File name:

SecuriteInfo.com.Win32.Evo-gen.20014.21640

Full analysis: https://app.any.run/tasks/c7c73f8c-23a4-467b-83b1-a768c8b2b3d5
Verdict: Malicious activity
Analysis date: May 10, 2025, 09:11:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
susp-powershell
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

997E67980C344C260A6CF77DA90A2B39

SHA1:

5743166C9C72D6C3F9E19D066E07E54E016F2222

SHA256:

F258F660F30A7F9669B025D9C2D5663F16C576A03F48E6FC169AF692D43336C3

SSDEEP:

48:YhXSHP3bUHkkY4444444aMcmMtjK7vvqNi3OeqmfH1cRqmOegp9tx5Pjvhvrrrab:igbf1lM7qNcObaV9Ii9txoEd3ojZlrl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • explorer.exe (PID: 5492)

    • Changes Windows Defender settings

      • explorer.exe (PID: 5492)

    • Executing a file with an untrusted certificate

      • win32.exe (PID: 4452)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 2284)

    • Application was injected by another process

      • svchost.exe (PID: 1260)
      • svchost.exe (PID: 468)
      • svchost.exe (PID: 1252)
      • svchost.exe (PID: 1044)
      • svchost.exe (PID: 1652)
      • svchost.exe (PID: 1552)
      • svchost.exe (PID: 1288)
      • svchost.exe (PID: 1352)
      • svchost.exe (PID: 1524)
      • svchost.exe (PID: 1444)
      • svchost.exe (PID: 1988)
      • svchost.exe (PID: 1416)
      • svchost.exe (PID: 1980)
      • svchost.exe (PID: 1772)
      • svchost.exe (PID: 1784)
      • svchost.exe (PID: 1792)
      • svchost.exe (PID: 1892)
      • lsass.exe (PID: 756)
      • svchost.exe (PID: 1232)
      • svchost.exe (PID: 2448)
      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 2068)
      • svchost.exe (PID: 2396)
      • svchost.exe (PID: 2292)
      • svchost.exe (PID: 2544)
      • svchost.exe (PID: 2172)
      • svchost.exe (PID: 2536)
      • dasHost.exe (PID: 3012)
      • svchost.exe (PID: 2624)
      • svchost.exe (PID: 2584)
      • svchost.exe (PID: 2776)
      • spoolsv.exe (PID: 2732)
      • svchost.exe (PID: 2880)
      • svchost.exe (PID: 2932)
      • svchost.exe (PID: 3084)
      • OfficeClickToRun.exe (PID: 3112)
      • svchost.exe (PID: 3184)
      • svchost.exe (PID: 1904)
      • svchost.exe (PID: 3104)
      • svchost.exe (PID: 4292)
      • svchost.exe (PID: 3196)
      • svchost.exe (PID: 3812)
      • svchost.exe (PID: 3564)
      • svchost.exe (PID: 4312)
      • svchost.exe (PID: 3232)
      • svchost.exe (PID: 3284)
      • svchost.exe (PID: 1572)
      • svchost.exe (PID: 860)
      • svchost.exe (PID: 3860)
      • svchost.exe (PID: 2996)
      • svchost.exe (PID: 4508)
      • dllhost.exe (PID: 5880)
      • svchost.exe (PID: 2920)
      • svchost.exe (PID: 3216)
      • winlogon.exe (PID: 6648)
      • uhssvc.exe (PID: 648)
      • dwm.exe (PID: 6568)
      • explorer.exe (PID: 5492)
      • svchost.exe (PID: 4544)
      • MoUsoCoreWorker.exe (PID: 5496)
      • svchost.exe (PID: 2112)
      • svchost.exe (PID: 6024)
      • svchost.exe (PID: 1684)
      • sihost.exe (PID: 4984)
      • svchost.exe (PID: 4952)
      • RuntimeBroker.exe (PID: 6160)
      • ctfmon.exe (PID: 956)
      • RuntimeBroker.exe (PID: 1036)
      • svchost.exe (PID: 4916)
      • svchost.exe (PID: 6544)
      • dllhost.exe (PID: 6176)
      • UserOOBEBroker.exe (PID: 1248)
      • ApplicationFrameHost.exe (PID: 6952)
      • svchost.exe (PID: 6180)
      • svchost.exe (PID: 6344)
      • svchost.exe (PID: 4284)
      • dllhost.exe (PID: 6896)
      • svchost.exe (PID: 6608)
      • RuntimeBroker.exe (PID: 5368)
      • svchost.exe (PID: 4684)
      • svchost.exe (PID: 4348)
      • svchost.exe (PID: 5132)
      • RuntimeBroker.exe (PID: 3032)
      • audiodg.exe (PID: 6168)
      • WmiPrvSE.exe (PID: 6268)
      • svchost.exe (PID: 3140)
      • WmiPrvSE.exe (PID: 4380)

    • Uses Task Scheduler to run other applications

      • explorer.exe (PID: 5492)

    • Runs injected code in another process

      • dialer.exe (PID: 5376)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Starts POWERSHELL.EXE for commands execution

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)
      • explorer.exe (PID: 5492)

    • BASE64 encoded PowerShell command has been detected

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Base64-obfuscated command line is found

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Manipulates environment variables

      • powershell.exe (PID: 7084)

    • Script adds exclusion path to Windows Defender

      • explorer.exe (PID: 5492)

    • Adds/modifies Windows certificates

      • lsass.exe (PID: 756)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2284)
      • win32.exe (PID: 4452)

    • Stops a currently running service

      • sc.exe (PID: 5260)
      • sc.exe (PID: 1040)
      • sc.exe (PID: 2644)
      • sc.exe (PID: 5400)
      • sc.exe (PID: 6468)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 5492)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1116)

    • Modifies hosts file to alter network resolution

      • win32.exe (PID: 4452)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 4000)

  • INFO

    • Checks supported languages

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)
      • win32.exe (PID: 4452)
      • uhssvc.exe (PID: 648)

    • Reads the computer name

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Process checks computer location settings

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Reads the time zone

      • MoUsoCoreWorker.exe (PID: 5496)
      • WmiPrvSE.exe (PID: 6268)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)

    • Creates files in the program directory

      • MoUsoCoreWorker.exe (PID: 5496)
      • win32.exe (PID: 4452)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2284)
      • powershell.exe (PID: 7084)

    • Disables trace logs

      • powershell.exe (PID: 2284)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • powershell.exe (PID: 2284)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2284)
      • powershell.exe (PID: 7084)

    • Checks proxy server information

      • powershell.exe (PID: 2284)
      • slui.exe (PID: 496)

    • Reads the software policy settings

      • lsass.exe (PID: 756)
      • slui.exe (PID: 1280)
      • slui.exe (PID: 496)

    • The executable file from the user directory is run by the Powershell process

      • win32.exe (PID: 4452)

    • Manual execution by a user

      • cmd.exe (PID: 1116)
      • dialer.exe (PID: 5376)
      • schtasks.exe (PID: 4000)
      • schtasks.exe (PID: 720)
      • powershell.exe (PID: 7084)
      • cmd.exe (PID: 5136)

    • Create files in a temporary directory

      • win32.exe (PID: 4452)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3112)

    • Creates files or folders in the user directory

      • lsass.exe (PID: 756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (61.6)
.dll | Win32 Dynamic Link Library (generic) (14.6)
.exe | Win32 Executable (generic) (10)
.exe | Win16/32 Executable Delphi generic (4.6)
.exe | Generic Win/DOS Executable (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 1024
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0x1159
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
112
Malicious processes
6
Suspicious processes
86

Behavior graph

Click at the process to see the details
start securiteinfo.com.win32.evo-gen.20014.21640.exe powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe wmiprvse.exe win32.exe wmiprvse.exe powershell.exe conhost.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs dialer.exe schtasks.exe conhost.exe no specs schtasks.exe conhost.exe no specs cmd.exe conhost.exe no specs choice.exe no specs slui.exe svchost.exe uhssvc.exe lsass.exe svchost.exe ctfmon.exe runtimebroker.exe svchost.exe svchost.exe useroobebroker.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe spoolsv.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe dashost.exe runtimebroker.exe svchost.exe svchost.exe officeclicktorun.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe sihost.exe svchost.exe runtimebroker.exe explorer.exe mousocoreworker.exe dllhost.exe securiteinfo.com.win32.evo-gen.20014.21640.exe no specs svchost.exe runtimebroker.exe audiodg.exe dllhost.exe svchost.exe svchost.exe svchost.exe dwm.exe svchost.exe winlogon.exe dllhost.exe applicationframehost.exe

Process information

PID
CMD
Path
Indicators
Parent process
468C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSMC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\lsm.dll
c:\windows\system32\msvcrt.dll
496C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
648"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Update Health Service
Version:
10.0.19041.3626 (WinBuild.160101.0800)
Modules
Images
c:\program files\microsoft update health tools\uhssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
720C:\WINDOWS\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\admin\AppData\Local\Temp\ysffqgghpxdj.xml"C:\Windows\System32\schtasks.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
756C:\WINDOWS\system32\lsass.exeC:\Windows\System32\lsass.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Local Security Authority Process
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lsasrv.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\sechost.dll
860C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvcC:\Windows\System32\svchost.exe
services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
956"ctfmon.exe"C:\Windows\System32\ctfmon.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CTF Loader
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1036C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1040sc stop UsoSvc C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1044C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s gpsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
23 707
Read events
23 390
Write events
210
Delete events
107

Modification events

(PID) Process:(5496) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator
Operation:delete valueName:EnhancedShutdownEnabled
Value:
(PID) Process:(5496) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator
Operation:writeName:ShutdownFlyoutOptions
Value:
0
(PID) Process:(2112) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator
Operation:writeName:Preshutdown
Value:
0
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator
Operation:writeName:SD
Value:
0100049C5C000000680000000000000014000000020048000300000000001400FF011F0001010000000000051200000000001400A900120001010000000000051300000000001800A900120001020000000000052000000020020000010100000000000512000000010100000000000512000000
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Operation:writeName:Index
Value:
3
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:writeName:Hash
Value:
3B6EE4045D97AA11A9FAE50DB375B526D55466B9856CF232E0B3DDF845CC6602
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:writeName:Schema
Value:
65538
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:delete valueName:Version
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:delete valueName:Date
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:writeName:SecurityDescriptor
Value:
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
Executable files
3
Suspicious files
36
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Workxml
MD5:5FADF13CCFBDCC5DD728380F7A615B28
SHA256:FF1F73395F6B5B22D5FDA367521FE0DCC31FF252849B7FA85FA346B953A40451
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Workxml
MD5:4838EE953DAB2C7A1BF57E0C6620A79D
SHA256:22C798E00C4793749EAC39CFB6EA3DD75112FD4453A3706E839038A64504D45D
1772svchost.exeC:\Windows\Prefetch\CONSENT.EXE-531BD9EA.pfbinary
MD5:A08B60FE992F4DEA896903E855E7A3E5
SHA256:3222DA1B6E30BAD0DEDEEE91052895F56333845FABE8F0BAC7DDD73B6BC8F5B6
1772svchost.exeC:\Windows\Prefetch\SVCHOST.EXE-2E4E3AC7.pfbinary
MD5:F8A86E1ABDB3662C107F556F1AA7B4A9
SHA256:A09136AD3E91D9662FEF75DAB38D78E6231508CE4D13E776FBEB65F73FAF7A00
2920svchost.exeC:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb —
MD5:—
SHA256:—
1772svchost.exeC:\Windows\Prefetch\SECURITEINFO.COM.WIN32.EVO-GE-3F7DED9F.pfbinary
MD5:0985CA9EDFB154E981C0AFA4B64E3A1F
SHA256:CAF1FCB6823F1F148D6A49B801467000AB8ABCF67D6D452470886BDDA4A062F4
6896dllhost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\V01.chkbinary
MD5:E313E6FAE3209AADA08F9555EC656479
SHA256:A7C3F81F6A785EDAD90CA02F02D7FBCBBCCC711A00F924D1AA8ED18284CF7F87
1772svchost.exeC:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pfbinary
MD5:2BA40EBE64A9DBC6E2BEF55A6F43B3E9
SHA256:86002D01BE623553E4C11CBF362E9F5958DCBF65CC2A74C2B461768FF55195D0
1772svchost.exeC:\Windows\Prefetch\HOST.EXE-F5D74C61.pfbinary
MD5:BCAD82FAD05EC33A0690829AFBA58378
SHA256:FDB0469F4ADCF206746F1F533D22D35B8E352746C68319BC4A1C9D2A15A8F50B
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Workxml
MD5:C6086D02F8CE044F5FA07A98303DC7EB
SHA256:8901D9C9AEA465DA4EA7AA874610A90B8CF0A71EBA0E321CF9675FCEEE0B54A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2284
powershell.exe
140.82.121.3:443
github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.14
  • 20.190.160.131
  • 20.190.160.4
  • 20.190.160.67
  • 20.190.160.22
  • 40.126.32.134
  • 40.126.31.128
  • 20.190.159.131
  • 40.126.31.73
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.73
  • 20.190.159.71
  • 20.190.159.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
github.com
  • 140.82.121.3
whitelisted
objects.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Win32.Evo-gen.20014.21640