File name:

Mimic.zip

Full analysis: https://app.any.run/tasks/ac349666-1c7a-4c4a-b035-582282c0e72e
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: June 20, 2025, 07:35:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
mimic
arch-exec
ransomware
everything
tool
themida
rhadamanthys
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

9F06695474EF0C0824C770029B7E5B83

SHA1:

F44B96F0051443B95275A930937717B5F28724A3

SHA256:

0FBC2AEB40FB34194B3B68CE165EE2568A596B22227F6718B088A7B35D4CB16F

SSDEEP:

98304:4m1/VHuVOUHQ/hb88G+QqDj08SvsA8JrWiJs3XJOoS4k3Iyl+z61qesMcWIaoRbj:j3+lhuaYssyQ/aAswf6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6684)

    • MIMIC has been found (auto)

      • WinRAR.exe (PID: 6684)
      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Changes the autorun value in the registry

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)

    • Known privilege escalation attack

      • dllhost.exe (PID: 6348)

    • MIMIC mutex has been found

      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 5060)
      • svcrhost.exe (PID: 1964)

    • Changes image file execution options

      • svcrhost.exe (PID: 5908)

    • Disables the Shutdown in the Start menu

      • svcrhost.exe (PID: 5908)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5496)
      • powershell.exe (PID: 6160)
      • powershell.exe (PID: 3108)

    • Changes powershell execution policy (Bypass)

      • svcrhost.exe (PID: 5908)

    • Executing a file with an untrusted certificate

      • DC.exe (PID: 5520)
      • DC.exe (PID: 6256)
      • DC.exe (PID: 2996)

    • UAC/LUA settings modification

      • svcrhost.exe (PID: 5908)

    • Disables Windows Defender

      • DC.exe (PID: 5520)
      • DC.exe (PID: 2996)
      • DC.exe (PID: 6256)

    • Starts CMD.EXE for self-deleting

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)

    • RHADAMANTHYS has been detected (YARA)

      • svcrhost.exe (PID: 5908)

    • MIMIC has been detected (YARA)

      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 6376)
      • svcrhost.exe (PID: 1964)
      • svcrhost.exe (PID: 5060)
      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Creates or modifies Windows services

      • DC.exe (PID: 6256)

    • Using BCDEDIT.EXE to modify recovery options

      • svcrhost.exe (PID: 5908)

    • Deletes shadow copies

      • svcrhost.exe (PID: 5908)

  • SUSPICIOUS

    • Reads the BIOS version

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 5060)
      • svcrhost.exe (PID: 1964)
      • svcrhost.exe (PID: 6376)

    • The process creates files with name similar to system file names

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Executable content was dropped or overwritten

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Application launched itself

      • svcrhost.exe (PID: 5908)
      • DC.exe (PID: 5520)
      • DC.exe (PID: 2996)

    • Creates or modifies Windows services

      • svcrhost.exe (PID: 5908)

    • Uses powercfg.exe to modify the power settings

      • svcrhost.exe (PID: 5908)

    • Creates file in the systems drive root

      • svcrhost.exe (PID: 5908)

    • Starts CMD.EXE for commands execution

      • svcrhost.exe (PID: 5908)
      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Starts POWERSHELL.EXE for commands execution

      • svcrhost.exe (PID: 5908)

    • The executable file from the user directory is run by the CMD process

      • DC.exe (PID: 5520)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 1284)

    • Sets range of bytes to zero

      • fsutil.exe (PID: 5732)
      • fsutil.exe (PID: 5004)

    • Executing commands from a ".bat" file

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)

    • There is functionality for taking screenshot (YARA)

      • Everything.exe (PID: 6224)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4800)
      • wbengine.exe (PID: 3644)
      • vds.exe (PID: 5332)

    • Start notepad (likely ransomware note)

      • svcrhost.exe (PID: 5908)

    • Uses WEVTUTIL.EXE to cleanup log

      • svcrhost.exe (PID: 5908)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6684)

    • Checks supported languages

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 1964)
      • svcrhost.exe (PID: 6376)
      • svcrhost.exe (PID: 5060)
      • DC.exe (PID: 5520)
      • Everything.exe (PID: 6224)
      • ShellExperienceHost.exe (PID: 1284)
      • DC.exe (PID: 2996)
      • DC.exe (PID: 6256)
      • Everything.exe (PID: 6140)

    • Manual execution by a user

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • WINWORD.EXE (PID: 5316)
      • systray.exe (PID: 5600)
      • systray.exe (PID: 2464)

    • The sample compiled with english language support

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Reads the computer name

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 1964)
      • svcrhost.exe (PID: 5060)
      • Everything.exe (PID: 6224)
      • svcrhost.exe (PID: 6376)
      • DC.exe (PID: 5520)
      • DC.exe (PID: 2996)
      • ShellExperienceHost.exe (PID: 1284)
      • DC.exe (PID: 6256)
      • Everything.exe (PID: 6140)

    • Creates files or folders in the user directory

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • Everything.exe (PID: 6224)
      • Everything.exe (PID: 6140)

    • Launching a file from a Registry key

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)

    • Reads the machine GUID from the registry

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 6348)
      • notepad.exe (PID: 432)

    • Process checks whether UAC notifications are on

      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 6376)
      • svcrhost.exe (PID: 1964)
      • svcrhost.exe (PID: 5060)

    • EVERYTHING mutex has been found

      • Everything.exe (PID: 6224)
      • Everything.exe (PID: 6140)

    • Create files in a temporary directory

      • DC.exe (PID: 5520)

    • Reads mouse settings

      • DC.exe (PID: 5520)
      • DC.exe (PID: 2996)
      • DC.exe (PID: 6256)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6160)
      • powershell.exe (PID: 5496)

    • Themida protector has been detected

      • 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe (PID: 6852)
      • svcrhost.exe (PID: 5908)
      • svcrhost.exe (PID: 6376)
      • svcrhost.exe (PID: 1964)
      • svcrhost.exe (PID: 5060)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3108)

    • Reads the software policy settings

      • slui.exe (PID: 1052)

    • Checks proxy server information

      • slui.exe (PID: 1052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:06:20 06:30:56
ZipCRC: 0xa23e7d10
ZipCompressedSize: 7926636
ZipUncompressedSize: 7997456
ZipFileName: 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
255
Monitored processes
94
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #MIMIC winrar.exe #MIMIC 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exe CMSTPLUA #MIMIC svcrhost.exe cmd.exe no specs #MIMIC svcrhost.exe no specs #MIMIC svcrhost.exe no specs #MIMIC svcrhost.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs everything.exe no specs dc.exe no specs shellexperiencehost.exe no specs systray.exe no specs dc.exe systray.exe no specs systray.exe no specs dc.exe no specs systray.exe no specs systray.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs slui.exe systray.exe no specs systray.exe no specs fsutil.exe no specs systray.exe no specs systray.exe no specs vssvc.exe no specs bcdedit.exe no specs bcdedit.exe no specs conhost.exe no specs conhost.exe no specs wbadmin.exe wbadmin.exe conhost.exe no specs conhost.exe no specs systray.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs everything.exe no specs notepad.exe no specs wevtutil.exe no specs wevtutil.exe no specs conhost.exe no specs wevtutil.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs fsutil.exe no specs winword.exe ai.exe no specs rundll32.exe no specs systray.exe no specs systray.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432bcdedit.exe /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\System32\bcdedit.exe—svcrhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
432notepad.exe "C:\Users\admin\AppData\Local\ILETISIM.txt"C:\Windows\SysWOW64\notepad.exe—svcrhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
984C:\WINDOWS\System32\Systray.exe "C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\System32\systray.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Systray .exe stub
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1052C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132C:\WINDOWS\System32\Systray.exe "C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\System32\systray.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Systray .exe stub
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1192C:\WINDOWS\System32\Systray.exe "C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\System32\systray.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Systray .exe stub
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1284"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
1336\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1816\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
31 598
Read events
31 146
Write events
406
Delete events
46

Modification events

(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Mimic.zip
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
10
Suspicious files
24
Text files
47
Unknown types
15

Dropped files

PID
Process
Filename
Type
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\Desktop\Everything32.dllexecutable
MD5:3B03324537327811BBBAFF4AAFA4D75B
SHA256:8CAE8A9740D466E17F16481E68DE9CBD58265863C3924D66596048EDFD87E880
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\Desktop\Everything.initext
MD5:742C2400F2DE964D0CCE4A8DABADD708
SHA256:2FEFB69E4B2310BE5E09D329E8CF1BEBD1F9E18884C8C2A38AF8D7EA46BD5E01
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\Desktop\xdel.exeexecutable
MD5:803DF907D936E08FBBD06020C411BE93
SHA256:E8EAA39E2ADFD49AB69D7BB8504CCB82A902C8B48FBC256472F36F41775E594C
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\addedbattery.rtftext
MD5:693DF81724DBF5245F11625BEAD27F30
SHA256:0D7E83396E895D2AF93667A2474A9929316C728E575EA0A53D803EB512B21F8D
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\centredistance.rtftext
MD5:5C0E93CC9FB346337658A1C80420A0D6
SHA256:976A197707D257BEAD62BEB83E1C3403FAFE8F37876BF6BA388094B89C174286
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\DC.exeexecutable
MD5:AC34BA84A5054CD701EFAD5DD14645C9
SHA256:C576F7F55C4C0304B290B15E70A638B037DF15C69577CD6263329C73416E490E
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\desktop.initext
MD5:9E36CC3537EE9EE1E3B10FA4E761045B
SHA256:4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\Everything.exeexecutable
MD5:C44487CE1827CE26AC4699432D15B42A
SHA256:4C83E46A29106AFBAF5279029D102B489D958781764289B61AB5B618A4307405
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\Everything2.initext
MD5:51014C0C06ACDD80F9AE4469E7D30A9E
SHA256:89AD2164717BD5F5F93FBB4CEBF0EFEB473097408FDDFC7FC7B924D790514DC5
685210157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86.exeC:\Users\admin\AppData\Local\BEE4EF61-BB25-3430-8540-FB0596452070\Everything.initext
MD5:742C2400F2DE964D0CCE4A8DABADD708
SHA256:2FEFB69E4B2310BE5E09D329E8CF1BEBD1F9E18884C8C2A38AF8D7EA46BD5E01
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
51
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4116
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
3908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5316
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
5316
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4172
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4116
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4116
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.48.23.138:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.131
  • 40.126.31.67
  • 40.126.31.130
  • 40.126.31.71
  • 40.126.31.2
  • 20.190.159.130
  • 20.190.159.64
  • 40.126.32.72
  • 40.126.32.74
  • 20.190.160.5
  • 40.126.32.134
  • 20.190.160.2
  • 20.190.160.65
  • 20.190.160.3
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
crl.microsoft.com
  • 23.48.23.138
  • 23.48.23.169
  • 23.48.23.194
  • 23.48.23.173
  • 23.48.23.177
  • 23.48.23.156
  • 23.48.23.166
  • 23.48.23.161
  • 23.48.23.150
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
wbadmin.exe
Invalid parameter passed to C runtime function.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mimic.zip