download:

/aZz85975-PPPwnGUI1.zip

Full analysis: https://app.any.run/tasks/7789b0e4-1bf1-4a70-b72d-50deaf0a7fd2
Verdict: Malicious activity
Analysis date: March 28, 2025, 15:54:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

40361B86AB88202C0A4B8FC9CCA02B8E

SHA1:

F46487D8A1C1504F1CB125546BD8C8476367D474

SHA256:

1B120DB91276268A5629905DF45FA12E8DADA0F0BEC801676C950B177FF59AB3

SSDEEP:

98304:hFYAsoIFSe068mMtc1N7slkjcRZ6q0zmh6G7TRHryNWvv7iiSZJ+gH3yJmyX+hoe:S0x+QFImeVBbn1CjqLjN8UBZV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5164)
      • powershell.exe (PID: 7632)
      • powershell.exe (PID: 7856)
      • powershell.exe (PID: 5436)
      • powershell.exe (PID: 6476)
      • powershell.exe (PID: 5576)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Install First.exe (PID: 8132)
      • NPFInstall.exe (PID: 1272)
      • drvinst.exe (PID: 1616)
      • PPPwn GUI 1.9.3.exe (PID: 7600)

    • The process hide an interactive prompt from the user

      • Install First.exe (PID: 8132)

    • The process bypasses the loading of PowerShell profile settings

      • Install First.exe (PID: 8132)

    • Removes files via Powershell

      • powershell.exe (PID: 7632)
      • powershell.exe (PID: 5436)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Install First.exe (PID: 8132)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 7632)
      • powershell.exe (PID: 7856)
      • powershell.exe (PID: 5436)
      • powershell.exe (PID: 5164)

    • Starts POWERSHELL.EXE for commands execution

      • Install First.exe (PID: 8132)

    • Adds/modifies Windows certificates

      • certutil.exe (PID: 6824)

    • Drops a system driver (possible attempt to evade defenses)

      • NPFInstall.exe (PID: 1272)
      • drvinst.exe (PID: 1616)
      • Install First.exe (PID: 8132)

    • Creates files in the driver directory

      • drvinst.exe (PID: 1616)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 7884)
      • cmd.exe (PID: 1628)
      • cmd.exe (PID: 4944)
      • cmd.exe (PID: 7236)
      • cmd.exe (PID: 744)
      • cmd.exe (PID: 2504)

    • Starts CMD.EXE for commands execution

      • PPPwn GUI 1.9.3.exe (PID: 7600)

    • The process creates files with name similar to system file names

      • Install First.exe (PID: 8132)

  • INFO

    • Manual execution by a user

      • Install First.exe (PID: 8084)
      • Install First.exe (PID: 8132)
      • PPPwn GUI 1.9.3.exe (PID: 7600)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 720)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 720)
      • Install First.exe (PID: 8132)

    • Creates files in the program directory

      • Install First.exe (PID: 8132)
      • NPFInstall.exe (PID: 6108)

    • Returns hidden items found within a container (POWERSHELL)

      • conhost.exe (PID: 4040)
      • conhost.exe (PID: 7656)
      • conhost.exe (PID: 7620)
      • conhost.exe (PID: 7880)
      • conhost.exe (PID: 7524)
      • conhost.exe (PID: 1040)
      • conhost.exe (PID: 2908)
      • conhost.exe (PID: 5256)
      • conhost.exe (PID: 8120)
      • conhost.exe (PID: 7376)
      • conhost.exe (PID: 7244)
      • conhost.exe (PID: 4688)
      • conhost.exe (PID: 6972)
      • powershell.exe (PID: 5576)
      • conhost.exe (PID: 1804)
      • conhost.exe (PID: 7436)
      • conhost.exe (PID: 6272)
      • conhost.exe (PID: 5384)
      • conhost.exe (PID: 2552)
      • conhost.exe (PID: 7340)
      • conhost.exe (PID: 7912)
      • conhost.exe (PID: 1812)

    • Create files in a temporary directory

      • NPFInstall.exe (PID: 1272)
      • PPPwn GUI 1.9.3.exe (PID: 7600)
      • Install First.exe (PID: 8132)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5576)

    • Creates files or folders in the user directory

      • PPPwn GUI 1.9.3.exe (PID: 7600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:11:13 00:21:04
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: PPPwn GUI 1.9.3/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
202
Monitored processes
60
Malicious processes
1
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs rundll32.exe no specs install first.exe no specs install first.exe npfinstall.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs certutil.exe no specs certutil.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs certutil.exe no specs certutil.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs npfinstall.exe no specs conhost.exe no specs pnputil.exe no specs conhost.exe no specs npfinstall.exe no specs conhost.exe no specs npfinstall.exe conhost.exe no specs drvinst.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs pppwn gui 1.9.3.exe cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\aZz85975-PPPwnGUI1.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
744"cmd.exe" /C taskkill /IM pppwn_p.exe /fC:\Windows\SysWOW64\cmd.exe—PPPwn GUI 1.9.3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1272"C:\Program Files\Npcap\NPFInstall.exe" -n -iC:\Program Files\Npcap\NPFInstall.exe
Install First.exe
User:
admin
Company:
Insecure.Com LLC.
Integrity Level:
HIGH
Description:
A LWF & WFP driver installation tool
Exit code:
0
Version:
1.79
Modules
Images
c:\program files\npcap\npfinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1616DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{8a05dcfa-6e9e-9f4c-9aab-dc7bacf79ed7}\NPCAP.inf" "9" "405306be3" "0000000000000170" "WinSta0\Default" "00000000000001EC" "208" "C:\Program Files\Npcap"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1628"cmd.exe" /C taskkill /IM pppwn_p.exe /fC:\Windows\SysWOW64\cmd.exe—PPPwn GUI 1.9.3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1804\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2504"cmd.exe" /C taskkill /IM pppwn_64.exe /fC:\Windows\SysWOW64\cmd.exe—PPPwn GUI 1.9.3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2552\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
50 063
Read events
49 967
Write events
74
Delete events
22

Modification events

(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\aZz85975-PPPwnGUI1.zip
(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(720) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
41
Suspicious files
58
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
720WinRAR.exeC:\Users\admin\Desktop\PPPwn GUI 1.9.3\ReadMe.txttext
MD5:995B06EF9DD951FB5F4E7F506CC11AA6
SHA256:4B35FCA9534C39734412C3081ACC5771AD163C4BAE71ACB374A8A8B56E451775
8132Install First.exeC:\Users\admin\AppData\Local\Temp\nsjFF15.tmp\InstallOptions.dllexecutable
MD5:170C17AC80215D0A377B42557252AE10
SHA256:61EA114D9D0CD1E884535095AA3527A6C28DF55A4ECEE733C8C398F50B84CC3D
8132Install First.exeC:\Users\admin\AppData\Local\Temp\nsjFF15.tmp\modern-header.bmpimage
MD5:B514F98A3DF2F23FB0FDF170FA772F5C
SHA256:F22D49EEC7926CDE60DAD056A3A9FA844327F759F38E76BAD4C3119A57E37888
8132Install First.exeC:\Users\admin\AppData\Local\Temp\nsjFF15.tmp\final.initext
MD5:5FAA58B0398F6C4442D5CFBC616B4531
SHA256:4AF865B65FDBA7BB5C874F3D67BFDCE7EEAD2459A572E0681A6C067568AF4902
8132Install First.exeC:\Users\admin\AppData\Local\Temp\nsjFF15.tmp\options.initext
MD5:13A70D1FB5473932B6BECACCE3256EB8
SHA256:6FB874CA5489CE28232F3451467A3E39047ECED5670830F813E5DEFA6A80D8F7
8132Install First.exeC:\Users\admin\AppData\Local\Temp\nsjFF15.tmp\nsExec.dllexecutable
MD5:F9E61A25016DCB49867477C1E71A704E
SHA256:274E53DC8C5DDC273A6F5683B71B882EF8917029E2EAF6C8DBEE0C62D999225D
6108NPFInstall.exeC:\Program Files\Npcap\NPFInstall.logtext
MD5:ECAA88F7FA0BF610A5A26CF545DCD3AA
SHA256:F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
8132Install First.exeC:\Program Files\Npcap\LICENSEtext
MD5:964BCA11041A5C595BA098D459C056DC
SHA256:CF7CD1D5F8E0713A7F86DA0BB5339A5ABBEAF9FE0FD0838401FBC58D1FCCC3C1
8132Install First.exeC:\Program Files\Npcap\FixInstall.battext
MD5:3DCB581D39D9349A906368B77A4CEDFA
SHA256:C6158E40BDFD88E892EE6C4DA3A16A037EDF2CC77DC008CBD8FBEB44C643DDDA
8132Install First.exeC:\Program Files\Npcap\DiagReport.ps1text
MD5:0B4DF7D19ADE75BEE930D54BE31AC09C
SHA256:27EB36CB165C6EDD2F55B72A6856E4BF32AE2FA6CADFFCD267F5DF96EEA0B011
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7228
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1628
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1628
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
3216
svchost.exe
172.172.255.217:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5256
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7228
backgroundTaskHost.exe
20.74.19.45:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7228
backgroundTaskHost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
client.wns.windows.com
  • 172.172.255.217
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.64
  • 20.190.160.128
  • 40.126.32.138
  • 20.190.160.131
  • 40.126.32.133
  • 20.190.160.22
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.74.19.45
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/aZz85975-PPPwnGUI1.zip