File name:

jre-6u20-windows-x64.exe

Full analysis: https://app.any.run/tasks/9b2054b6-2a63-43d0-958c-5947ad3b3e41
Verdict: Malicious activity
Analysis date: April 11, 2025, 22:57:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

343EEAD5222DA8F5BFFB298FB2683330

SHA1:

3E0C7BDD32AE22B1E3DA0D127AF06B6AD6742B46

SHA256:

E191FE103FE341C2C900A6DF3D37D9C4D53A890D408F3DC8795851D37FB6E2AA

SSDEEP:

98304:BbWx//8cT4GjimUc1K17zRlpnyBEvm8frkU6PMthGRlJF6JKwE7s6ySv+SyVXoz0:965r1K+5tG6dUlRqDuFbnD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • jre-6u20-windows-x64.exe (PID: 2320)
      • jre-6u20-windows-x64.exe (PID: 3176)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 672)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • jre-6u20-windows-x64.exe (PID: 3176)
      • zipper.exe (PID: 928)

    • Checks for Java to be installed

      • jre-6u20-windows-x64.exe (PID: 3176)
      • msiexec.exe (PID: 2236)
      • msiexec.exe (PID: 672)
      • javaws.exe (PID: 4068)
      • msiexec.exe (PID: 4400)
      • javaw.exe (PID: 6820)

    • Reads security settings of Internet Explorer

      • jre-6u20-windows-x64.exe (PID: 3176)
      • msiexec.exe (PID: 672)
      • msiexec.exe (PID: 4400)
      • javaw.exe (PID: 6820)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 2600)

    • Application launched itself

      • msiexec.exe (PID: 2236)

    • There is functionality for taking screenshot (YARA)

      • jre-6u20-windows-x64.exe (PID: 3176)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2236)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1532)

    • Process drops legitimate windows executable

      • zipper.exe (PID: 928)

    • The process drops C-runtime libraries

      • zipper.exe (PID: 928)

    • Uses WMIC.EXE to obtain computer system information

      • cmd.exe (PID: 6264)
      • cmd.exe (PID: 5544)
      • cmd.exe (PID: 3884)

    • Reads Mozilla Firefox installation path

      • msiexec.exe (PID: 672)

    • Uses WMIC.EXE to obtain BIOS management information

      • cmd.exe (PID: 6248)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 5036)

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 928)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 672)

    • Searches for installed software

      • explorer.exe (PID: 6256)

  • INFO

    • The sample compiled with english language support

      • jre-6u20-windows-x64.exe (PID: 3176)
      • zipper.exe (PID: 928)

    • Creates files or folders in the user directory

      • jre-6u20-windows-x64.exe (PID: 3176)
      • javaw.exe (PID: 928)
      • msiexec.exe (PID: 4400)
      • javaw.exe (PID: 6820)

    • Checks supported languages

      • jre-6u20-windows-x64.exe (PID: 3176)
      • msiexec.exe (PID: 2236)
      • msiexec.exe (PID: 4400)
      • MSI6A7.tmp (PID: 1912)
      • msiexec.exe (PID: 1132)
      • msiexec.exe (PID: 672)
      • zipper.exe (PID: 928)
      • unpack200.exe (PID: 7012)
      • unpack200.exe (PID: 5508)
      • unpack200.exe (PID: 6244)
      • unpack200.exe (PID: 2332)
      • unpack200.exe (PID: 6208)
      • unpack200.exe (PID: 5988)
      • unpack200.exe (PID: 7000)
      • javaw.exe (PID: 6416)
      • javaw.exe (PID: 928)
      • javaws.exe (PID: 4068)
      • javaw.exe (PID: 4988)
      • javaw.exe (PID: 6820)

    • Create files in a temporary directory

      • jre-6u20-windows-x64.exe (PID: 3176)
      • msiexec.exe (PID: 672)
      • javaw.exe (PID: 4988)
      • javaw.exe (PID: 928)
      • javaw.exe (PID: 6820)

    • Checks proxy server information

      • jre-6u20-windows-x64.exe (PID: 3176)
      • msiexec.exe (PID: 4400)
      • slui.exe (PID: 3020)
      • javaw.exe (PID: 6820)

    • Reads the computer name

      • jre-6u20-windows-x64.exe (PID: 3176)
      • msiexec.exe (PID: 2236)
      • msiexec.exe (PID: 4400)
      • msiexec.exe (PID: 1132)
      • msiexec.exe (PID: 672)
      • javaw.exe (PID: 928)
      • javaw.exe (PID: 6820)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2600)
      • msiexec.exe (PID: 2236)
      • msiexec.exe (PID: 672)

    • Manages system restore points

      • SrTasks.exe (PID: 6828)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2236)

    • Creates files in the program directory

      • zipper.exe (PID: 928)
      • unpack200.exe (PID: 7012)
      • unpack200.exe (PID: 5508)
      • unpack200.exe (PID: 6244)
      • unpack200.exe (PID: 2332)
      • unpack200.exe (PID: 6208)
      • unpack200.exe (PID: 7000)
      • unpack200.exe (PID: 5988)
      • javaw.exe (PID: 928)
      • javaw.exe (PID: 6820)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 928)
      • msiexec.exe (PID: 4400)
      • jre-6u20-windows-x64.exe (PID: 3176)
      • javaw.exe (PID: 6820)

    • Reads the software policy settings

      • msiexec.exe (PID: 4400)
      • javaw.exe (PID: 6820)
      • jre-6u20-windows-x64.exe (PID: 3176)
      • slui.exe (PID: 3020)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 976)
      • WMIC.exe (PID: 6988)
      • WMIC.exe (PID: 2416)
      • WMIC.exe (PID: 4272)
      • WMIC.exe (PID: 5036)
      • explorer.exe (PID: 6256)

    • Reads the time zone

      • javaw.exe (PID: 928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (49)
.exe | Win64 Executable (generic) (31.4)
.scr | Windows screen saver (14.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2010:04:12 23:48:08+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 8
CodeSize: 74752
InitializedDataSize: 16349696
UninitializedDataSize: -
EntryPoint: 0x8b40
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 6.0.200.2
ProductVersionNumber: 6.0.200.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Sun Microsystems, Inc.
FileDescription: Java(TM) Platform SE binary
FileVersion: 6.0.200.2
FullVersion: 1.6.0_20-b02
InternalName: Setup Launcher
LegalCopyright: Copyright © 2004
OriginalFileName: jinstall.exe
ProductName: Java(TM) Platform SE 6 U20
ProductVersion: 6.0.200.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
45
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start jre-6u20-windows-x64.exe msiexec.exe msiexec.exe msiexec.exe msi6a7.tmp no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe zipper.exe unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs javaw.exe no specs javaw.exe no specs javaws.exe no specs javaw.exe no specs cmd.exe no specs conhost.exe no specs javaw.exe wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs icacls.exe no specs conhost.exe no specs slui.exe explorer.exe no specs COpenControlPanel no specs rundll32.exe no specs jre-6u20-windows-x64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
672C:\Windows\System32\MsiExec.exe -Embedding 6CF16C6C96432977D574F12B3E45E176 E Global\MSI0000C:\Windows\System32\msiexec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
684\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
928"C:\Program Files\Java\jre6\zipper.exe" "C:\Program Files\Java\jre6\core.zip" "C:\Program Files\Java\jre6\" "C:\Users\admin\AppData\Local\Temp\java_install.log"C:\Program Files\Java\jre6\zipper.exe
msiexec.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\java\jre6\zipper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
928"C:\Program Files\Java\jre6\bin\javaw.exe" com.sun.servicetag.Installer -source "Windows JRE installer"C:\Program Files\Java\jre6\bin\javaw.exe—msiexec.exe
User:
admin
Company:
Sun Microsystems, Inc.
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
6.0.200.2
Modules
Images
c:\program files\java\jre6\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
976WMIC computersystem get manufacturerC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1132C:\Windows\System32\MsiExec.exe -Embedding 75DF7D30A2F5557768828A51E0972B89C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1532C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1912"C:\Users\admin\AppData\Local\Temp\MSI6A7.tmp" C:\Program Files\Java\jre6\;CC:\Users\admin\AppData\Local\Temp\MSI6A7.tmp—msiexec.exe
User:
admin
Company:
Sun Microsystems, Inc.
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
6.0.200.2
Modules
Images
c:\users\admin\appdata\local\temp\msi6a7.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2084C:\WINDOWS\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
Total events
41 963
Read events
29 159
Write events
6 576
Delete events
6 228

Modification events

(PID) Process:(3176) jre-6u20-windows-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft
Operation:delete valueName:InstallStatus
Value:
(PID) Process:(3176) jre-6u20-windows-x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3176) jre-6u20-windows-x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3176) jre-6u20-windows-x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3176) jre-6u20-windows-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy
Operation:writeName:Country
Value:
NL
(PID) Process:(3176) jre-6u20-windows-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy
Operation:writeName:PostStatusUrl
Value:
https://sjremetrics.java.com/b/ss//6
(PID) Process:(3176) jre-6u20-windows-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy
Operation:writeName:Method
Value:
joff
(PID) Process:(2236) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000CE23871D35ABDB01BC08000024190000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2236) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000CD9B3F1D35ABDB01BC08000024190000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2236) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000CD9B3F1D35ABDB01BC08000024190000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
105
Suspicious files
501
Text files
85
Unknown types
0

Dropped files

PID
Process
Filename
Type
3176jre-6u20-windows-x64.exeC:\Users\admin\AppData\LocalLow\Sun\Java\jre1.6.0_20_x64\Data1.cab —
MD5:—
SHA256:—
2236msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2600msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6D7.tmpexecutable
MD5:154113531946747CD8B5341723772D39
SHA256:BBBE2154737E7221FA1DC49A191D6DF74D3A737138B4941098FF0D346A60477E
2600msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIC863.tmpexecutable
MD5:154113531946747CD8B5341723772D39
SHA256:BBBE2154737E7221FA1DC49A191D6DF74D3A737138B4941098FF0D346A60477E
2600msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6A7.tmpexecutable
MD5:362BCF99AAE166A5126AEF3B4D3ACB37
SHA256:39FC5CC68D8492A72E5756A01B39798EA57867776E14D20A976F87783AD27246
2600msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6E9.tmpexecutable
MD5:154113531946747CD8B5341723772D39
SHA256:BBBE2154737E7221FA1DC49A191D6DF74D3A737138B4941098FF0D346A60477E
2600msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI657.tmpexecutable
MD5:154113531946747CD8B5341723772D39
SHA256:BBBE2154737E7221FA1DC49A191D6DF74D3A737138B4941098FF0D346A60477E
2236msiexec.exeC:\Windows\Installer\114d42.msibinary
MD5:B8100C23F7AF17BACBE811BE5B00D4CF
SHA256:B69FC19D586AC489E33309D80898955E2937B707BCA1E702087F5FAADBC22EBA
2236msiexec.exeC:\Windows\Installer\MSI5259.tmpexecutable
MD5:154113531946747CD8B5341723772D39
SHA256:BBBE2154737E7221FA1DC49A191D6DF74D3A737138B4941098FF0D346A60477E
2236msiexec.exeC:\Program Files\Java\jre6\core.zip —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
62
DNS requests
33
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3176
jre-6u20-windows-x64.exe
HEAD
200
2.18.121.81:80
http://rps-svcs.sun.com/services/countrylookup
unknown
—
—
whitelisted
3176
jre-6u20-windows-x64.exe
GET
200
2.18.121.5:80
http://javadl-esd.sun.com/update/1.6.0/1.6.0_20-b02.xml
unknown
—
—
whitelisted
—
—
GET
200
2.18.121.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
616
SIHClient.exe
GET
200
104.85.1.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
616
SIHClient.exe
GET
200
104.85.1.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4400
msiexec.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.18.121.139:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3176
jre-6u20-windows-x64.exe
2.18.121.5:80
javadl-esd.sun.com
AKAMAI-AS
FR
whitelisted
3176
jre-6u20-windows-x64.exe
2.18.121.81:80
rps-svcs.sun.com
AKAMAI-AS
FR
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.18.121.139
  • 2.18.121.147
whitelisted
google.com
  • 216.58.206.78
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
javadl-esd.sun.com
  • 2.18.121.5
  • 2.18.121.6
whitelisted
rps-svcs.sun.com
  • 2.18.121.81
  • 2.18.121.68
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.17
  • 40.126.32.136
  • 20.190.160.4
  • 20.190.160.131
  • 20.190.160.66
  • 20.190.160.5
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.130
  • 40.126.32.140
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 104.85.1.163
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
jre-6u20-windows-x64.exe