • INFO

    • Checks supported languages

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)
      • HFS-2.X通杀自动搜索版本.exe (PID: 1272)
      • PLUGScheduler.exe (PID: 4152)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6788)
      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6608)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)

    • Reads the machine GUID from the registry

      • HFS-2.X通杀自动搜索版本.exe (PID: 1272)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6788)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6608)

    • Checks transactions between databases Windows and Oracle

      • rundll32.exe (PID: 1300)

    • The sample compiled with english language support

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)
      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)

    • Reads the computer name

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)
      • PLUGScheduler.exe (PID: 4152)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)
      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)

    • Create files in a temporary directory

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)
      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)

    • Reads the software policy settings

      • dllhost.exe (PID: 2344)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 2344)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 4152)

    • PyInstaller has been detected (YARA)

      • HFS-2.X通杀自动搜索版本.exe (PID: 6964)

    • Manual execution by a user

      • HFS-2.X通杀自动搜索版本.exe (PID: 5972)
      • HFS-2.X通杀自动搜索版本.exe (PID: 6624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (57.6)
.exe | Win64 Executable (generic) (36.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:02:05 10:42:54+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 176640
InitializedDataSize: 115712
UninitializedDataSize: -
EntryPoint: 0xc380
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
297
Monitored processes
17
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start hfs-2.x通杀自动搜索版本.exe conhost.exe no specs hfs-2.x通杀自动搜索版本.exe no specs sppextcomobj.exe no specs slui.exe no specs explorer.exe no specs COpenControlPanel no specs rundll32.exe no specs %systemroot%\system32\intl.cpl no specs chsime.exe no specs plugscheduler.exe no specs hfs-2.x通杀自动搜索版本.exe conhost.exe no specs hfs-2.x通杀自动搜索版本.exe no specs hfs-2.x通杀自动搜索版本.exe conhost.exe no specs hfs-2.x通杀自动搜索版本.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1052C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
1272"C:\Users\admin\Desktop\HFS-2.X通杀自动搜索版本.exe" C:\Users\admin\Desktop\HFS-2.X通杀自动搜索版本.exe—HFS-2.X通杀自动搜索版本.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hfs-2.x通杀自动搜索版本.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1300"C:\WINDOWS\System32\rundll32.exe" C:\WINDOWS\System32\shell32.dll,Control_RunDLL C:\WINDOWS\System32\intl.cplC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1852\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—HFS-2.X通杀自动搜索版本.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2344C:\WINDOWS\system32\DllHost.exe /Processid:{514B5E31-5596-422F-BE58-D804464683B5}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
4024C:\Windows\System32\InputMethod\CHS\ChsIME.exe -EmbeddingC:\Windows\System32\InputMethod\CHS\ChsIME.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft IME
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\inputmethod\chs\chsime.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4152"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4920"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5332C:\WINDOWS\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\twinapi.dll
c:\windows\system32\oleaut32.dll
5972"C:\Users\admin\Desktop\HFS-2.X通杀自动搜索版本.exe" C:\Users\admin\Desktop\HFS-2.X通杀自动搜索版本.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\hfs-2.x通杀自动搜索版本.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
12 219
Read events
10 992
Write events
1 124
Delete events
103

Modification events

(PID) Process:(5332) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(5332) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
0000000004000000030000000E000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(5332) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar
Operation:writeName:Locked
Value:
1
(PID) Process:(2344) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink
Operation:writeName:FontLinkControl
Value:
0
(PID) Process:(2344) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink
Operation:writeName:FontLinkDefaultChar
Value:
12539
(PID) Process:(2344) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
Operation:delete valueName:Lucida Sans Unicode
Value:
MSGOTHIC.TTC,MS UI Gothic
(PID) Process:(2344) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
Operation:writeName:Lucida Sans Unicode
Value:
MSGOTHIC.TTC,MS UI Gothic
(PID) Process:(2344) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
Operation:delete valueName:Microsoft Sans Serif
Value:
MSGOTHIC.TTC,MS UI Gothic
(PID) Process:(2344) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
Operation:writeName:Microsoft Sans Serif
Value:
MSGOTHIC.TTC,MS UI Gothic
(PID) Process:(2344) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
Operation:delete valueName:Tahoma
Value:
MSGOTHIC.TTC,MS UI Gothic
Executable files
36
Suspicious files
47
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\_hashlib.pydexecutable
MD5:5FA7C9D5E6068718C6010BBEB18FBEB3
SHA256:2E98F91087F56DFDFFBBDD951CD55CD7EA771CEC93D59CADB86B964ED8708155
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\VCRUNTIME140.dllexecutable
MD5:18571D6663B7D9AC95F2821C203E471F
SHA256:0B040A314C19FF88F38FD9C89DCA2D493113A6109ADB8525733C3F6627DA888F
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\_lzma.pydexecutable
MD5:60E215BB78FB9A40352980F4DE818814
SHA256:C4D00582DEE45841747B07B91A3E46E55AF79E6518EC9F0CE59B989C0ACD2806
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\_queue.pydexecutable
MD5:1FC2C6B80936EFC502BFC30FC24CAA56
SHA256:9C47A3B84012837C60B7FECED86ED0A4F12910A85FD259A4483A48CD940E3514
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\_socket.pydexecutable
MD5:1D53841BB21ACDCC8742828C3ADED891
SHA256:AB13258C6DA2C26C4DCA7239FF4360CA9166EA8F53BB8CC08D2C7476CAB7D61B
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\_ssl.pydexecutable
MD5:84DEA8D0ACCE4A707B094A3627B62EAB
SHA256:DCF6B3FF84B55C3859D0F176C4CE6904C0D7D4643A657B817C6322933DBF82F6
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\base_library.zipcompressed
MD5:BCC06D24C2C806A06E861D9020E65B30
SHA256:A0FCCBE44E5B9D3AABD6E955C2ECB5FF52492C469EBED61EA3CAD5EC5642AA5D
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\certifi\cacert.pemtext
MD5:EA4EE2AF66C4C57B8A275867E9DC07CD
SHA256:FA883829EBB8CD2A602F9B21C1F85DE24CF47949D520BCEB1828B4CD1CB6906C
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\libcrypto-1_1.dllexecutable
MD5:CC4CBF715966CDCAD95A1E6C95592B3D
SHA256:594303E2CE6A4A02439054C84592791BF4AB0B7C12E9BBDB4B040E27251521F1
6964HFS-2.X通杀自动搜索版本.exeC:\Users\admin\AppData\Local\Temp\_MEI69642\python38.dllexecutable
MD5:1F2688B97F9827F1DE7DFEDB4AD2348C
SHA256:169EEB1BDF99ED93CA26453D5CA49339E5AE092662CD94CDE09FBB10046F83FC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
77
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5984
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1452
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5984
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5964
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1628
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2924
SearchApp.exe
104.126.37.144:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.74.206
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.18.121.147
  • 2.18.121.139
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.52.120.96
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.69
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.128
  • 20.190.159.23
  • 20.190.159.68
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
www.bing.com
  • 104.126.37.144
  • 104.126.37.153
  • 104.126.37.160
  • 104.126.37.146
  • 104.126.37.147
  • 104.126.37.171
  • 104.126.37.161
  • 104.126.37.154
  • 104.126.37.170
  • 2.16.106.196
  • 2.16.106.200
  • 104.126.37.128
  • 104.126.37.131
  • 104.126.37.145
  • 104.126.37.139
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
th.bing.com
  • 92.123.104.34
  • 92.123.104.38
  • 92.123.104.32
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HFS-2.X通杀自动搜索版本.exe