File name:

fuckyou.exe

Full analysis: https://app.any.run/tasks/ade0462d-c598-4656-80e4-d9eb5cc3056d
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: April 25, 2025, 14:41:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pastebin
xworm
auto-startup
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

77EB2A6CABA8DD18369380069E679DAC

SHA1:

18639620D367AF741544E87D1F3850E2AE8B91EB

SHA256:

D81F741017066784429E6926DA0484796B0939779EC6588FC7A6BE54C876D6CE

SSDEEP:

768:pOpl/SoIlyJlUW1vJJiXFh9ZHiO0hRQBu:gpAoIIfUW1xAFh9ZHiO0DYu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XWORM has been detected (YARA)

      • fuckyou.exe (PID: 6708)

    • Uses Task Scheduler to run other applications

      • fuckyou.exe (PID: 6708)
      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)

    • Create files in the Startup directory

      • fuckyou.exe (PID: 6708)

    • Changes the autorun value in the registry

      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)
      • fuckyou.exe (PID: 6708)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • fuckyou.exe (PID: 6708)

    • Reads security settings of Internet Explorer

      • fuckyou.exe (PID: 6708)
      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)

    • Reads the date of Windows installation

      • fuckyou.exe (PID: 6708)
      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)

    • The process executes via Task Scheduler

      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 4112)

    • Executes application which crashes

      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 6708)
      • fuckyou.exe (PID: 4112)

  • INFO

    • Reads the computer name

      • fuckyou.exe (PID: 6708)
      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)

    • Reads the machine GUID from the registry

      • fuckyou.exe (PID: 6708)
      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 516)
      • fuckyou.exe (PID: 6708)
      • WerFault.exe (PID: 3180)
      • WerFault.exe (PID: 2504)
      • WerFault.exe (PID: 6736)

    • Checks supported languages

      • fuckyou.exe (PID: 6708)
      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)

    • Process checks computer location settings

      • fuckyou.exe (PID: 6708)
      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)

    • Auto-launch of the file from Registry key

      • fuckyou.exe (PID: 6708)
      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)

    • Auto-launch of the file from Startup directory

      • fuckyou.exe (PID: 6708)

    • Disables trace logs

      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)
      • fuckyou.exe (PID: 6708)

    • Checks proxy server information

      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)
      • fuckyou.exe (PID: 6708)
      • slui.exe (PID: 2320)

    • Reads the software policy settings

      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 6708)
      • slui.exe (PID: 2320)
      • fuckyou.exe (PID: 4112)

    • Reads Environment values

      • fuckyou.exe (PID: 6540)
      • fuckyou.exe (PID: 5512)
      • fuckyou.exe (PID: 4112)
      • fuckyou.exe (PID: 6708)

    • Manual execution by a user

      • fuckyou.exe (PID: 5512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6708) fuckyou.exe
C2N2MSLhN4j0kOBdI+iCaPpwVhf7Mz7I4H/vqZqh4TnlhX8N4rBeNL9DbtYHG61brX:%IP%
Keys
AES%Port%
Options
SplitterPu71zrxjRSLbwDxE2YVPlQ==
USB drop nameXnV/UWQv3SxK5y1zKnd9fg==
Mutex3
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:25 14:32:49+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 31232
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x992e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: fuckyou.exe
LegalCopyright:
OriginalFileName: fuckyou.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
17
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XWORM fuckyou.exe schtasks.exe no specs conhost.exe no specs werfault.exe no specs fuckyou.exe schtasks.exe no specs conhost.exe no specs werfault.exe no specs slui.exe fuckyou.exe schtasks.exe no specs conhost.exe no specs werfault.exe no specs fuckyou.exe schtasks.exe no specs conhost.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516C:\WINDOWS\system32\WerFault.exe -u -p 6708 -s 2608C:\Windows\System32\WerFault.exe—fuckyou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
1052"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "fuckyou" /tr "C:\Users\admin\fuckyou.exe"C:\Windows\System32\schtasks.exe—fuckyou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2284\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2320C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2504C:\WINDOWS\system32\WerFault.exe -u -p 5512 -s 2540C:\Windows\System32\WerFault.exe—fuckyou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
3180C:\WINDOWS\system32\WerFault.exe -u -p 6540 -s 2564C:\Windows\System32\WerFault.exe—fuckyou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\cryptsp.dll
4008\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4112"C:\Users\admin\fuckyou.exe"C:\Users\admin\fuckyou.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\fuckyou.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4608"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "fuckyou" /tr "C:\Users\admin\fuckyou.exe"C:\Windows\System32\schtasks.exe—fuckyou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4688"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "fuckyou" /tr "C:\Users\admin\fuckyou.exe"C:\Windows\System32\schtasks.exe—fuckyou.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
26 476
Read events
26 458
Write events
18
Delete events
0

Modification events

(PID) Process:(6708) fuckyou.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:fuckyou
Value:
C:\Users\admin\fuckyou.exe
(PID) Process:(6708) fuckyou.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\fuckyou_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6708) fuckyou.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\fuckyou_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6708) fuckyou.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\fuckyou_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6708) fuckyou.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\fuckyou_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6708) fuckyou.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\fuckyou_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6708) fuckyou.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\fuckyou_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6708) fuckyou.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\fuckyou_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6708) fuckyou.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\fuckyou_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6708) fuckyou.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\fuckyou_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
1
Suspicious files
8
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
516WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fuckyou.exe_2b6b13522a4cccb5e2ecd2f4de2a559ad76982c_cb330f96_ed6cee79-1705-45f8-bd72-5f282d2ce17d\Report.wer —
MD5:—
SHA256:—
516WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\fuckyou.exe.6708.dmp —
MD5:—
SHA256:—
3180WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fuckyou.exe_2b6b13522a4cccb5e2ecd2f4de2a559ad76982c_cb330f96_12099a33-0596-4db4-ae4b-7a24e201cbbe\Report.wer —
MD5:—
SHA256:—
3180WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\fuckyou.exe.6540.dmp —
MD5:—
SHA256:—
2504WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fuckyou.exe_2b6b13522a4cccb5e2ecd2f4de2a559ad76982c_cb330f96_f67c63f0-8995-48db-b79a-16910047376e\Report.wer —
MD5:—
SHA256:—
2504WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\fuckyou.exe.5512.dmp —
MD5:—
SHA256:—
6736WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fuckyou.exe_2b6b13522a4cccb5e2ecd2f4de2a559ad76982c_cb330f96_10de418d-0b73-467a-b142-e7f02be7dc60\Report.wer —
MD5:—
SHA256:—
6736WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\fuckyou.exe.4112.dmp —
MD5:—
SHA256:—
3180WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7E07.tmp.dmpbinary
MD5:66648347BEEF54A06191C3A2D70DFAA6
SHA256:167D5D91C4DA782051365F17369AB34DE74015CA27A02481FCDE69A1ED14E53E
516WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF5CD.tmp.WERInternalMetadata.xmlbinary
MD5:0E3820A396B941BDF42EA60F6C772E48
SHA256:BAD09F681593CBE83152AEC370F90881F3A366A56A402AA2B42792418CB3707D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
56
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
1128
SIHClient.exe
GET
200
23.48.23.148:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
—
—
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
1128
SIHClient.exe
GET
200
23.48.23.148:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.48.23.190:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6708
fuckyou.exe
104.22.69.199:443
pastebin.com
CLOUDFLARENET
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.48.23.190
  • 23.48.23.191
  • 23.48.23.186
  • 23.48.23.194
  • 23.48.23.192
  • 23.48.23.193
  • 23.48.23.135
  • 23.48.23.189
  • 23.48.23.184
  • 23.48.23.148
  • 23.48.23.146
  • 23.48.23.147
  • 23.48.23.153
  • 23.48.23.150
  • 23.48.23.155
  • 23.48.23.140
  • 23.48.23.141
  • 23.48.23.144
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.130
  • 20.190.159.75
  • 20.190.159.64
  • 40.126.31.3
  • 40.126.31.71
  • 40.126.31.67
whitelisted
pastebin.com
  • 104.22.69.199
  • 104.22.68.199
  • 172.67.25.94
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
fuckyou.exe