File name:

expressvpn-windows-x64-12.201.0.12153_release.exe

Full analysis: https://app.any.run/tasks/0d0066d0-4d67-4420-acc3-8e6b05536ce8
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 07, 2026, 09:01:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
evasion
ip-check
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

C58E271C1BDF7271D3CC432CC26F5A6D

SHA1:

04F3BCDBBF8E575CCBABE3509B9A874206261741

SHA256:

CE721F5B1EA67B25D3538D36FDFFECE18731F534084D1241B2829DB1B73AC3CE

SSDEEP:

393216:pr8QwiUpvTlFUl+TiiUFMMpVvKI4+Vr0PW4qnf:qiUpbtiiUF1vKI4+Vr0eZf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)
      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 5308)
      • expressvpn-service.exe (PID: 7288)
      • expressvpn-client.exe (PID: 7208)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)
      • netcfg.exe (PID: 1176)
      • tapinstall.exe (PID: 5148)

    • Process drops legitimate windows executable

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)

    • Drops a system driver (possible attempt to evade defenses)

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)
      • drvinst.exe (PID: 4036)
      • netcfg.exe (PID: 1176)
      • tapinstall.exe (PID: 5148)
      • drvinst.exe (PID: 6324)

    • The process drops C-runtime libraries

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)

    • Creates files in the driver directory

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)

    • Starts SC.EXE for service management

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)

    • Windows service management via SC.EXE

      • sc.exe (PID: 2844)

    • Executes as Windows Service

      • expressvpn-service.exe (PID: 7288)

    • Checks for external IP

      • expressvpn-service.exe (PID: 7288)
      • svchost.exe (PID: 2292)

    • Possible stealing of VPN data

      • expressvpn-client.exe (PID: 7208)

    • There is functionality for capture public ip (YARA)

      • expressvpn-service.exe (PID: 7288)

  • INFO

    • Reads the computer name

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)
      • drvinst.exe (PID: 4036)
      • tapinstall.exe (PID: 5148)
      • drvinst.exe (PID: 6324)
      • drvinst.exe (PID: 1524)
      • expressvpn-service.exe (PID: 7288)
      • expressvpn-client.exe (PID: 7208)

    • Checks supported languages

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)
      • drvinst.exe (PID: 4036)
      • tapinstall.exe (PID: 2608)
      • tapinstall.exe (PID: 5148)
      • drvinst.exe (PID: 6324)
      • drvinst.exe (PID: 1524)
      • expressvpn-service.exe (PID: 7288)
      • expressvpn-client.exe (PID: 7208)

    • Creates files in the program directory

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)
      • expressvpn-service.exe (PID: 7288)

    • The sample compiled with english language support

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)
      • tapinstall.exe (PID: 5148)
      • drvinst.exe (PID: 6324)

    • There is functionality for taking screenshot (YARA)

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)
      • expressvpn-client.exe (PID: 7208)

    • Drops script file

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)

    • Create files in a temporary directory

      • netcfg.exe (PID: 1176)
      • tapinstall.exe (PID: 5148)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 4036)
      • tapinstall.exe (PID: 5148)
      • drvinst.exe (PID: 6324)
      • expressvpn-service.exe (PID: 7288)
      • expressvpn-client.exe (PID: 7208)

    • Creates files in the driver directory

      • netcfg.exe (PID: 1176)

    • Reads security settings of Internet Explorer

      • tapinstall.exe (PID: 5148)
      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)

    • Reads the time zone

      • expressvpn-service.exe (PID: 7288)

    • Creates a software uninstall entry

      • expressvpn-windows-x64-12.201.0.12153_release.exe (PID: 7488)

    • Creates files or folders in the user directory

      • expressvpn-client.exe (PID: 7208)

    • Application based on Rust

      • expressvpn-service.exe (PID: 7288)

    • Process checks computer location settings

      • expressvpn-service.exe (PID: 7288)

    • Checks proxy server information

      • slui.exe (PID: 1672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:01:27 11:30:12+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.44
CodeSize: 350720
InitializedDataSize: 41861632
UninitializedDataSize: -
EntryPoint: 0x31fd0
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
19
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start expressvpn-windows-x64-12.201.0.12153_release.exe netcfg.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs netcfg.exe conhost.exe no specs drvinst.exe no specs tapinstall.exe no specs conhost.exe no specs tapinstall.exe conhost.exe no specs drvinst.exe no specs drvinst.exe no specs expressvpn-service.exe expressvpn-client.exe no specs svchost.exe slui.exe expressvpn-windows-x64-12.201.0.12153_release.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1176C:\WINDOWS\System32\netcfg.exe -v -l "C:\Program Files\ExpressVPN\pkf\expressvpn-pkf.inf" -c s -i expressvpn-pkfC:\Windows\System32\netcfg.exe
expressvpn-windows-x64-12.201.0.12153_release.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WinPE network installer
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netcfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1524DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\WINDOWS\INF\oem10.inf" "oem10.inf:f4d036df732de81c:expressvpn-ovpn-dco_Device:1.4.0.0:expressvpn-ovpn-dco," "46e91010b" "00000000000001F4"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1672C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2608"C:\Program Files\ExpressVPN\tapinstall.exe" remove expressvpn-ovpn-dcoC:\Program Files\ExpressVPN\tapinstall.exe—expressvpn-windows-x64-12.201.0.12153_release.exe
User:
admin
Company:
Windows (R) Win 7 DDK provider
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.10011.16384
Modules
Images
c:\program files\expressvpn\tapinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2844C:\WINDOWS\System32\sc.exe delete expressvpn-pkfC:\Windows\System32\sc.exe—expressvpn-windows-x64-12.201.0.12153_release.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3584\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tapinstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4036DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{1ea41b6c-0388-e44a-954b-c914ba7e3636}\expressvpn-pkf.inf" "9" "431161757" "00000000000001D4" "WinSta0\Default" "00000000000001EC" "208" "C:\Program Files\ExpressVPN\pkf"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
5148"C:\Program Files\ExpressVPN\tapinstall.exe" install "C:\Program Files\ExpressVPN\dco\win10\expressvpn-ovpn-dco.inf" expressvpn-ovpn-dcoC:\Program Files\ExpressVPN\tapinstall.exe
expressvpn-windows-x64-12.201.0.12153_release.exe
User:
admin
Company:
Windows (R) Win 7 DDK provider
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.10011.16384
Modules
Images
c:\program files\expressvpn\tapinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
27 024
Read events
26 970
Write events
47
Delete events
7

Modification events

(PID) Process:(7488) expressvpn-windows-x64-12.201.0.12153_release.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\expressvpn
Operation:writeName:URL Protocol
Value:
(PID) Process:(1176) netcfg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
Operation:writeName:setupapi.dev.log
Value:
4096
(PID) Process:(1176) netcfg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\TemporaryInstallStage|6300|expressvpn-pkf|{8275E232-26AA-4657-BE2C-BB6236E637F3}\Ndi
Operation:writeName:Service
Value:
expressvpn-pkf
(PID) Process:(1176) netcfg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\TemporaryInstallStage|6300|expressvpn-pkf|{8275E232-26AA-4657-BE2C-BB6236E637F3}\Ndi
Operation:writeName:CoServices
Value:
expressvpn-pkf
(PID) Process:(1176) netcfg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\TemporaryInstallStage|6300|expressvpn-pkf|{8275E232-26AA-4657-BE2C-BB6236E637F3}\Ndi
Operation:writeName:HelpText
Value:
ExpressVPN Packet Filter
(PID) Process:(1176) netcfg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\TemporaryInstallStage|6300|expressvpn-pkf|{8275E232-26AA-4657-BE2C-BB6236E637F3}\Ndi
Operation:writeName:FilterClass
Value:
compression
(PID) Process:(1176) netcfg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\TemporaryInstallStage|6300|expressvpn-pkf|{8275E232-26AA-4657-BE2C-BB6236E637F3}\Ndi
Operation:writeName:FilterType
Value:
2
(PID) Process:(1176) netcfg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\TemporaryInstallStage|6300|expressvpn-pkf|{8275E232-26AA-4657-BE2C-BB6236E637F3}\Ndi\Interfaces
Operation:writeName:UpperRange
Value:
noupper
(PID) Process:(1176) netcfg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\TemporaryInstallStage|6300|expressvpn-pkf|{8275E232-26AA-4657-BE2C-BB6236E637F3}\Ndi\Interfaces
Operation:writeName:LowerRange
Value:
ndis5,ndis4
(PID) Process:(1176) netcfg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network\TemporaryInstallStage|6300|expressvpn-pkf|{8275E232-26AA-4657-BE2C-BB6236E637F3}\Ndi\Interfaces
Operation:writeName:FilterMediaTypes
Value:
ethernet, wan, ppip, bluetooth, ndis5, nolower
Executable files
211
Suspicious files
495
Text files
559
Unknown types
0

Dropped files

PID
Process
Filename
Type
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\brand.txttext
MD5:70EC61806218C2A865B9F8C90E4FC9F7
SHA256:AE86A1A2DED38947D89B86C42B2722F9CEA0AB0ACD463B3A870894115C296930
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\dco\win10\expressvpn-ovpn-dco.inftext
MD5:BBA08314602A5721EC6781B5F4231CF8
SHA256:62EABAD0E03319F313A86237C53BFBDCC580CFD9BFBC6B7DA4BF7F01F1CF19F1
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\browser_helper_wrapper.shtext
MD5:FE46C7C1F3360AC7B62BD935FD0837DB
SHA256:203F9063120EB8BA959EB9077FF8C8200CF5ECC56F4B19F9387EB326D2980C6A
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\firefox.com.expressvpn.helper.jsontext
MD5:DF8CEF13332ECE3C6A82DA79EF8CE70C
SHA256:2482C9CE3485998A34E52405F2532A5BF705E004821CA8EC3BB3FCB717AED72A
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\dco\win11\expressvpn-ovpn-dco.inftext
MD5:BBA08314602A5721EC6781B5F4231CF8
SHA256:62EABAD0E03319F313A86237C53BFBDCC580CFD9BFBC6B7DA4BF7F01F1CF19F1
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\LICENSE.txttext
MD5:0FBF3D8298E4D1E8D066E92AC854611A
SHA256:ADF9E7568BEB482832EFE9AB9BA0F2B279B67063831F8C051809D65F31F2484F
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\ndisapi.expbinary
MD5:23702EC17E026B7618F428FEFFEE1E74
SHA256:CFD6C3669558D41712ACFBC9D1B5AE531566667465F46C99CB86B19F96B24D01
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\architecture.txttext
MD5:0027F42E1E5DFCB4FD5F8F9C6DB89AF3
SHA256:7520B5A1B312EFDE4FD7E2793EF4BC0CF8F1C235F778D203AB7216A0E31B3880
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\chrome.com.expressvpn.helper.jsontext
MD5:B0D9BDDF0C1AA892C0188AA5089C4E7C
SHA256:D48895D1C03E5CD6E50BCC0119EC76F7DCD210CD2AEEB7F6B40343E53B39BC62
7488expressvpn-windows-x64-12.201.0.12153_release.exeC:\Program Files\ExpressVPN\qml\Qt5Compat\GraphicalEffects\BrightnessContrast.qmltext
MD5:9B41E31F1BB236ED137D610E6CBD7BCE
SHA256:CB3A577549F0E66BE514A3AE34DF03336CA8DABB180FC087B3B04F46B5049B0F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
70
DNS requests
26
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8228
SIHClient.exe
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.32.74:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
unknown
—
—
POST
200
40.126.32.74:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
unknown
—
—
POST
200
20.190.160.67:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
unknown
356
svchost.exe
POST
200
20.190.160.17:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
2.16.241.205:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3412
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
356
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
self.events.data.microsoft.com
  • 13.89.179.8
  • 13.89.179.14
whitelisted
www.bing.com
  • 2.16.241.205
  • 2.16.241.206
  • 2.16.241.207
  • 2.16.241.222
  • 2.16.241.204
  • 2.16.241.218
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
google.com
  • 142.250.187.238
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 23.216.77.42
  • 2.16.168.124
  • 2.16.168.114
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.14
  • 20.190.160.5
  • 20.190.160.2
  • 40.126.32.140
  • 20.190.160.67
  • 40.126.32.68
  • 20.190.160.4
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
clientstream.launchdarkly.com
  • 3.33.235.18
  • 15.197.213.252
  • 13.248.151.210
  • 76.223.31.44
whitelisted

Threats

PID
Process
Class
Message
2292
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (checkip .amazonaws .com)
7288
expressvpn-service.exe
Device Retrieving External IP Address Detected
ET INFO Observed External IP Lookup Domain (checkip .amazonaws .com) in TLS SNI
—
—
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
—
—
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7288
expressvpn-service.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7288
expressvpn-service.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
—
—
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
7288
expressvpn-service.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
expressvpn-windows-x64-12.201.0.12153_release.exe