File name:

random.exe

Full analysis: https://app.any.run/tasks/92652b5f-2a9e-4c7a-bcab-5f6fa945f71d
Verdict: Malicious activity
Threats:

GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 07:28:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
gcleaner
loader
delphi
themida
autoit
telegram
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

553A8CCB7AC159A742F6EE4FF65B6D7B

SHA1:

D4A080165F17BEC57F53915C1E1558DB03CE002A

SHA256:

F05D4664473DFD470990EE621B8925A4369F48734C40C137C5DBDCB4750447BA

SSDEEP:

98304:UgehVceK6Ed85csBTITTEkUYvFMbYluSB7dGH8BIDHcUIOXN14tnNCtdV0/qtLBg:V6jmxXh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • random.exe (PID: 7348)
      • svchost015.exe (PID: 7948)

    • GCLEANER has been detected (SURICATA)

      • svchost015.exe (PID: 7948)

    • GCLEANER has been detected (YARA)

      • svchost015.exe (PID: 7948)

    • Executing a file with an untrusted certificate

      • 6j7NYsukD.exe (PID: 4180)

  • SUSPICIOUS

    • Reads the BIOS version

      • random.exe (PID: 7348)

    • Executable content was dropped or overwritten

      • random.exe (PID: 7348)
      • svchost015.exe (PID: 7948)
      • W4RytQpro6O.exe (PID: 8124)
      • W4RytQpro6O.tmp (PID: 8144)
      • simatydatarecovery.exe (PID: 8172)

    • Reads security settings of Internet Explorer

      • svchost015.exe (PID: 7948)
      • simatydatarecovery.exe (PID: 8172)
      • 6j7NYsukD.exe (PID: 4180)

    • Connects to the server without a host name

      • svchost015.exe (PID: 7948)

    • Potential Corporate Privacy Violation

      • svchost015.exe (PID: 7948)

    • Reads the Windows owner or organization settings

      • W4RytQpro6O.tmp (PID: 8144)

    • Process drops legitimate windows executable

      • W4RytQpro6O.tmp (PID: 8144)

    • The process drops C-runtime libraries

      • W4RytQpro6O.tmp (PID: 8144)

    • Starts POWERSHELL.EXE for commands execution

      • simatydatarecovery.exe (PID: 8172)

    • Starts CMD.EXE for commands execution

      • 6j7NYsukD.exe (PID: 4180)
      • cmd.exe (PID: 5728)

    • Executing commands from a ".bat" file

      • 6j7NYsukD.exe (PID: 4180)

    • Application launched itself

      • cmd.exe (PID: 5728)

    • Get information on the list of running processes

      • cmd.exe (PID: 5728)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5728)

    • The executable file from the user directory is run by the CMD process

      • Vault.com (PID: 6620)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Vault.com (PID: 6620)

    • There is functionality for taking screenshot (YARA)

      • 6j7NYsukD.exe (PID: 4180)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 5728)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5728)

  • INFO

    • Themida protector has been detected

      • random.exe (PID: 7348)

    • Checks supported languages

      • random.exe (PID: 7348)
      • svchost015.exe (PID: 7948)
      • W4RytQpro6O.exe (PID: 8124)
      • W4RytQpro6O.tmp (PID: 8144)
      • simatydatarecovery.exe (PID: 8172)
      • 6j7NYsukD.exe (PID: 4180)
      • SXt17bEO2Svir.exe (PID: 2088)
      • extrac32.exe (PID: 7324)
      • Vault.com (PID: 6620)

    • Compiled with Borland Delphi (YARA)

      • random.exe (PID: 7348)
      • W4RytQpro6O.tmp (PID: 8144)

    • Reads the computer name

      • random.exe (PID: 7348)
      • svchost015.exe (PID: 7948)
      • W4RytQpro6O.tmp (PID: 8144)
      • simatydatarecovery.exe (PID: 8172)
      • 6j7NYsukD.exe (PID: 4180)
      • SXt17bEO2Svir.exe (PID: 2088)
      • extrac32.exe (PID: 7324)
      • Vault.com (PID: 6620)

    • The sample compiled with english language support

      • random.exe (PID: 7348)
      • W4RytQpro6O.tmp (PID: 8144)

    • Create files in a temporary directory

      • random.exe (PID: 7348)
      • W4RytQpro6O.tmp (PID: 8144)
      • W4RytQpro6O.exe (PID: 8124)
      • 6j7NYsukD.exe (PID: 4180)
      • extrac32.exe (PID: 7324)

    • Reads the machine GUID from the registry

      • svchost015.exe (PID: 7948)

    • Checks proxy server information

      • svchost015.exe (PID: 7948)

    • Creates files or folders in the user directory

      • svchost015.exe (PID: 7948)
      • W4RytQpro6O.tmp (PID: 8144)

    • Reads the software policy settings

      • svchost015.exe (PID: 7948)

    • Creates files in the program directory

      • simatydatarecovery.exe (PID: 8172)

    • Creates a software uninstall entry

      • W4RytQpro6O.tmp (PID: 8144)

    • Process checks computer location settings

      • simatydatarecovery.exe (PID: 8172)
      • 6j7NYsukD.exe (PID: 4180)

    • Changes the registry key values via Powershell

      • simatydatarecovery.exe (PID: 8172)

    • Creates a new folder

      • cmd.exe (PID: 5392)

    • Detects InnoSetup installer (YARA)

      • W4RytQpro6O.exe (PID: 8124)
      • W4RytQpro6O.tmp (PID: 8144)

    • Reads mouse settings

      • Vault.com (PID: 6620)

    • Manual execution by a user

      • SimatyDataRecovery.exe (PID: 4068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.6)
.exe | Win16/32 Executable Delphi generic (19.5)
.exe | Generic Win/DOS Executable (18.9)
.exe | DOS Executable Generic (18.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 815616
InitializedDataSize: 3698688
UninitializedDataSize: -
EntryPoint: 0x924000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.9.129
ProductVersionNumber: 1.2.9.129
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Greenshot
FileDescription: Greenshot
FileVersion: 1.2.9.129
InternalName: Greenshot.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
24
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #GENERIC random.exe #GCLEANER svchost015.exe w4rytqpro6o.exe w4rytqpro6o.tmp simatydatarecovery.exe powershell.exe no specs conhost.exe no specs 6j7nysukd.exe no specs cmd.exe no specs conhost.exe no specs sxt17beo2svir.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs vault.com choice.exe no specs slui.exe simatydatarecovery.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1276"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "dRecovery" -Value "C:\ProgramData\SimatyDataRecovery\SimatyDataRecovery.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—simatydatarecovery.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2088"C:\Users\admin\AppData\Roaming\9pR7TZ\SXt17bEO2Svir.exe"C:\Users\admin\AppData\Roaming\9pR7TZ\SXt17bEO2Svir.exe—svchost015.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Gcleanerapp
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\9pr7tz\sxt17beo2svir.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2136cmd /c copy /b 315472\Vault.com + Impressed + Oklahoma + Compliant + Encourages + Upgrades + Serum + Tn + Ownership + Fabrics + Innocent 315472\Vault.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2320cmd /c copy /b ..\Repository.wpd + ..\Jan.wpd + ..\Halifax.wpd + ..\Compound.wpd + ..\Trivia.wpd + ..\Evaluation.wpd + ..\Standards.wpd A C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3888findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4068C:\ProgramData\SimatyDataRecovery\SimatyDataRecovery.exeC:\ProgramData\SimatyDataRecovery\SimatyDataRecovery.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.6.7.5
Modules
Images
c:\programdata\simatydatarecovery\simatydatarecovery.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4180"C:\Users\admin\AppData\Roaming\PSAzuuOCb9\6j7NYsukD.exe"C:\Users\admin\AppData\Roaming\PSAzuuOCb9\6j7NYsukD.exe—svchost015.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\psazuuocb9\6j7nysukd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4652C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4696tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
7 317
Read events
7 300
Write events
17
Delete events
0

Modification events

(PID) Process:(7948) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7948) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7948) svchost015.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8144) W4RytQpro6O.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Simaty Data Recovery_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.0 (a)
(PID) Process:(8144) W4RytQpro6O.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Simaty Data Recovery_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local\Simaty Data Recovery 7.5
(PID) Process:(8144) W4RytQpro6O.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Simaty Data Recovery_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Simaty Data Recovery 7.5\
(PID) Process:(8144) W4RytQpro6O.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Simaty Data Recovery_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(8144) W4RytQpro6O.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Simaty Data Recovery_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(8144) W4RytQpro6O.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Simaty Data Recovery_is1
Operation:writeName:Inno Setup: Language
Value:
English
(PID) Process:(8144) W4RytQpro6O.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Simaty Data Recovery_is1
Operation:writeName:DisplayName
Value:
Simaty Data Recovery 7.5
Executable files
38
Suspicious files
34
Text files
8
Unknown types
1

Dropped files

PID
Process
Filename
Type
7948svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
7948svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:FB3C35AD7E59E5EC40C10524B85F04C4
SHA256:162F10E4124A82BA9BFCAB07BD53311A49BD3AD083F2CB6ADAD227BEE890929F
7948svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
7948svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800binary
MD5:4F262643EA0323E09B8B9DD47DE7E2C1
SHA256:0B86A4EDD9B70A127BED104271C69D1984B0334E17E4C1A83FA9A48E329C2590
7948svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\fuckingdllENCR[1].dllbinary
MD5:4BC1EF6688690AF3DD8D3D70906A9F98
SHA256:7703A6B77C0B0935F5900A2D846CFA3AB59B46D03A1A0844F6BCB5CF9496B2FE
7948svchost015.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800binary
MD5:605D30037EAA61274132FAB74BF82DB0
SHA256:08C5C7799F65DB5DBC3F046D1EFB6A0F7D13768D21299F8EDD6F0BA73D9B0CFF
7948svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\text[1]text
MD5:5E847B1CC501E8A09997640FED7DB52F
SHA256:C06903CB5A25E63794907092B488A8580074C872272A9FC51CEF5E76EEECF7A2
7948svchost015.exeC:\Users\admin\AppData\Roaming\5ME9vukNw7s\W4RytQpro6O.exeexecutable
MD5:B68B96B24AC651499C3FA53D82222469
SHA256:A787FBD735570B05C5C98AC7FA62AD39FC2CD1E795905A3950B0AA090B24EA95
7948svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\info[1].htmtext
MD5:FE9B08252F126DDFCB87FB82F9CC7677
SHA256:E63E7EBE4C2DB7E61FFC71AF0675E870BCDE0A9D8916E5B3BE0CB252478030BF
7948svchost015.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\ONE[1].fileexecutable
MD5:B68B96B24AC651499C3FA53D82222469
SHA256:A787FBD735570B05C5C98AC7FA62AD39FC2CD1E795905A3950B0AA090B24EA95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
33
DNS requests
20
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7972
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7972
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7948
svchost015.exe
GET
200
142.250.74.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
7948
svchost015.exe
GET
200
142.250.74.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7948
svchost015.exe
GET
200
142.250.74.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEDmdiANCnbVJCTfkel4NKS0%3D
unknown
—
—
whitelisted
7948
svchost015.exe
GET
200
185.156.72.196:80
http://185.156.72.196/success?substr=mixsix&s=three&sub=none
unknown
—
—
unknown
7948
svchost015.exe
GET
200
185.156.72.196:80
http://185.156.72.196/info
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2340
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.42
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.130
  • 40.126.31.128
  • 20.190.159.71
  • 40.126.31.69
  • 20.190.159.23
  • 40.126.31.129
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
drive.usercontent.google.com
  • 142.250.185.97
whitelisted
c.pki.goog
  • 142.250.74.195
whitelisted

Threats

PID
Process
Class
Message
7948
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
7948
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
7948
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
7948
svchost015.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7948
svchost015.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7948
svchost015.exe
Misc activity
ET INFO EXE - Served Attached HTTP
7948
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
7948
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
7948
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
7948
svchost015.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe