File name:

splice.exe

Full analysis: https://app.any.run/tasks/6fd09167-0486-4646-a9d7-a31a7209e32b
Verdict: Malicious activity
Analysis date: October 12, 2025, 06:15:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

6C1FE96D0A762EBC5E02903EFE056081

SHA1:

49932672DC454ABD0DA51CBB71C7DC95383EB69F

SHA256:

D02A673371B0857E28D3FCB565150F5002D065C705CCB25F722B644EE9944D0D

SSDEEP:

24576:XPCS9O47aXMF00Ng9TIEJLTUOwuCjki/i/r3d:qS9OgaXMF00q9TIEJLTUOwuCjki/iD3d

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • splice.exe (PID: 8440)

    • Changes the autorun value in the registry

      • Splice.exe (PID: 8944)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • splice.exe (PID: 8440)
      • updatecheck.exe (PID: 8676)

    • Reads the date of Windows installation

      • splice.exe (PID: 8440)
      • updatecheck.exe (PID: 8676)

    • Reads the Internet Settings

      • updatecheck.exe (PID: 8676)

    • Reads settings of System Certificates

      • updatecheck.exe (PID: 8676)
      • Splice.exe (PID: 8944)

    • Application launched itself

      • Splice.exe (PID: 8944)

  • INFO

    • Checks supported languages

      • splice.exe (PID: 8440)
      • updatecheck.exe (PID: 8676)
      • desktop-helper.exe (PID: 2652)
      • Splice.exe (PID: 8944)
      • Splice.exe (PID: 2724)
      • Splice.exe (PID: 5180)
      • Splice.Cert.Tool.exe (PID: 4180)
      • Splice.Cert.Tool.exe (PID: 7876)
      • Splice.exe (PID: 8928)
      • Splice.Cert.Tool.exe (PID: 2456)
      • Splice.Cert.Tool.exe (PID: 1032)
      • Splice.Cert.Tool.exe (PID: 8784)
      • Splice.Cert.Tool.exe (PID: 7688)
      • Splice.Helper.exe (PID: 2884)
      • Splice.Cert.Tool.exe (PID: 3196)
      • Splice.Cert.Tool.exe (PID: 4640)
      • Splice.Cert.Tool.exe (PID: 8676)
      • Splice.Cert.Tool.exe (PID: 7668)
      • Splice.Cert.Tool.exe (PID: 2008)
      • Splice.Cert.Tool.exe (PID: 4640)
      • Splice.Cert.Tool.exe (PID: 3196)
      • Splice.Cert.Tool.exe (PID: 7196)
      • Splice.Cert.Tool.exe (PID: 7668)
      • Splice.Cert.Tool.exe (PID: 7032)
      • Splice.Cert.Tool.exe (PID: 7876)
      • Splice.Cert.Tool.exe (PID: 4640)
      • Splice.Cert.Tool.exe (PID: 5212)
      • Splice.Cert.Tool.exe (PID: 7436)
      • Splice.Cert.Tool.exe (PID: 4308)
      • Splice.exe (PID: 7716)
      • Splice.Cert.Tool.exe (PID: 5648)
      • Splice.Cert.Tool.exe (PID: 7876)
      • Splice.Cert.Tool.exe (PID: 3060)
      • Splice.Cert.Tool.exe (PID: 8884)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7956)
      • BackgroundTransferHost.exe (PID: 2876)
      • BackgroundTransferHost.exe (PID: 4076)
      • BackgroundTransferHost.exe (PID: 9140)
      • BackgroundTransferHost.exe (PID: 7608)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 9140)
      • updatecheck.exe (PID: 8676)
      • Splice.exe (PID: 8944)
      • Splice.exe (PID: 2724)
      • Splice.Cert.Tool.exe (PID: 4180)
      • Splice.Helper.exe (PID: 2884)

    • Reads the computer name

      • splice.exe (PID: 8440)
      • updatecheck.exe (PID: 8676)
      • Splice.exe (PID: 8944)
      • Splice.exe (PID: 2724)
      • Splice.exe (PID: 5180)
      • Splice.Helper.exe (PID: 2884)

    • Process checks computer location settings

      • splice.exe (PID: 8440)
      • updatecheck.exe (PID: 8676)
      • Splice.exe (PID: 8944)
      • Splice.exe (PID: 8928)
      • Splice.exe (PID: 7716)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 9140)
      • updatecheck.exe (PID: 8676)
      • slui.exe (PID: 8852)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 9140)
      • updatecheck.exe (PID: 8676)
      • slui.exe (PID: 8852)

    • Manual execution by a user

      • updatecheck.exe (PID: 8676)

    • Create files in a temporary directory

      • Splice.exe (PID: 8944)

    • Reads product name

      • Splice.exe (PID: 8944)

    • Reads Environment values

      • Splice.exe (PID: 8944)

    • Reads the machine GUID from the registry

      • updatecheck.exe (PID: 8676)
      • Splice.exe (PID: 8944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:09:09 17:28:02+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 388608
InitializedDataSize: 270848
UninitializedDataSize: -
EntryPoint: 0x2ecfc
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
246
Monitored processes
70
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start splice.exe Delivery Optimization User no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs updatecheck.exe splice.exe splice.exe no specs desktop-helper.exe no specs splice.exe conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.helper.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.cert.tool.exe no specs conhost.exe no specs splice.exe no specs splice.cert.tool.exe no specs conhost.exe no specs slui.exe ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1032"C:\Program Files\WindowsApps\Splice_5.3.11.0_x64__xpwcknj9p1bc6\Splice.Cert.Tool.exe" -out-path C:\Users\admin\AppData\Local\SpliceSettings\.certsC:\Program Files\WindowsApps\Splice_5.3.11.0_x64__xpwcknj9p1bc6\Splice.Cert.Tool.exe—Splice.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\windowsapps\splice_5.3.11.0_x64__xpwcknj9p1bc6\splice.cert.tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\powrprof.dll
1620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Splice.Cert.Tool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2008"C:\Program Files\WindowsApps\Splice_5.3.11.0_x64__xpwcknj9p1bc6\Splice.Cert.Tool.exe" -out-path C:\Users\admin\AppData\Local\SpliceSettings\.certsC:\Program Files\WindowsApps\Splice_5.3.11.0_x64__xpwcknj9p1bc6\Splice.Cert.Tool.exe—Splice.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\windowsapps\splice_5.3.11.0_x64__xpwcknj9p1bc6\splice.cert.tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\powrprof.dll
2156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Splice.Cert.Tool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Splice.Cert.Tool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Splice.Cert.Tool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2276\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Splice.Helper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2456"C:\Program Files\WindowsApps\Splice_5.3.11.0_x64__xpwcknj9p1bc6\Splice.Cert.Tool.exe" -out-path C:\Users\admin\AppData\Local\SpliceSettings\.certs -forceC:\Program Files\WindowsApps\Splice_5.3.11.0_x64__xpwcknj9p1bc6\Splice.Cert.Tool.exe—Splice.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\windowsapps\splice_5.3.11.0_x64__xpwcknj9p1bc6\splice.cert.tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\powrprof.dll
2488"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2652"C:\Program Files\WindowsApps\Splice_5.3.11.0_x64__xpwcknj9p1bc6\desktop-helper.exe" machine-idC:\Program Files\WindowsApps\Splice_5.3.11.0_x64__xpwcknj9p1bc6\desktop-helper.exe—Splice.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\windowsapps\splice_5.3.11.0_x64__xpwcknj9p1bc6\desktop-helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\psapi.dll
Total events
16 385
Read events
16 336
Write events
30
Delete events
19

Modification events

(PID) Process:(7956) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7956) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7956) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(9140) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(9140) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(9140) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4076) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4076) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4076) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2876) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
1
Suspicious files
67
Text files
18
Unknown types
1

Dropped files

PID
Process
Filename
Type
9140BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\23ef5893-b426-4906-9161-b492a14e8aed.down_data —
MD5:—
SHA256:—
8944Splice.exeC:\Users\admin\AppData\Local\Temp\a8fe48d7-ded9-4db2-9a86-e4c3ab05453e.tmp.ico —
MD5:—
SHA256:—
8944Splice.exeC:\Users\admin\AppData\Local\SpliceSettings\Local Storage\leveldb\MANIFEST-000001binary
MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
SHA256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
9140BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:36DC773B19F43BC75199172CC564357A
SHA256:8C100C8BF60B8E8FF6749F3A20E47C283FA4695229933ADD7C536696D5CD4B6D
8944Splice.exeC:\Users\admin\AppData\Local\SpliceSettings\Local Storage\leveldb\000001.dbtmptext
MD5:46295CAC801E5D4857D09837238A6394
SHA256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
9140BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:EFE37857C68D3D72F10B6AB72BA32DBA
SHA256:FD04C4835D16F355440568E2192F049C3BB28E2D15840B13781110FE6712C2C1
9140BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1c190012-5943-4fc2-993e-f2b71c1e51db.up_meta_securebinary
MD5:166C622BB09FF64AB970CFD8E48ECB6B
SHA256:5B12AAF52BC89C94D50774D6B6A81FE04A8DBEF2735BFB7A8C25448A633BF532
9140BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1c190012-5943-4fc2-993e-f2b71c1e51db.e314b6fc-04c9-44cb-bc64-5aa6e38244e1.down_metabinary
MD5:6B90E6B12BC2E1D02535DC79F86C422C
SHA256:E9F549FE7251781745D7B45FC66C542D51632CA51C2B9283EB6A25A85D8135CD
9140BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\23ef5893-b426-4906-9161-b492a14e8aed.e314b6fc-04c9-44cb-bc64-5aa6e38244e1.down_metabinary
MD5:6B90E6B12BC2E1D02535DC79F86C422C
SHA256:E9F549FE7251781745D7B45FC66C542D51632CA51C2B9283EB6A25A85D8135CD
8676updatecheck.exeC:\Users\admin\AppData\Local\Packages\Splice_xpwcknj9p1bc6\AC\INetCache\H51S5TRR\metadata[1].propertiestext
MD5:3F1A62F51DC8CE3E0E4DDD06C7BDFAFF
SHA256:A0245F92D2436EF79D91FB68C77460E429FDE481FE4BC0BC2C30E8F76ECF1C6C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
73
DNS requests
40
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7568
svchost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
8544
backgroundTaskHost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
8504
backgroundTaskHost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
313 b
whitelisted
3332
svchost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
US
binary
727 b
whitelisted
3332
svchost.exe
GET
200
18.245.38.235:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
US
binary
1.40 Kb
whitelisted
7568
svchost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
8608
backgroundTaskHost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
3332
svchost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAjhquDtaD6wycKe3slHkvk%3D
US
binary
727 b
whitelisted
9140
BackgroundTransferHost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
313 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4564
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6016
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5224
SearchApp.exe
2.16.241.205:443
www.bing.com
Akamai International B.V.
DE
whitelisted
3332
svchost.exe
108.138.26.23:443
desktop.splice.com
AMAZON-02
US
unknown
3332
svchost.exe
18.245.38.235:80
ocsp.rootca1.amazontrust.com
—
US
whitelisted
5224
SearchApp.exe
2.16.241.201:443
www.bing.com
Akamai International B.V.
DE
whitelisted
7568
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7568
svchost.exe
172.66.2.5:80
ocsp.digicert.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.16.241.205
  • 2.16.241.218
  • 2.16.241.201
whitelisted
google.com
  • 142.250.185.142
whitelisted
desktop.splice.com
  • 108.138.26.23
  • 108.138.26.3
  • 108.138.26.68
  • 108.138.26.13
unknown
ocsp.rootca1.amazontrust.com
  • 18.245.38.235
whitelisted
th.bing.com
  • 2.16.241.201
  • 2.16.241.218
  • 2.16.241.205
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.76
  • 20.190.160.22
  • 20.190.160.4
  • 40.126.32.68
  • 40.126.32.74
  • 20.190.160.67
  • 40.126.32.72
whitelisted
ocsp.digicert.com
  • 172.66.2.5
  • 162.159.142.9
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
geo.prod.do.dsp.mp.microsoft.com
  • 72.145.35.96
whitelisted

Threats

PID
Process
Class
Message
2724
Splice.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2724
Splice.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2724
Splice.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2724
Splice.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
splice.exe
Generated install ID: 6B49A1B4-AD68-41E3-9B1D-42F8C4EEE7E
splice.exe
Initial installation.
splice.exe
URI: https://desktop.splice.com/conveyor/stable/splice.appinstaller
splice.exe
5 attempts remaining.
splice.exe
Timer expired, showing UI.
splice.exe
Waiting ...
splice.exe
Result: op.status: 1 op.error: 0 code=0, IsRegistered=1
splice.exe
Full command: "shell:appsFolder\Splice_xpwcknj9p1bc6!Splice"
updatecheck.exe
Generated install ID: 20D1A1B0-6C76-4ACE-9612-BDB5FDFDFD7F
updatecheck.exe
App launched.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
splice.exe