File name:

AnVir.exe

Full analysis: https://app.any.run/tasks/7b44b390-7135-427a-8937-c5d90509a6c5
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: March 16, 2025, 17:18:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
screenconnect
rat
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

4F43C88D7F927530E5E07D4D20E60071

SHA1:

D229E9ABD1EAE3A8B17B93182282F4B463103F79

SHA256:

E0CBF935B59A329B25581611FF509CBAE7D023ACC4E312F26D0CDE43B3F1DB40

SSDEEP:

98304:XE3aQfCwDm55vZ2mpWqAKziinEvYzH6r0Vq5sikGgaDY2ipmU9:0qUCwQ5h2mRAKziXYzH6K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • AnVir.exe (PID: 6268)
      • ShellExperienceHost.exe (PID: 8348)
      • AnVir.exe (PID: 1164)

    • Application launched itself

      • AnVir.exe (PID: 1164)

    • Adds/modifies Windows certificates

      • AnVir.exe (PID: 6268)

    • There is functionality for VM detection VMWare (YARA)

      • AnVir.exe (PID: 6268)

    • Detects ScreenConnect RAT (YARA)

      • AnVir.exe (PID: 6268)

    • There is functionality for VM detection VirtualBox (YARA)

      • AnVir.exe (PID: 6268)

    • There is functionality for VM detection Parallels (YARA)

      • AnVir.exe (PID: 6268)

    • There is functionality for VM detection antiVM strings (YARA)

      • AnVir.exe (PID: 6268)

    • Start notepad (likely ransomware note)

      • AnVir.exe (PID: 6268)

    • Searches for installed software

      • AnVir.exe (PID: 6268)

    • The process checks if it is being run in the virtual environment

      • AnVir.exe (PID: 6268)

  • INFO

    • The sample compiled with english language support

      • AnVir.exe (PID: 1164)

    • Checks supported languages

      • AnVir.exe (PID: 1164)
      • AnVir.exe (PID: 6268)
      • ShellExperienceHost.exe (PID: 8348)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 10132)
      • BackgroundTransferHost.exe (PID: 8084)
      • BackgroundTransferHost.exe (PID: 8692)
      • BackgroundTransferHost.exe (PID: 8340)
      • BackgroundTransferHost.exe (PID: 7740)
      • notepad.exe (PID: 10212)

    • Checks proxy server information

      • AnVir.exe (PID: 6268)
      • BackgroundTransferHost.exe (PID: 7740)
      • slui.exe (PID: 5064)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7740)
      • AnVir.exe (PID: 6268)

    • Reads the machine GUID from the registry

      • AnVir.exe (PID: 6268)

    • Process checks computer location settings

      • AnVir.exe (PID: 6268)
      • AnVir.exe (PID: 1164)

    • Create files in a temporary directory

      • AnVir.exe (PID: 6268)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7740)
      • slui.exe (PID: 5064)
      • AnVir.exe (PID: 6268)

    • Reads the computer name

      • ShellExperienceHost.exe (PID: 8348)
      • AnVir.exe (PID: 1164)
      • AnVir.exe (PID: 6268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (53.4)
.exe | Win64 Executable (generic) (35.5)
.exe | Win32 Executable (generic) (5.8)
.exe | Generic Win/DOS Executable (2.5)
.exe | DOS Executable Generic (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:08:06 05:39:09+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 978944
InitializedDataSize: 10720768
UninitializedDataSize: -
EntryPoint: 0xc9fef
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 9.4.0.0
ProductVersionNumber: 9.4.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
Comments: Advanced processes and startup manager with anti-trojan and anti-spyware functions.
CompanyName: AnVir Software
FileDescription: AnVir Task Manager Free
FileVersion: 9.4.0.0
InternalName: AnVir Task Manager Free
LegalCopyright: Copyright (c) 2002-2021. AnVir Software
LegalTrademarks: AnVir Task Manager Free
OriginalFileName: AnVir.exe
ProductName: AnVir Task Manager Free
ProductVersion: 9.4.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start anvir.exe no specs #SCREENCONNECT anvir.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe msinfo32.exe no specs notepad.exe no specs shellexperiencehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1164"C:\Users\admin\AppData\Local\Temp\AnVir.exe" C:\Users\admin\AppData\Local\Temp\AnVir.exe—explorer.exe
User:
admin
Company:
AnVir Software
Integrity Level:
MEDIUM
Description:
AnVir Task Manager Free
Exit code:
0
Version:
9.4.0.0
Modules
Images
c:\users\admin\appdata\local\temp\anvir.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5064C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6268"C:\Users\admin\AppData\Local\Temp\AnVir.exe" C:\Users\admin\AppData\Local\Temp\AnVir.exe
AnVir.exe
User:
admin
Company:
AnVir Software
Integrity Level:
HIGH
Description:
AnVir Task Manager Free
Version:
9.4.0.0
Modules
Images
c:\users\admin\appdata\local\temp\anvir.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
7740"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7780"C:\Windows\System32\msinfo32.exe" C:\Windows\System32\msinfo32.exe—AnVir.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
System Information
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msinfo32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
8084"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
8340"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
8348"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
8692"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
10132"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
77 974
Read events
77 788
Write events
175
Delete events
11

Modification events

(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:Language
Value:
0
(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:FirstLaunch
Value:
1
(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:SplitStartup
Value:
0
(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:ToolTipCtrlOnly
Value:
0
(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:AutoCheckUpdate
Value:
1
(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:CheckFileSignatures
Value:
1
(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:BigTabIcons
Value:
1
(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:CoolGUI
Value:
1
(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:AnimateOnMinimize
Value:
1
(PID) Process:(1164) AnVir.exeKey:HKEY_CURRENT_USER\SOFTWARE\AnVir
Operation:writeName:MainFrameMaximized
Value:
0
Executable files
0
Suspicious files
72
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
6268AnVir.exeC:\Users\admin\AppData\Local\AnVir\detectPr.datbinary
MD5:6AA374630579EC943623F5EBBB041619
SHA256:3B0791F6F778792CAACF7F725FD380A95A3AFA7351EBCC1B3771015FF2E36749
6268AnVir.exeC:\Users\admin\AppData\Local\AnVir\version.datbinary
MD5:D2090D6B941ECBC38F0D584DA7A9AE85
SHA256:A571E99891C08EA4EF5E130F664E1A796F0622C8D63A9B893C29BA0123E1513C
6268AnVir.exeC:\Users\admin\AppData\Local\AnVir\titlebuttons.datbinary
MD5:BED681CF8FDEF78BC05DE8B2BBD22DEB
SHA256:FD5DB2EC5A52C3B982D91F605D0DA9AE974F76D77FAC64BB1476B6FE25C48B01
6268AnVir.exeC:\Users\admin\AppData\Local\AnVir\versionsinfo.datbinary
MD5:26A32412182D7B1EDF2CAB8315351635
SHA256:032FCFF51AEA476B5CE6366BD460F8A511E3017F0EB18B4ED2BDBBF9C8E26F39
6268AnVir.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_2A1F4CCD74E7AC1EAF9433BC50ADF937binary
MD5:83430A3CE712B54596BB9FEEBAADA4B0
SHA256:6CA756EE409204A6C6DE295E6ADDEF50C40A0027061A24E296CF920F89C2F3CA
6268AnVir.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9binary
MD5:FA48334FBECB1B9FF15602F0B472EB50
SHA256:224934C099B004DCB50EBEBB6593DB68331AA0BAAB4787AF590E3CBA5BBE4E36
6268AnVir.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:AEF75270495EFF15CC70F05CFE21809E
SHA256:438E4043C7225C7E9A405C70C4C2109D387679C6DAB7E95D853DE5998F3376A0
6268AnVir.exeC:\Users\admin\AppData\Local\AnVir\startup.datbinary
MD5:C3F2012D6829D5EB2274BAAD420A0BC8
SHA256:C051D45D4528B9B2F304E79A3CA4AE16A7100CE254947B7DAC0B030A5EA3000D
6268AnVir.exeC:\Users\admin\AppData\Local\AnVir\Backup\AnVir2025_3.regtext
MD5:3AF03C5256039ECF15A211A8C723231D
SHA256:79BE300167CE73EE86A11BF11F12641A6D41BD9B4315C6796388C7FB547529C1
6268AnVir.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5binary
MD5:B788CE8001FDF888FFD5BF26A9EDA75B
SHA256:6B34A8D9D1BEE0FBA443BF27209302940D7C1560731F3193B2FB314B379C566F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
50
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.24.77.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6268
AnVir.exe
GET
200
142.250.185.174:80
http://www.google-analytics.com/collect?v=1&tid=UA-2758427-1&cid=649566714&t=event&ec=Launch%5Ftf&ea=ManualInstalled&el=9.4.0
unknown
—
—
whitelisted
6268
AnVir.exe
GET
200
185.221.152.14:80
http://www.anvir.com/version.dat
unknown
—
—
—
6268
AnVir.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEB2iSDBvmyYY0ILgln0z02o%3D
unknown
—
—
whitelisted
6268
AnVir.exe
GET
200
2.22.242.121:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
5728
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6268
AnVir.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
6268
AnVir.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D
unknown
—
—
whitelisted
6268
AnVir.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA%2BoSQYV1wCgviF2%2FcXsbb0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
184.24.77.37:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
6268
AnVir.exe
142.250.185.174:80
www.google-analytics.com
GOOGLE
US
whitelisted
6268
AnVir.exe
185.221.152.14:80
www.anvir.com
EuroByte LLC
RU
unknown
5728
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 184.24.77.37
  • 184.24.77.35
  • 2.22.242.121
  • 2.22.242.90
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.5
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.72
  • 20.190.160.130
  • 40.126.32.138
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
www.google-analytics.com
  • 142.250.185.174
whitelisted
www.anvir.com
  • 185.221.152.14
unknown
arc.msn.com
  • 20.31.169.57
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AnVir.exe