File name:

070b84fb8a04aec06d06f4ecc9d1389f0f91c9720024e46373ff8287d0da1aaf.zip

Full analysis: https://app.any.run/tasks/0df5b130-fb48-47d4-9b29-6e56aa5e6a67
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 04:46:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

8896A4D9F026A07918B02A3DE8C4B5AD

SHA1:

9C2D4800F96D9999B10C893B4F2984AE12E8AD4A

SHA256:

070B84FB8A04AEC06D06F4ECC9D1389F0F91C9720024E46373FF8287D0DA1AAF

SSDEEP:

6144:mytnSZDeUfT4HONFdu1VNHufe1OzTEcuuK35Sk14GHiK2idu325kGTN5ZiTRzu:zSReO44uw2STxuu051GwJ2au31kWTxu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5156)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6240)

    • Actions looks like stealing of personal data

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 616)
      • cmd.exe (PID: 7280)
      • cmd.exe (PID: 7208)

    • Steals credentials from Web Browsers

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 616)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 1300)

    • Starts CMD.EXE for commands execution

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 1300)
      • Certificates Profile Details Of Our Company And About Us.exe (PID: 616)
      • WinRAR.exe (PID: 1628)

    • Application launched itself

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 1300)

    • Executes application which crashes

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 1300)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 1628)

    • Connects to SMTP port

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 616)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1628)

  • INFO

    • Manual execution by a user

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 1300)
      • WinRAR.exe (PID: 1628)

    • Create files in a temporary directory

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 1300)
      • MpCmdRun.exe (PID: 7484)

    • Reads the computer name

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 1300)
      • Certificates Profile Details Of Our Company And About Us.exe (PID: 616)
      • MpCmdRun.exe (PID: 7484)

    • Checks supported languages

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 1300)
      • Certificates Profile Details Of Our Company And About Us.exe (PID: 616)
      • MpCmdRun.exe (PID: 7484)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 4108)
      • BackgroundTransferHost.exe (PID: 7744)

    • Reads the machine GUID from the registry

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 616)

    • Reads the software policy settings

      • Certificates Profile Details Of Our Company And About Us.exe (PID: 616)
      • BackgroundTransferHost.exe (PID: 7744)
      • slui.exe (PID: 7244)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1628)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7744)
      • BackgroundTransferHost.exe (PID: 7536)
      • BackgroundTransferHost.exe (PID: 8116)
      • BackgroundTransferHost.exe (PID: 7544)
      • BackgroundTransferHost.exe (PID: 5360)
      • BackgroundTransferHost.exe (PID: 7856)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7744)
      • slui.exe (PID: 7244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2020:11:30 13:21:06
ZipCRC: 0x6fc98598
ZipCompressedSize: 239554
ZipUncompressedSize: 239494
ZipFileName: 19f70a4fcc1b074251dda867fe71873194814c8b7b16ecf864627c0494dc6251.7z
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
22
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe certificates profile details of our company and about us.exe cmd.exe no specs certificates profile details of our company and about us.exe conhost.exe no specs schtasks.exe no specs werfault.exe no specs cmd.exe conhost.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Users\admin\Desktop\Certificates Profile Details Of Our Company And About Us.exe"C:\Users\admin\Desktop\Certificates Profile Details Of Our Company And About Us.exe
Certificates Profile Details Of Our Company And About Us.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\certificates profile details of our company and about us.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1300"C:\Users\admin\Desktop\Certificates Profile Details Of Our Company And About Us.exe" C:\Users\admin\Desktop\Certificates Profile Details Of Our Company And About Us.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\certificates profile details of our company and about us.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
1628"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\19f70a4fcc1b074251dda867fe71873194814c8b7b16ecf864627c0494dc6251.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4108C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1300 -s 608C:\Windows\SysWOW64\WerFault.exe—Certificates Profile Details Of Our Company And About Us.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4892schtasks /Create /TN name /XML "C:\Users\admin\AppData\Local\Temp\7671a885cd75415abc923d7251839b5c.xml"C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5156"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\070b84fb8a04aec06d06f4ecc9d1389f0f91c9720024e46373ff8287d0da1aaf.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5360"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6240cmd /c schtasks /Create /TN name /XML "C:\Users\admin\AppData\Local\Temp\7671a885cd75415abc923d7251839b5c.xml"C:\Windows\SysWOW64\cmd.exe—Certificates Profile Details Of Our Company And About Us.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7208"cmd.exe" /C copy "C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\admin\AppData\Local\Temp\\yd6amqdx8j"C:\Windows\SysWOW64\cmd.exe
Certificates Profile Details Of Our Company And About Us.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
13 442
Read events
13 407
Write events
35
Delete events
0

Modification events

(PID) Process:(5156) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5156) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5156) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5156) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\070b84fb8a04aec06d06f4ecc9d1389f0f91c9720024e46373ff8287d0da1aaf.zip
(PID) Process:(5156) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5156) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5156) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5156) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
Executable files
2
Suspicious files
9
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
4108WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Certificates Pro_83859fe75d69350b542932339ad9935ef27657e_c5f560bf_6261948c-4d9a-44e0-83e2-9510882e8562\Report.wer —
MD5:—
SHA256:—
7744BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6dd63be0-19eb-4d0f-a3e4-11a49a720761.down_data —
MD5:—
SHA256:—
4108WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCF77.tmp.dmpbinary
MD5:2C5BF95990BFC96E325C7FCB1E12A2C3
SHA256:01759BD33AC8167A9E6A66FF2D39FB7C36469AD9258C842E5892CC063B734D39
4108WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD014.tmp.WERInternalMetadata.xmlbinary
MD5:C00F2B8E46B6A6AA86860BB901B4F10C
SHA256:414FC29A54EA342A221685F4B8FB9056C1F8411A934A4B0EAE961D6FF487A4ED
1300Certificates Profile Details Of Our Company And About Us.exeC:\Users\admin\AppData\Local\Temp\7671a885cd75415abc923d7251839b5c.xmlxml
MD5:50AFFCC7CAEF60E1A9741079B195C96B
SHA256:45241DD9261EF6CCE94914BE3D725E0905D89CC2AEDB7FA16D6D87912B9A8563
4108WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD063.tmp.xmlxml
MD5:E452DFBB773E5C6BC4DE3EA9F1DCD4F4
SHA256:F2CDC2C19D90133A0B88405FD6B7B3BF3C81BB87DA294760F7CB477AE3AABBC4
7484MpCmdRun.exeC:\Users\admin\AppData\Local\Temp\MpCmdRun.logbinary
MD5:D32D8808F33C792314565D59FD7BD530
SHA256:D8A7243749FE28B356C9A354384D6A4CB03BE96653FA8A13EC8A4983F1998A37
4108WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Certificates Profile Details Of Our Company And About Us.exe.1300.dmpbinary
MD5:28B9962CDE13D8B26EAB7DFBDAB17AA9
SHA256:B6D6DB7C18B66C6F00619E389142285C2CCA3CBD27E85FB2D05F62D129C24A10
7208cmd.exeC:\Users\admin\AppData\Local\Temp\yd6amqdx8jbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
1628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1628.34630\19f70a4fcc1b074251dda867fe71873194814c8b7b16ecf864627c0494dc6251.7z\Certificates Profile Details Of Our Company And About Us.exeexecutable
MD5:7D503B3BB2A1283996AB6D39272792BA
SHA256:C6E39969EFAB70E7374EE395B9B4DE9A960F13270A37AEB8A3ABFD341D1BFB4C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
57
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
POST
200
20.190.159.68:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
POST
400
40.126.31.3:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
—
—
whitelisted
—
—
POST
400
20.190.159.68:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
GET
200
20.31.169.57:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250325T044706Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5c54cef272b4447c8698b7824ea01284&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3968446&metered=false&nettype=ethernet&npid=sc-310091&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&rver=2&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1358976&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
4.23 Kb
whitelisted
—
—
POST
200
40.126.31.3:443
https://login.live.com/RST2.srf
unknown
xml
1.35 Kb
whitelisted
—
—
POST
400
20.190.159.129:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.69:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.3:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
20.198.162.76:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5720
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
616
Certificates Profile Details Of Our Company And About Us.exe
198.54.122.135:587
mail.privateemail.com
NAMECHEAP-NET
US
shared

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 2.16.164.120
  • 2.16.164.72
whitelisted
client.wns.windows.com
  • 20.198.162.76
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.3
  • 20.190.160.132
  • 40.126.32.138
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.128
  • 40.126.32.76
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
mail.privateemail.com
  • 198.54.122.135
shared
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
070b84fb8a04aec06d06f4ecc9d1389f0f91c9720024e46373ff8287d0da1aaf.zip