File name:

final_joiner.js

Full analysis: https://app.any.run/tasks/f12ddfef-8bb5-4824-8fad-a26ef8629622
Verdict: Malicious activity
Analysis date: June 21, 2025, 13:01:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
screenconnect
rmm-tool
remote
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with CRLF line terminators
MD5:

C8A17CF22CFCB4D639447143C7058B7F

SHA1:

469F068804E62B1A0B4E147CAC4D7AECF70F4DB6

SHA256:

BCB97CF5312F953650A63DCB45319FDE1B287BFEA7026FB0379095DD894C82BB

SSDEEP:

3072:fcnqxrHKQeu3VmxWSs3O9zSu8h3hU0JTOOjBn02BMy11P+vgrIUjRBzXZsU1X1jT:bjfhp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 5616)

    • Gets TEMP folder path (SCRIPT)

      • wscript.exe (PID: 5616)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 5616)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 5616)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 5616)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 5616)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7060)

    • Changes powershell execution policy (Bypass)

      • mshta.exe (PID: 3092)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7060)

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 5348)

  • SUSPICIOUS

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 5616)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 5616)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5616)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 5616)

    • Starts process via Powershell

      • powershell.exe (PID: 7060)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 3092)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7060)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7060)
      • rundll32.exe (PID: 432)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 7060)

    • Reads security settings of Internet Explorer

      • ZoomMeetingsInstall-6.4.12-85070.exe (PID: 2532)
      • ScreenConnect.WindowsClient.exe (PID: 4216)
      • ScreenConnect.WindowsClient.exe (PID: 6124)
      • ScreenConnect.ClientService.exe (PID: 5348)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7120)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 7120)

    • Executes as Windows Service

      • ScreenConnect.ClientService.exe (PID: 5348)
      • VSSVC.exe (PID: 1984)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 7120)

    • Screenconnect has been detected

      • msiexec.exe (PID: 7120)
      • ScreenConnect.ClientService.exe (PID: 5348)
      • ScreenConnect.ClientService.exe (PID: 5348)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 5348)

    • Connects to unusual port

      • ScreenConnect.ClientService.exe (PID: 5348)

    • Potential Corporate Privacy Violation

      • ScreenConnect.ClientService.exe (PID: 5348)

    • SCREENCONNECT mutex has been found

      • ScreenConnect.ClientService.exe (PID: 5348)

  • INFO

    • Checks proxy server information

      • wscript.exe (PID: 5616)
      • powershell.exe (PID: 7060)
      • slui.exe (PID: 1028)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 3092)

    • Disables trace logs

      • powershell.exe (PID: 7060)

    • The executable file from the user directory is run by the Powershell process

      • ZoomMeetingsInstall-6.4.12-85070.exe (PID: 2532)
      • ZoomMeetingsInstall-6.4.12-85070.exe (PID: 6224)

    • Checks supported languages

      • ZoomMeetingsInstall-6.4.12-85070.exe (PID: 2532)
      • msiexec.exe (PID: 7120)
      • msiexec.exe (PID: 1100)
      • msiexec.exe (PID: 2464)
      • msiexec.exe (PID: 2716)
      • ScreenConnect.ClientService.exe (PID: 5348)
      • ScreenConnect.WindowsClient.exe (PID: 4216)
      • ScreenConnect.WindowsClient.exe (PID: 6124)

    • Reads the machine GUID from the registry

      • ZoomMeetingsInstall-6.4.12-85070.exe (PID: 2532)
      • ScreenConnect.WindowsClient.exe (PID: 4216)
      • ScreenConnect.ClientService.exe (PID: 5348)
      • ScreenConnect.WindowsClient.exe (PID: 6124)

    • Reads the computer name

      • ZoomMeetingsInstall-6.4.12-85070.exe (PID: 2532)
      • msiexec.exe (PID: 7120)
      • msiexec.exe (PID: 1100)
      • msiexec.exe (PID: 2464)
      • msiexec.exe (PID: 2716)
      • ScreenConnect.ClientService.exe (PID: 5348)
      • ScreenConnect.WindowsClient.exe (PID: 4216)
      • ScreenConnect.WindowsClient.exe (PID: 6124)

    • Create files in a temporary directory

      • ZoomMeetingsInstall-6.4.12-85070.exe (PID: 2532)
      • rundll32.exe (PID: 432)

    • Process checks computer location settings

      • ZoomMeetingsInstall-6.4.12-85070.exe (PID: 2532)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6220)
      • msiexec.exe (PID: 7120)

    • SCREENCONNECT has been detected

      • msiexec.exe (PID: 7120)
      • ScreenConnect.ClientService.exe (PID: 5348)

    • CONNECTWISE has been detected

      • msiexec.exe (PID: 7120)
      • ScreenConnect.ClientService.exe (PID: 5348)
      • msiexec.exe (PID: 6220)
      • ScreenConnect.WindowsClient.exe (PID: 4216)
      • ScreenConnect.WindowsClient.exe (PID: 6124)

    • Manages system restore points

      • SrTasks.exe (PID: 3628)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7120)

    • Reads the software policy settings

      • slui.exe (PID: 1028)

    • Reads CPU info

      • ScreenConnect.WindowsClient.exe (PID: 6124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
19
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start wscript.exe mshta.exe no specs powershell.exe conhost.exe no specs zoommeetingsinstall-6.4.12-85070.exe no specs zoommeetingsinstall-6.4.12-85070.exe msiexec.exe msiexec.exe msiexec.exe no specs rundll32.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs screenconnect.windowsclient.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
432rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSIA028.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1548390 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1028C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1100C:\Windows\syswow64\MsiExec.exe -Embedding 83498F4482360D6EF37DF281C8DFB6D3 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1984C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2464C:\Windows\syswow64\MsiExec.exe -Embedding 8FCE1E36967EF9E947E034B9AEC5627DC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2532"C:\Users\admin\AppData\Local\Temp\ZoomMeetingsInstall-6.4.12-85070.exe" C:\Users\admin\AppData\Local\Temp\ZoomMeetingsInstall-6.4.12-85070.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\zoommeetingsinstall-6.4.12-85070.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2716C:\Windows\syswow64\MsiExec.exe -Embedding D7FD4DBD971CA9D920B259F1CEB5BE24 E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3092"C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\ZoomMeetingsInstall-6.4.12-62868.hta"C:\Windows\System32\mshta.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
3628C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
13 382
Read events
13 086
Write events
278
Delete events
18

Modification events

(PID) Process:(5616) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5616) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5616) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5616) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
7A59170000000000
(PID) Process:(7120) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000F956779FACE2DB01D01B0000881B0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7120) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000F956779FACE2DB01D01B0000881B0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7120) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000F956779FACE2DB01D01B0000881B0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7120) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000D1F8559FACE2DB01D01B0000881B0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7120) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000D1F8559FACE2DB01D01B0000881B0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7120) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000007CBA799FACE2DB01D01B0000881B0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
21
Suspicious files
29
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
2532ZoomMeetingsInstall-6.4.12-85070.exeC:\Users\admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\5b4d3b0913e89c0a\ScreenConnect.ClientSetup.msi —
MD5:—
SHA256:—
5616wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
5616wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:F8E093538BF8DEC502F5349E59661953
SHA256:C19651E684FEBC1C2A71A721992FBAB060D6743694214B606657C47E16E74BE0
5616wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:2C3E4D9524FF531CEC05076BDBA06A05
SHA256:2E14320C967BD69B133B9B393E5E4EBDFF0124B0F28FF172D40F3946BAD83852
5616wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\build[1].jshtml
MD5:0B9277766718641B99FAA62F74811E67
SHA256:961456716A465117FABD01B24BDD4B7FB90E0444FA2996E061B14C0B59F3E905
5616wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
7060powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0drfc2i2.fua.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7060powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:428749CA3145C0CFF399339B8DC9EEFE
SHA256:9EA595F8633D205DA505FD7D2D4CDA899793341F595F174A5E8D79EDAB4045B1
7120msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7120msiexec.exeC:\Windows\Installer\17cc39.msi —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
40
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5616
wscript.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
1200
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5616
wscript.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.25.50.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2804
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2804
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
472
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5616
wscript.exe
172.67.210.137:443
pneuservisjirkalovi.com
CLOUDFLARENET
US
unknown
5616
wscript.exe
142.250.184.227:80
c.pki.goog
GOOGLE
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7060
powershell.exe
172.67.210.137:443
pneuservisjirkalovi.com
CLOUDFLARENET
US
unknown
2336
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1200
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
pneuservisjirkalovi.com
  • 172.67.210.137
  • 104.21.61.130
unknown
c.pki.goog
  • 142.250.184.227
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.71
  • 20.190.159.0
  • 40.126.31.3
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.128
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
crl.microsoft.com
  • 184.25.50.10
  • 184.25.50.8
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

PID
Process
Class
Message
5348
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
final_joiner.js