File name:

Rubrik-Download-54FEJhTeNR5GpuQWW6Z5.zip

Full analysis: https://app.any.run/tasks/895b64d7-ee13-4ee0-99b4-a878c04e2ac4
Verdict: Malicious activity
Analysis date: March 21, 2025, 19:14:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
java
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

ECEB5DA2050E52CCE6C6DDA71FBEBF81

SHA1:

619E83D452B4789B4F4F766B3E43C793EABC116B

SHA256:

142FA0F7837572549F204B97A983502E9ABD90F3AA88623293993C465098E907

SSDEEP:

24576:P1MdozeT71wvzMbxkEfJm0Nqzq6Q4DAHLbxAkoARK0WuVPFY7/pLybJ9:P1MdozeT71wvzMbWEfJm0NqzqJ4DAHLL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4200)
      • jucheck.exe (PID: 4008)
      • jp2launcher.exe (PID: 1052)
      • jre-8u441-windows-au.exe (PID: 1272)

    • Checks for Java to be installed

      • jucheck.exe (PID: 4008)
      • jp2launcher.exe (PID: 1052)
      • jre-8u441-windows-au.exe (PID: 1272)

    • Reads Microsoft Outlook installation path

      • jucheck.exe (PID: 4008)
      • jre-8u441-windows-au.exe (PID: 1272)

    • Reads Internet Explorer settings

      • jucheck.exe (PID: 4008)
      • jre-8u441-windows-au.exe (PID: 1272)

    • Executable content was dropped or overwritten

      • jucheck.exe (PID: 4008)
      • jre-8u441-windows-au.exe (PID: 5008)

  • INFO

    • Create files in a temporary directory

      • jucheck.exe (PID: 4008)
      • jp2launcher.exe (PID: 1052)
      • jre-8u441-windows-au.exe (PID: 5008)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4200)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4200)
      • jucheck.exe (PID: 4008)
      • jre-8u441-windows-au.exe (PID: 5008)

    • JAVA mutex has been found

      • javaws.exe (PID: 3100)
      • jp2launcher.exe (PID: 1052)
      • jucheck.exe (PID: 4008)

    • Checks supported languages

      • jucheck.exe (PID: 4008)
      • jp2launcher.exe (PID: 1052)
      • javaws.exe (PID: 3100)
      • jre-8u441-windows-au.exe (PID: 5008)
      • jre-8u441-windows-au.exe (PID: 1272)

    • Reads the computer name

      • javaws.exe (PID: 3100)
      • jucheck.exe (PID: 4008)
      • jp2launcher.exe (PID: 1052)
      • jre-8u441-windows-au.exe (PID: 5008)
      • jre-8u441-windows-au.exe (PID: 1272)

    • Reads the machine GUID from the registry

      • jucheck.exe (PID: 4008)
      • jp2launcher.exe (PID: 1052)
      • jre-8u441-windows-au.exe (PID: 1272)

    • Creates files or folders in the user directory

      • jucheck.exe (PID: 4008)
      • jp2launcher.exe (PID: 1052)
      • jre-8u441-windows-au.exe (PID: 1272)

    • Checks proxy server information

      • jp2launcher.exe (PID: 1052)
      • jucheck.exe (PID: 4008)
      • jre-8u441-windows-au.exe (PID: 1272)
      • slui.exe (PID: 5756)

    • Reads the software policy settings

      • jucheck.exe (PID: 4008)
      • jre-8u441-windows-au.exe (PID: 1272)
      • slui.exe (PID: 6184)
      • slui.exe (PID: 5756)

    • Process checks computer location settings

      • jucheck.exe (PID: 4008)

    • Java executable

      • jre-8u441-windows-au.exe (PID: 5008)
      • jre-8u441-windows-au.exe (PID: 1272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x000d
ZipCompression: Deflated
ZipModifyDate: 2024:09:30 13:51:30
ZipCRC: 0xbc486144
ZipCompressedSize: 665185
ZipUncompressedSize: 1224792
ZipFileName: C_/Program Files (x86)/Common Files/Java/Java Update/jucheck.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
9
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe jucheck.exe javaws.exe no specs jp2launcher.exe jre-8u441-windows-au.exe jre-8u441-windows-au.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
720C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1052"C:\Program Files\Java\jre1.8.0_271\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_271" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjcxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjcxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzI3MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8yNzFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzI3MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjcxXGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8yNzFcYmluXGphdmF3LmV4ZQAtRGpubHB4LnZtYXJncz1MVVJxWkdzdVpHbHpZV0pzWlV4aGMzUlZjMkZuWlZSeVlXTnJhVzVuUFhSeWRXVUE= -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZhC:\Program Files\Java\jre1.8.0_271\bin\jp2launcher.exe
javaws.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Web Launcher
Exit code:
0
Version:
11.271.2.09
Modules
Images
c:\program files\java\jre1.8.0_271\bin\jp2launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1272"C:\Users\admin\AppData\Local\Temp\jds1129140.tmp\jre-8u441-windows-au.exe" "/installmethod=jau-m" "FAMILYUPGRADE=1"C:\Users\admin\AppData\Local\Temp\jds1129140.tmp\jre-8u441-windows-au.exe
jre-8u441-windows-au.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java Platform SE binary
Version:
8.0.4410.7
Modules
Images
c:\users\admin\appdata\local\temp\jds1129140.tmp\jre-8u441-windows-au.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
3100"C:\Program Files\Java\jre1.8.0_271\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdateC:\Program Files\Java\jre1.8.0_271\bin\javaws.exe—jucheck.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Web Start Launcher
Exit code:
0
Version:
11.271.2.09
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaws.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4008"C:\Users\admin\AppData\Local\Temp\Rar$EXb4200.31673\C_\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4200.31673\C_\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
WinRAR.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Update Checker
Exit code:
0
Version:
2.8.431.10
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb4200.31673\c_\program files (x86)\common files\java\java update\jucheck.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4200"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rubrik-Download-54FEJhTeNR5GpuQWW6Z5.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5008"C:\Users\admin\AppData\Local\Temp\jre-8u441-windows-au.exe" /installmethod=jau-m FAMILYUPGRADE=1 C:\Users\admin\AppData\Local\Temp\jre-8u441-windows-au.exe
jucheck.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java Platform SE binary
Version:
8.0.4410.7
Modules
Images
c:\users\admin\appdata\local\temp\jre-8u441-windows-au.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5756C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6184"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
14 364
Read events
14 127
Write events
202
Delete events
35

Modification events

(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Rubrik-Download-54FEJhTeNR5GpuQWW6Z5.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4008) jucheck.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:writeName:Method
Value:
jau-m
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
Executable files
6
Suspicious files
10
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
4008jucheck.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:E62F4FB3D77C8E85BDB7135043839445
SHA256:F1C62AFEC1061FFDE782E823AC492E13E37340C79E5CDDE8B0D4F89A8A77D96A
4200WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4200.31673\C_\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeexecutable
MD5:11B7ED0DE6B7FF2AD2773A3945D6D052
SHA256:8A285816ADA4F318AD2FC595ECAB08A2CEB8A5418DCAD3FADFAA84582AE8B47F
1052jp2launcher.exeC:\Users\admin\AppData\LocalLow\Sun\Java\Deployment\security\blacklisted.certstext
MD5:8273F70416F494F7FA5B6C70A101E00E
SHA256:583500B76965EB54B03493372989AB4D3426F85462D1DB232C5AE6706A4D6C58
4008jucheck.exeC:\Users\admin\AppData\Local\Temp\jusched.logtext
MD5:E91A0B6B5873DDA3B96C11A67B8B4CF0
SHA256:A25763EC71D681FC750E11E3498EFEB99173A502C3EED308826C2F122CBC61C0
4008jucheck.exeC:\Users\admin\AppData\Local\Temp\au-descriptor-1.8.0_441-b07.xmlxml
MD5:AA7101E77C83866CBC61A06A83BD7AA3
SHA256:FE43C0B927A1948EDAB455B09EBF32CBF4777570C14EFBFCAB60FA250E5ABB22
4008jucheck.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:80AEEB35EE78CE8437E937333F5E3F79
SHA256:016E9482BDA6F672CF98800F1E6B314FB7122D5735708A8FF05AF0E37A331E72
4008jucheck.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:BF48E6795D6A40BD58A848B615F17D21
SHA256:BC02B29CD8EEC61CA3CEC0F119D8C8D99AE7E0FFB769DC773CE132CE5EC4406F
4008jucheck.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBDbinary
MD5:017EBDB0B256D18E401CC54BBD51CA79
SHA256:3C2A9AD91F356DFC7D76D0414C885A76F04BEE42CBF65B33145CFE264587ACD0
4008jucheck.exeC:\Users\admin\AppData\Local\Temp\jds1126968.tmpexecutable
MD5:780728A0345897E83148EB8568861656
SHA256:1575DDBCC2EC95CE3647CFEFC68D5AE03C623B54612B06CCF9C3AA3C7662ABED
4008jucheck.exeC:\Users\admin\AppData\Local\Temp\jre-8u441-windows-au.exeexecutable
MD5:780728A0345897E83148EB8568861656
SHA256:1575DDBCC2EC95CE3647CFEFC68D5AE03C623B54612B06CCF9C3AA3C7662ABED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
32
DNS requests
19
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4980
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4008
jucheck.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
5756
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1052
jp2launcher.exe
POST
200
2.17.190.73:80
http://ocsp.digicert.com/
unknown
—
—
whitelisted
1052
jp2launcher.exe
POST
200
2.17.190.73:80
http://ocsp.digicert.com/
unknown
—
—
whitelisted
1052
jp2launcher.exe
POST
200
2.17.190.73:80
http://ocsp.digicert.com/
unknown
—
—
whitelisted
5756
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1052
jp2launcher.exe
POST
200
2.17.190.73:80
http://ocsp.digicert.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4980
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
client.wns.windows.com
  • 20.197.71.89
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.128
  • 20.190.159.2
  • 40.126.31.131
  • 40.126.31.130
  • 40.126.31.0
  • 40.126.31.3
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
javadl-esd-secure.oracle.com
  • 104.73.239.136
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
1052
jp2launcher.exe
Potentially Bad Traffic
ET INFO Vulnerable Java Version 1.8.x Detected
1052
jp2launcher.exe
Potentially Bad Traffic
ET INFO Vulnerable Java Version 1.8.x Detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Rubrik-Download-54FEJhTeNR5GpuQWW6Z5.zip