File name:

Mimic.zip

Full analysis: https://app.any.run/tasks/ac349666-1c7a-4c4a-b035-582282c0e72e
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: June 20, 2025, 07:35:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
mimic
arch-exec
ransomware
everything
tool
themida
rhadamanthys
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

9F06695474EF0C0824C770029B7E5B83

SHA1:

F44B96F0051443B95275A930937717B5F28724A3

SHA256:

0FBC2AEB40FB34194B3B68CE165EE2568A596B22227F6718B088A7B35D4CB16F

SSDEEP:

98304:4m1/VHuVOUHQ/hb88G+QqDj08SvsA8JrWiJs3XJOoS4k3Iyl+z61qesMcWIaoRbj:j3+lhuaYssyQ/aAswf6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6684)

    • MIMIC has been found (auto)

      • WinRAR.exe (PID: 6684)
      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Changes the autorun value in the registry

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)

    • MIMIC mutex has been found

      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 5060)
      • svcrhost.exe (PID: 1964)

    • Changes image file execution options

      • svcrhost.exe (PID: 5908)

    • Disables the Shutdown in the Start menu

      • svcrhost.exe (PID: 5908)

    • UAC/LUA settings modification

      • svcrhost.exe (PID: 5908)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5496)
      • powershell.exe (PID: 6160)
      • powershell.exe (PID: 3108)

    • Changes powershell execution policy (Bypass)

      • svcrhost.exe (PID: 5908)

    • Executing a file with an untrusted certificate

      • DC.exe (PID: 5520)
      • DC.exe (PID: 2996)
      • DC.exe (PID: 6256)

    • Known privilege escalation attack

      • dllhost.exe (PID: 6348)

    • Disables Windows Defender

      • DC.exe (PID: 5520)
      • DC.exe (PID: 2996)
      • DC.exe (PID: 6256)

    • MIMIC has been detected (YARA)

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 5060)
      • svcrhost.exe (PID: 6376)
      • svcrhost.exe (PID: 1964)

    • Creates or modifies Windows services

      • DC.exe (PID: 6256)

    • Starts CMD.EXE for self-deleting

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)

    • RHADAMANTHYS has been detected (YARA)

      • svcrhost.exe (PID: 5908)

    • Using BCDEDIT.EXE to modify recovery options

      • svcrhost.exe (PID: 5908)

    • Deletes shadow copies

      • svcrhost.exe (PID: 5908)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Reads the BIOS version

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 5060)
      • svcrhost.exe (PID: 6376)
      • svcrhost.exe (PID: 1964)

    • The process creates files with name similar to system file names

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Creates or modifies Windows services

      • svcrhost.exe (PID: 5908)

    • Starts CMD.EXE for commands execution

      • svcrhost.exe (PID: 5908)
      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Application launched itself

      • svcrhost.exe (PID: 5908)
      • DC.exe (PID: 5520)
      • DC.exe (PID: 2996)

    • Uses powercfg.exe to modify the power settings

      • svcrhost.exe (PID: 5908)

    • Starts POWERSHELL.EXE for commands execution

      • svcrhost.exe (PID: 5908)

    • The executable file from the user directory is run by the CMD process

      • DC.exe (PID: 5520)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 1284)

    • Creates file in the systems drive root

      • svcrhost.exe (PID: 5908)

    • Executing commands from a ".bat" file

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)

    • Sets range of bytes to zero

      • fsutil.exe (PID: 5732)
      • fsutil.exe (PID: 5004)

    • There is functionality for taking screenshot (YARA)

      • Everything.exe (PID: 6224)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4800)
      • wbengine.exe (PID: 3644)
      • vds.exe (PID: 5332)

    • Uses WEVTUTIL.EXE to cleanup log

      • svcrhost.exe (PID: 5908)

    • Start notepad (likely ransomware note)

      • svcrhost.exe (PID: 5908)

  • INFO

    • Checks supported languages

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 1964)
      • svcrhost.exe (PID: 6376)
      • svcrhost.exe (PID: 5060)
      • Everything.exe (PID: 6224)
      • DC.exe (PID: 5520)
      • ShellExperienceHost.exe (PID: 1284)
      • DC.exe (PID: 2996)
      • DC.exe (PID: 6256)
      • Everything.exe (PID: 6140)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6684)

    • Manual execution by a user

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • systray.exe (PID: 2464)
      • systray.exe (PID: 5600)
      • WINWORD.EXE (PID: 5316)

    • Creates files or folders in the user directory

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • Everything.exe (PID: 6224)
      • Everything.exe (PID: 6140)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 6348)
      • notepad.exe (PID: 432)

    • Reads the computer name

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 5060)
      • svcrhost.exe (PID: 1964)
      • Everything.exe (PID: 6224)
      • svcrhost.exe (PID: 6376)
      • ShellExperienceHost.exe (PID: 1284)
      • DC.exe (PID: 5520)
      • DC.exe (PID: 2996)
      • DC.exe (PID: 6256)
      • Everything.exe (PID: 6140)

    • The sample compiled with english language support

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Process checks whether UAC notifications are on

      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 5060)
      • svcrhost.exe (PID: 6376)
      • svcrhost.exe (PID: 1964)

    • EVERYTHING mutex has been found

      • Everything.exe (PID: 6224)
      • Everything.exe (PID: 6140)

    • Launching a file from a Registry key

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)

    • Reads the machine GUID from the registry

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Reads mouse settings

      • DC.exe (PID: 5520)
      • DC.exe (PID: 2996)
      • DC.exe (PID: 6256)

    • Create files in a temporary directory

      • DC.exe (PID: 5520)

    • Themida protector has been detected

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 6376)
      • svcrhost.exe (PID: 5060)
      • svcrhost.exe (PID: 1964)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6160)
      • powershell.exe (PID: 5496)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3108)

    • Checks proxy server information

      • slui.exe (PID: 1052)

    • Reads the software policy settings

      • slui.exe (PID: 1052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:06:20 06:30:56
ZipCRC: 0xa23e7d10
ZipCompressedSize: 7926636
ZipUncompressedSize: 7997456
ZipFileName: 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
255
Monitored processes
94
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #MIMIC winrar.exe #MIMIC 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe CMSTPLUA #MIMIC svcrhost.exe cmd.exe no specs #MIMIC svcrhost.exe no specs #MIMIC svcrhost.exe no specs #MIMIC svcrhost.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs everything.exe no specs dc.exe no specs shellexperiencehost.exe no specs systray.exe no specs dc.exe systray.exe no specs systray.exe no specs dc.exe no specs systray.exe no specs systray.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs slui.exe systray.exe no specs systray.exe no specs fsutil.exe no specs systray.exe no specs systray.exe no specs vssvc.exe no specs bcdedit.exe no specs bcdedit.exe no specs conhost.exe no specs conhost.exe no specs wbadmin.exe wbadmin.exe conhost.exe no specs conhost.exe no specs systray.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs everything.exe no specs notepad.exe no specs wevtutil.exe no specs wevtutil.exe no specs conhost.exe no specs wevtutil.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs fsutil.exe no specs winword.exe ai.exe no specs rundll32.exe no specs systray.exe no specs systray.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432bcdedit.exe /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\System32\bcdedit.exe—svcrhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
432notepad.exe "C:\Users\admin\AppData\Local\ILETISIM.txt"C:\Windows\SysWOW64\notepad.exe—svcrhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
984C:\WINDOWS\System32\Systray.exe "C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\System32\systray.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Systray .exe stub
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1052C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132C:\WINDOWS\System32\Systray.exe "C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\System32\systray.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Systray .exe stub
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1192C:\WINDOWS\System32\Systray.exe "C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\System32\systray.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Systray .exe stub
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1284"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
1336\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1816\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
31 598
Read events
31 146
Write events
406
Delete events
46

Modification events

(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Mimic.zip
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
10
Suspicious files
24
Text files
47
Unknown types
15

Dropped files

PID
Process
Filename
Type
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\Desktop\xdel.exeexecutable
MD5:803DF907D936E08FBBD06020C411BE93
SHA256:E8EAA39E2ADFD49AB69D7BB8504CCB82A902C8B48FBC256472F36F41775E594C
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\Desktop\Everything2.initext
MD5:51014C0C06ACDD80F9AE4469E7D30A9E
SHA256:89AD2164717BD5F5F93FBB4CEBF0EFEB473097408FDDFC7FC7B924D790514DC5
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\Desktop\Everything.initext
MD5:742C2400F2DE964D0CCE4A8DABADD708
SHA256:2FEFB69E4B2310BE5E09D329E8CF1BEBD1F9E18884C8C2A38AF8D7EA46BD5E01
6684WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6684.29508\10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeexecutable
MD5:DD9A743880F9A1D2FA90844304B73E5C
SHA256:10157499F507352E37A313393C24D5024123C5A4D557FC509094BAD4652DDC86
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\svcrhost.exeexecutable
MD5:DD9A743880F9A1D2FA90844304B73E5C
SHA256:10157499F507352E37A313393C24D5024123C5A4D557FC509094BAD4652DDC86
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\executivenumbers.rtftext
MD5:AAA1A62E22E6FA7DCC8FD954A79C86F1
SHA256:AA17A81A28C7043AD6923335D8FB3282E3C6DE467B9BF42B51A12B37822D7C87
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\Desktop\Everything32.dllexecutable
MD5:3B03324537327811BBBAFF4AAFA4D75B
SHA256:8CAE8A9740D466E17F16481E68DE9CBD58265863C3924D66596048EDFD87E880
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\headfi.pngimage
MD5:0D635B975C1C365510F1075BCDFFA985
SHA256:919AAB9A1978A11282278EBEA59E0756CE472FCA10CC4540027C2107BCACB36F
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\frenchcase.rtftext
MD5:36A16437DD8C0E646DFC0416F058D0CD
SHA256:9BFE44983E673F0D2AAEEB9914D614A4AAE54B800D6FDF934996E3445870C5D6
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\desktop.initext
MD5:9E36CC3537EE9EE1E3B10FA4E761045B
SHA256:4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
51
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4116
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
3908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5316
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5316
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4172
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4116
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4116
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.48.23.138:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.131
  • 40.126.31.67
  • 40.126.31.130
  • 40.126.31.71
  • 40.126.31.2
  • 20.190.159.130
  • 20.190.159.64
  • 40.126.32.72
  • 40.126.32.74
  • 20.190.160.5
  • 40.126.32.134
  • 20.190.160.2
  • 20.190.160.65
  • 20.190.160.3
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
crl.microsoft.com
  • 23.48.23.138
  • 23.48.23.169
  • 23.48.23.194
  • 23.48.23.173
  • 23.48.23.177
  • 23.48.23.156
  • 23.48.23.166
  • 23.48.23.161
  • 23.48.23.150
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
wbadmin.exe
Invalid parameter passed to C runtime function.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mimic.zip