File name:

_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe

Full analysis: https://app.any.run/tasks/dc239238-882a-4048-9f1d-a1c6bf981954
Verdict: Malicious activity
Analysis date: February 27, 2026, 13:49:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
simplehelp
rmm-tool
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

DC7C27785A6F7509D39D236DE24DDD1D

SHA1:

C78702CAD05C3512A5D31081D16DF0E5A8CB03B9

SHA256:

ED3D67177D52E3A2A480887694BB17982365F00F6478DDFFEF1BCB992E47085B

SSDEEP:

196608:3Dfx6xGPu6W9cZqIbe9eaVyqOfmPJAs2zuBQDVL8+X:3jx6EPuhAqIC9eqOfDJ5L8+X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 7636)
      • unpack200.exe (PID: 5284)
      • unpack200.exe (PID: 6664)
      • unpack200.exe (PID: 7756)
      • unpack200.exe (PID: 2608)
      • unpack200.exe (PID: 6236)
      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)
      • unpack200.exe (PID: 8024)
      • unpack200.exe (PID: 8372)
      • unpack200.exe (PID: 8460)
      • unpack200.exe (PID: 3644)
      • unpack200.exe (PID: 5588)
      • windowslauncher.exe (PID: 7612)
      • unpack200.exe (PID: 4544)
      • unpack200.exe (PID: 8032)
      • Remote AccessLauncher.exe (PID: 524)
      • SimpleService.exe (PID: 7944)
      • SimpleService.exe (PID: 2788)
      • Remote Access.exe (PID: 7164)
      • SimpleService.exe (PID: 1600)
      • Remote Access.exe (PID: 3276)
      • Remote Access Service.exe (PID: 3584)

    • SIMPLEHELP has been detected

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)
      • Remote Access Service.exe (PID: 3584)
      • SimpleService.exe (PID: 1600)

  • SUSPICIOUS

    • Uses ICACLS.EXE to modify access control lists

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)
      • Remote Access.exe (PID: 7164)
      • Remote AccessLauncher.exe (PID: 524)

    • Executes as Windows Service

      • SimpleService.exe (PID: 1600)

  • INFO

    • Checks supported languages

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)
      • unpack200.exe (PID: 8460)
      • unpack200.exe (PID: 5284)
      • unpack200.exe (PID: 6664)
      • unpack200.exe (PID: 7756)
      • unpack200.exe (PID: 6236)
      • unpack200.exe (PID: 8024)
      • windowslauncher.exe (PID: 7612)
      • unpack200.exe (PID: 2608)
      • unpack200.exe (PID: 8372)
      • unpack200.exe (PID: 4544)
      • unpack200.exe (PID: 8032)
      • unpack200.exe (PID: 3644)
      • unpack200.exe (PID: 5588)
      • Remote AccessLauncher.exe (PID: 524)
      • Remote Access.exe (PID: 7164)
      • SimpleService.exe (PID: 7944)
      • SimpleService.exe (PID: 2788)
      • Remote Access Service.exe (PID: 3584)
      • SimpleService.exe (PID: 1600)
      • Remote Access.exe (PID: 3276)

    • Reads the computer name

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)
      • Remote Access.exe (PID: 7164)
      • SimpleService.exe (PID: 7944)
      • SimpleService.exe (PID: 2788)
      • SimpleService.exe (PID: 1600)
      • Remote Access.exe (PID: 3276)

    • Creates files in the program directory

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)
      • unpack200.exe (PID: 5284)
      • unpack200.exe (PID: 6664)
      • unpack200.exe (PID: 7756)
      • unpack200.exe (PID: 8460)
      • unpack200.exe (PID: 8372)
      • unpack200.exe (PID: 2608)
      • unpack200.exe (PID: 6236)
      • unpack200.exe (PID: 8024)
      • unpack200.exe (PID: 4544)
      • unpack200.exe (PID: 5588)
      • unpack200.exe (PID: 8032)
      • unpack200.exe (PID: 3644)
      • Remote AccessLauncher.exe (PID: 524)
      • Remote Access.exe (PID: 7164)
      • Remote Access Service.exe (PID: 3584)
      • Remote Access.exe (PID: 3276)

    • SIMPLEHELP has been detected

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)
      • cacls.exe (PID: 7208)
      • Remote Access.exe (PID: 7164)
      • SimpleService.exe (PID: 2788)
      • SimpleService.exe (PID: 7944)

    • Checks proxy server information

      • slui.exe (PID: 3576)
      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)

    • Reads security settings of Internet Explorer

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)

    • Create files in a temporary directory

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)
      • Remote AccessLauncher.exe (PID: 524)
      • Remote Access.exe (PID: 7164)

    • Creates files or folders in the user directory

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)

    • Reads the machine GUID from the registry

      • _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe (PID: 3716)
      • Remote Access.exe (PID: 7164)
      • Remote Access.exe (PID: 3276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2020:03:18 14:39:36+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 8
CodeSize: 268800
InitializedDataSize: 143872
UninitializedDataSize: -
EntryPoint: 0x1cf10
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 5.2.11.0
ProductVersionNumber: 10.10.10.10
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 5.2.11.0
ProductVersion: 5.2.11.0
OriginalFileName:
InternalName:
FileDescription: SimpleHelp Remote Access Client
CompanyName: SimpleHelp Ltd
LegalCopyright: Copyright (c) 2020
ProductName: Remote Access
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
61
Malicious processes
5
Suspicious processes
17

Behavior graph

Click at the process to see the details
start THREAT _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe slui.exe unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs windowslauncher.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs icacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs remote accesslauncher.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs remote access.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs cacls.exe no specs conhost.exe no specs simpleservice.exe no specs simpleservice.exe no specs THREAT simpleservice.exe no specs THREAT remote access service.exe no specs remote access.exe _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
524"C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\JWLaunchProperties-1772200350800-0"C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe—_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe
User:
admin
Company:
SimpleHelp Ltd
Integrity Level:
HIGH
Description:
SimpleHelp Remote Access Client
Exit code:
42
Version:
5.0.0.0
Modules
Images
c:\programdata\jwrapper-remote access\jwrapper-windows64jre-00063527423-complete\bin\remote accesslauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\programdata\jwrapper-remote access\jwrapper-windows64jre-00063527423-complete\bin\server\jvm.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
796\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1352\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1600"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\programdata\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1676\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1760cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":FC:\Windows\System32\cacls.exe—Remote AccessLauncher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\rpcrt4.dll
2096cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted" /e /g "Users":FC:\Windows\System32\cacls.exe—_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
2460cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun" /e /g "Users":FC:\Windows\System32\cacls.exe—_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
2608"C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200331-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200331-4-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200331-4-app\lib\ext\sunmscapi.jar" C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200331-4-app\bin\unpack200.exe—_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1920.12
Modules
Images
c:\programdata\jwrapper-remote access\jwrappertemp-1772200331-4-app\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\programdata\jwrapper-remote access\jwrappertemp-1772200331-4-app\bin\msvcr100.dll
2788"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe—Remote Access.exe
User:
admin
Integrity Level:
HIGH
Exit code:
7736944
Modules
Images
c:\programdata\jwrapper-remote access\jwappssharedconfig\restricted\simpleservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
5 967
Read events
5 956
Write events
11
Delete events
0

Modification events

(PID) Process:(3716) _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3716) _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3716) _ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2788) SimpleService.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Access Service\Parameters
Operation:writeName:workingdir
Value:
C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService
(PID) Process:(2788) SimpleService.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Access Service\Parameters
Operation:writeName:cmdline
Value:
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe"
(PID) Process:(2788) SimpleService.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Access Service\Parameters
Operation:writeName:auto_restart
Value:
no
(PID) Process:(2788) SimpleService.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Access Service\Parameters
Operation:writeName:run_once
Value:
no
(PID) Process:(2788) SimpleService.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Access Service\Parameters
Operation:writeName:do_cad
Value:
no
(PID) Process:(2788) SimpleService.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Access Service\Parameters
Operation:writeName:stopcmdline
Value:
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe"
(PID) Process:(2788) SimpleService.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Remote Access Service\Parameters
Operation:writeName:stopworkingdir
Value:
C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService
Executable files
0
Suspicious files
0
Text files
0
Unknown types
297

Dropped files

PID
Process
Filename
Type
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200204-3-app\jwrapperlib\jwstandalonelaunch.jarbinary
MD5:404F278CBAAF0187271295C80623556F
SHA256:901919E3E42B44565A2F57A077BA65E7308D9651223B97B4966360F18F63246A
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200204-3-app\JWrapper-Remote Access-ICNS.icnsbinary
MD5:38D961A37088B5B60431EF4B81BC8902
SHA256:60BCAAEF7D51F73A7461FB83D27EFF75353EE0273D0D4A9CD2DFE92D2D50D599
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200204-3-app\libjwutils_linux32arm.sobinary
MD5:8A7574C4F327D70B144C92C126870C34
SHA256:BBEC792801A81F7521F27FD872C9E1A2CA19456525A4E201E81A0F19776D0E0E
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200204-3-app\jwutils_win64.dllbinary
MD5:E7A1E6E40B24ADFEA986EFBCBA166BCF
SHA256:49C49B94E2A50B865F8A39EB8497BD97A9F3F4C585CD671F8C8FD2B05A24639A
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200204-3-app\libjwutils_linux64.sobinary
MD5:D28409795FB3212DC5621A680388AA8E
SHA256:D08B475F3E40077E40BF949DB73DE4836C0318A7D4CFBE310135F445AE7403FB
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200204-3-app\JWrapper-JWrapper-version.txtbinary
MD5:9C08295BFCE420684BB4ADF6619B3066
SHA256:A9F4EBB48449D128DC92BAE80B5CFF0014CAEC60E566F3F8CE0C368BB71FADFE
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200204-3-app\jwAuthorPublicKeybinary
MD5:1128DCB368DF4E55C20A4657D6B9B6A5
SHA256:B72D40A45A55DF2C60142D734630E5BE9464B52A09CF71A2951BD4553F785A12
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200204-3-app\libjwutils_macos64.jnilibbinary
MD5:592A6D59C2DC1E78C1E535F573A10A0D
SHA256:AA76B12C98229260D0856EEADF412DC35CF44E440593D539756BF34A1D198D59
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200331-4-app\bin\api-ms-win-core-datetime-l1-1-0.dllbinary
MD5:AC3C4CAFA028297DA5037781F1156220
SHA256:0F0CEC83DA06F06E9C42FFDED72FA69C51EFED881DEF2B4B7B88274BC1BF3D40
3716_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exeC:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1772200204-3-app\JWrapperLaunchbinary
MD5:D622DECBD7498058C4F7664F088C0543
SHA256:7186271120BDC76A60AB6AAEE280E9EF1ED6C14FA3515126555AFEC8073DFE9E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
63
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8792
SIHClient.exe
GET
304
135.232.92.137:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
2976
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
—
—
POST
200
40.126.32.68:443
https://login.live.com/RST2.srf
US
binary
11.1 Kb
whitelisted
356
svchost.exe
POST
200
40.126.31.71:443
https://login.live.com/RST2.srf
US
binary
11.1 Kb
whitelisted
—
—
POST
200
40.126.32.138:443
https://login.live.com/RST2.srf
US
binary
10.3 Kb
whitelisted
8552
RUXIMICS.exe
GET
200
95.101.54.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
8792
SIHClient.exe
GET
200
74.178.76.54:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
8792
SIHClient.exe
GET
200
135.232.92.137:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
8792
SIHClient.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
US
binary
814 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
8552
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
2976
svchost.exe
95.101.54.122:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
8552
RUXIMICS.exe
95.101.54.122:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
2976
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
8552
RUXIMICS.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 52.182.143.208
  • 13.89.178.27
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
google.com
  • 142.250.201.174
whitelisted
crl.microsoft.com
  • 95.101.54.122
  • 95.101.54.128
  • 23.216.77.42
  • 23.216.77.6
  • 23.216.77.20
whitelisted
www.microsoft.com
  • 23.59.18.102
  • 23.52.181.212
  • 184.30.25.170
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.2
  • 40.126.31.129
  • 40.126.31.3
  • 20.190.159.129
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.71
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
online.controller-point.com
  • 155.2.192.27
unknown
slscr.update.microsoft.com
  • 135.232.92.137
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 74.178.76.54
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_ed3d67177d52e3a2a480887694bb17982365f00f6478ddffef1bcb992e47085b.exe