File name:

AutoHotkey_2.0.19_setup.exe

Full analysis: https://app.any.run/tasks/ce08e50f-1032-41f7-b122-c251f3e7cbf4
Verdict: Malicious activity
Analysis date: June 21, 2025, 17:46:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

34979CF8AB65E09D738FD6B95365CEFB

SHA1:

0AFD36786EEB45BBE7DB1CF2A6D2251C10DA303C

SHA256:

FD55129CBD356F49D2151E0A8B9662D90D2DBBB9579CC2410FDE38DF94787A3A

SSDEEP:

98304:/Rv3DwxUAtz2eVhxkk/7wIvycwI0mm/H7Krd6dV9zXv8E2d4J1KD3B+yfaXDFcd2:WmxZCp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • AutoHotkey_2.0.19_setup.exe (PID: 3864)
      • AutoHotkey_2.0.19_setup.exe (PID: 3108)

    • Application launched itself

      • AutoHotkey_2.0.19_setup.exe (PID: 3864)

    • Executable content was dropped or overwritten

      • AutoHotkey_2.0.19_setup.exe (PID: 3108)

    • Creates a software uninstall entry

      • AutoHotkey_2.0.19_setup.exe (PID: 3108)

    • Adds/modifies Windows certificates

      • AutoHotkey_2.0.19_setup.exe (PID: 3108)

    • Starts itself from another location

      • AutoHotkeyUX.exe (PID: 1752)
      • AutoHotkeyUX.exe (PID: 2808)
      • AutoHotkeyUX.exe (PID: 4372)
      • AutoHotkeyUX.exe (PID: 1688)

    • There is functionality for taking screenshot (YARA)

      • AutoHotkeyUX.exe (PID: 3688)

    • Creates file in the systems drive root

      • explorer.exe (PID: 2188)

  • INFO

    • The sample compiled with english language support

      • AutoHotkey_2.0.19_setup.exe (PID: 3864)
      • AutoHotkey_2.0.19_setup.exe (PID: 3108)

    • Reads the computer name

      • AutoHotkey_2.0.19_setup.exe (PID: 3864)
      • AutoHotkey_2.0.19_setup.exe (PID: 3108)
      • AutoHotkeyUX.exe (PID: 3688)
      • AutoHotkeyUX.exe (PID: 3048)

    • Process checks computer location settings

      • AutoHotkey_2.0.19_setup.exe (PID: 3864)
      • SearchApp.exe (PID: 5328)

    • Checks supported languages

      • AutoHotkey_2.0.19_setup.exe (PID: 3864)
      • AutoHotkey_2.0.19_setup.exe (PID: 3108)
      • AutoHotkeyUX.exe (PID: 3668)
      • AutoHotkeyUX.exe (PID: 3688)
      • AutoHotkeyUX.exe (PID: 2808)
      • AutoHotkey64.exe (PID: 7060)
      • AutoHotkeyUX.exe (PID: 1752)
      • AutoHotkey64.exe (PID: 4040)
      • AutoHotkey64.exe (PID: 5348)
      • AutoHotkeyUX.exe (PID: 4372)
      • SearchApp.exe (PID: 5328)
      • AutoHotkey64.exe (PID: 6636)
      • AutoHotkeyUX.exe (PID: 3048)
      • AutoHotkeyUX.exe (PID: 1688)

    • Creates files in the program directory

      • AutoHotkey_2.0.19_setup.exe (PID: 3108)

    • AutoHotkey executable

      • AutoHotkey_2.0.19_setup.exe (PID: 3864)
      • AutoHotkey_2.0.19_setup.exe (PID: 3108)
      • AutoHotkeyUX.exe (PID: 2808)
      • explorer.exe (PID: 2188)
      • AutoHotkeyUX.exe (PID: 1752)
      • AutoHotkeyUX.exe (PID: 4372)
      • AutoHotkeyUX.exe (PID: 1688)

    • Reads the machine GUID from the registry

      • AutoHotkey_2.0.19_setup.exe (PID: 3108)
      • SearchApp.exe (PID: 5328)

    • Creates files or folders in the user directory

      • AutoHotkey_2.0.19_setup.exe (PID: 3108)

    • Reads the software policy settings

      • AutoHotkey_2.0.19_setup.exe (PID: 3108)
      • SearchApp.exe (PID: 5328)

    • Manual execution by a user

      • AutoHotkeyUX.exe (PID: 3688)
      • AutoHotkeyUX.exe (PID: 3048)

    • Detects AutoHotkey samples (YARA)

      • AutoHotkeyUX.exe (PID: 3688)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 2188)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 2188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:25 08:00:28+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 2994176
InitializedDataSize: 40960
UninitializedDataSize: 2527232
EntryPoint: 0x544000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.19.0
ProductVersionNumber: 2.0.19.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: AutoHotkey installer
FileVersion: 2.0.19
ProductName: AutoHotkey Setup
ProductVersion: 2.0.19
InternalName: AutoHotkey Setup
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
18
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start autohotkey_2.0.19_setup.exe no specs autohotkey_2.0.19_setup.exe autohotkeyux.exe no specs autohotkeyux.exe no specs explorer.exe no specs explorer.exe no specs rundll32.exe no specs autohotkeyux.exe no specs autohotkey64.exe no specs autohotkeyux.exe no specs autohotkey64.exe no specs autohotkeyux.exe no specs autohotkey64.exe no specs autohotkeyux.exe autohotkey64.exe no specs autohotkeyux.exe slui.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
1688"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\launcher.ahk" "C:\Users\admin\Documents\AutoHotkey\fwaf.ahk" C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe—explorer.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
MEDIUM
Description:
AutoHotkey 64-bit
Exit code:
259
Version:
2.0.19
Modules
Images
c:\program files\autohotkey\ux\autohotkeyux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\user32.dll
c:\windows\system32\winmm.dll
1752"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\launcher.ahk" "C:\Users\admin\Documents\AutoHotkey\fwaf.ahk" C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe—explorer.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
MEDIUM
Description:
AutoHotkey 64-bit
Exit code:
259
Version:
2.0.19
Modules
Images
c:\program files\autohotkey\ux\autohotkeyux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\user32.dll
c:\windows\system32\ws2_32.dll
2132explorer /select,"C:\Users\admin\Documents\AutoHotkey\fwaf.ahk"C:\Windows\explorer.exe—AutoHotkeyUX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
2188C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\aepic.dll
2620C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2760C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2808"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\launcher.ahk" "C:\Users\admin\Documents\AutoHotkey\fwaf.ahk" C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe—explorer.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
MEDIUM
Description:
AutoHotkey 64-bit
Exit code:
259
Version:
2.0.19
Modules
Images
c:\program files\autohotkey\ux\autohotkeyux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\user32.dll
3048"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\ui-dash.ahk"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
explorer.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
HIGH
Description:
AutoHotkey 64-bit
Version:
2.0.19
Modules
Images
c:\program files\autohotkey\ux\autohotkeyux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\winmm.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
3108"C:\Users\admin\AppData\Local\Temp\AutoHotkey_2.0.19_setup.exe" /to "C:\Program Files\AutoHotkey"C:\Users\admin\AppData\Local\Temp\AutoHotkey_2.0.19_setup.exe
AutoHotkey_2.0.19_setup.exe
User:
admin
Integrity Level:
HIGH
Description:
AutoHotkey installer
Exit code:
0
Version:
2.0.19
Modules
Images
c:\users\admin\appdata\local\temp\autohotkey_2.0.19_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3668"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\reset-assoc.ahk" /checkC:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe—AutoHotkey_2.0.19_setup.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
HIGH
Description:
AutoHotkey 64-bit
Exit code:
0
Version:
2.0.19
Modules
Images
c:\program files\autohotkey\ux\autohotkeyux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
Total events
27 362
Read events
27 235
Write events
113
Delete events
14

Modification events

(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:DisplayName
Value:
AutoHotkey
(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:UninstallString
Value:
"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\ui-uninstall.ahk"
(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\install.ahk" /uninstall /silent
(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:NoModify
Value:
1
(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:DisplayIcon
Value:
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:DisplayVersion
Value:
2.0.19
(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:URLInfoAbout
Value:
https://autohotkey.com
(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:Publisher
Value:
AutoHotkey Foundation LLC
(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:InstallLocation
Value:
C:\Program Files\AutoHotkey
(PID) Process:(3108) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AutoHotkey
Operation:writeName:InstallDir
Value:
C:\Program Files\AutoHotkey
Executable files
13
Suspicious files
13
Text files
71
Unknown types
0

Dropped files

PID
Process
Filename
Type
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\license.txttext
MD5:E3F2AD7733F3166FE770E4DC00AF6C45
SHA256:B27C1A7C92686E47F8740850AD24877A50BE23FD3DBD44EDEE50AC1223135E38
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\ui-uninstall.ahktext
MD5:0FE4932669E99A498A7BC76975919000
SHA256:1E09FC4AF5DC3E673D4FACFE4FA849C6BDD0B29C67B0EFD7F96AAF387FCEF698
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\reset-assoc.ahktext
MD5:0299132478B49E3EB706C214BF32E62F
SHA256:D26CAEF44190E0B612C3E4309FF6689DC2953C72CB3DE1C94D002250B089F16B
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\ui-newscript.ahktext
MD5:1B88198B4BD36EB25E23DC412321A555
SHA256:31249EF15CCE83D150A9A5DE11168A5052FF2C55DBD574B8DF1C054510B61843
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\ui-editor.ahktext
MD5:82EB574294FF4E2E7461B95F5BAD0A87
SHA256:7263286EB3A42ECCF5EDC39B43C74A8BF7C82F2671204D1AE654236C1DE3F05D
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\WindowSpy.ahktext
MD5:E2067D978526B83A1DA967F16A69C125
SHA256:040404A4DEF02F17CDAFDA938F5B63FC2181940BA1290DA5742DB0862C07166E
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\inc\bounce-v1.ahktext
MD5:165B8FC572F943E3665994F87F1772B7
SHA256:9B75C7F804D1D55807459E6F06DB2BEE8E1FB60CE9C9340D44A7B491CE53B982
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\install-version.ahktext
MD5:30B87FBFADC592C38BE9D82EDF597FA3
SHA256:1E59921BCDDB3C41651EB01605CDEFCDEE3C6ADEC5DB6B7CAFB7AB801EAD5E1E
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\AutoHotkey64.exeexecutable
MD5:38746D44ECA1F41D1F8E16746EB182F5
SHA256:3880F9EC464DFE78C16BBD8B9F30560227154C292280337346A30C8FD92871FE
3108AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\AutoHotkey.chmbinary
MD5:57BB054E56EB6FA154F5BCA6AFFA656A
SHA256:33D035BBC23CE61FA83E13DA126D17D3EB48ED210CA59E4F4BAB46F1BE3654C7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
28
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
728
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
728
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5328
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4944
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5328
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5900
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
728
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
www.bing.com
  • 92.123.104.38
  • 92.123.104.33
  • 92.123.104.34
  • 92.123.104.59
  • 92.123.104.52
  • 92.123.104.32
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.2
  • 40.126.31.131
  • 20.190.159.71
  • 20.190.159.130
  • 40.126.31.73
  • 20.190.159.23
  • 40.126.31.128
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AutoHotkey_2.0.19_setup.exe