File name:

d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8

Full analysis: https://app.any.run/tasks/401074ab-8de6-48db-a230-fff5c0f18700
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: June 07, 2025, 15:09:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
cloak
chilelocker
ransomware
arcrypt
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

A99E3627AFB443440686FCB10491D954

SHA1:

FF14A3919C9E4BD0DD4E1B964017DE64A0298318

SHA256:

D00853E592BCCD823027E7E685D88C5A1F76A5A36EC5B7073D49EE633B050CC8

SSDEEP:

1536:ekL3GNIRFjOAgtPfIHHpu9JC8R9uk4BN+b3:eU3GORFQt3mv8+k43+b3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Disables the Shutdown in the Start menu

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • CLOAK has been found (auto)

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • CHILELOCKER mutex has been found

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • ChileLocker note has been found

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Disables the LogOff the Start menu

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Deletes shadow copies

      • cmd.exe (PID: 7680)

    • RANSOMWARE has been detected

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Reads security settings of Internet Explorer

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Changes the desktop background image

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Uses pipe srvsvc via SMB (transferring data)

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Mutex name with non-standard characters

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Uses NETSH.EXE to change the status of the firewall

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Creates file in the systems drive root

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • There is functionality for taking screenshot (YARA)

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

  • INFO

    • Reads the machine GUID from the registry

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Process checks computer location settings

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Checks supported languages

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Reads the computer name

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Launching a file from a Registry key

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Creates files in the program directory

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Creates files or folders in the user directory

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • UPX packer has been detected

      • d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe (PID: 7776)

    • Reads the software policy settings

      • slui.exe (PID: 1176)
      • slui.exe (PID: 5404)

    • Checks proxy server information

      • slui.exe (PID: 5404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:06 16:38:47+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.4
CodeSize: 69632
InitializedDataSize: 4096
UninitializedDataSize: 147456
EntryPoint: 0x35100
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
13
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #CHILELOCKER d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe cmd.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs sppextcomobj.exe no specs vssadmin.exe no specs slui.exe slui.exe ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1176"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2600vssadmin.exe delete shadows /all /quietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4620"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state offC:\Windows\SysWOW64\netsh.exe—d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5404C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6792"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7448C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7680"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quietC:\Windows\System32\cmd.exe—d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
7776"C:\Users\admin\AppData\Local\Temp\d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe" C:\Users\admin\AppData\Local\Temp\d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
1 998
Read events
1 981
Write events
17
Delete events
0

Modification events

(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoLogoff
Value:
1
(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoClose
Value:
1
(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:StartMenuLogOff
Value:
1
(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:DisableChangePassword
Value:
1
(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:DisableSwitchUser
Value:
1
(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:DisableTaskMgr
Value:
1
(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:HideFastUserSwitching
Value:
1
(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:NoLogoff
Value:
1
(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:NoClose
Value:
1
(PID) Process:(7776) d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:StartMenuLogOff
Value:
1
Executable files
0
Suspicious files
44
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe\Device\Mup:\127.0.0.1\PIPE\srvsvc —
MD5:—
SHA256:—
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_200_percent.pak.crYpt —
MD5:—
SHA256:—
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_extensions.pak.crYpt —
MD5:—
SHA256:—
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef.pak.crYpt —
MD5:—
SHA256:—
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_100_percent.pak.crYpt —
MD5:—
SHA256:—
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeC:\Users\admin\AppData\Local\VirtualStore\readme_for_unlock.txtbinary
MD5:A1F835D85681E21088AEFC8F9D031A1C
SHA256:4C96E8A99B6A79A2DE4C91D51D45577C4E4EE40E0133277F2728EE351DC2BA14
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\readme_for_unlock.txtbinary
MD5:A1F835D85681E21088AEFC8F9D031A1C
SHA256:4C96E8A99B6A79A2DE4C91D51D45577C4E4EE40E0133277F2728EE351DC2BA14
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeC:\ProgramData\wallpaper.bmpbinary
MD5:E52460C92B73A25A340D909EB388423F
SHA256:48C198E652B8ED6465AE8965152C28BF9BF03DD2F445F3C575095B9BCC822B99
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.crYptpdf
MD5:B515F7B33B9F8CB1CF59DC54253CD98A
SHA256:FCD81262F272ADD4C9A4AA82031140B8B7658CC5DD3B96209ED3A655A145E831
7776d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef.pak.crYpt —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
45
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1812
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1812
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.23:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.73:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7552
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7504
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 172.217.16.206
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted
self.events.data.microsoft.com
  • 20.189.173.25
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8