File name:

Winmalware2.zip

Full analysis: https://app.any.run/tasks/6fb8dfe8-ace5-4fe4-a9ed-05450ff5ead6
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 20:20:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
evasion
stealer
ultravnc
rmm-tool
exfiltration
smtp
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

5FE7FB36BE8F6AEDC48A5703CEDAFDDC

SHA1:

6FCADEFD469964272A8E5DCA15BF91876728F95B

SHA256:

1F8A3D5F8C03BE105A824FFAA4D6D3C3E9518281DF0FDC599FCA0F9ED7E59BF3

SSDEEP:

24576:tBtRbsqfD3mAtsj/OXkgAvKqWIrb5pH8sAcr7F6//r3MnZ8CLC64Gt:tBtRbsqf6Atsj/OXkgAvKqWIr1pH8sAY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7392)

    • Actions looks like stealing of personal data

      • msiexec.exe (PID: 6872)

    • Steals credentials from Web Browsers

      • msiexec.exe (PID: 6872)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7392)

    • Starts POWERSHELL.EXE for commands execution

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 8020)

    • Connects to the server without a host name

      • msiexec.exe (PID: 6872)

    • Checks for external IP

      • msiexec.exe (PID: 6872)
      • svchost.exe (PID: 2196)

    • The process connected to a server suspected of theft

      • msiexec.exe (PID: 6872)

    • Connects to SMTP port

      • msiexec.exe (PID: 6872)

  • INFO

    • Create files in a temporary directory

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • Checks supported languages

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • Creates files or folders in the user directory

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7392)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7392)
      • powershell.exe (PID: 8020)

    • Reads the computer name

      • 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe (PID: 7988)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6872)

    • Checks proxy server information

      • msiexec.exe (PID: 6872)

    • Disables trace logs

      • msiexec.exe (PID: 6872)

    • ULTRAVNC has been detected

      • msiexec.exe (PID: 6872)

    • Reads the software policy settings

      • msiexec.exe (PID: 6872)
      • slui.exe (PID: 7556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:15 18:08:44
ZipCRC: 0xe3196897
ZipCompressedSize: 507981
ZipUncompressedSize: 525931
ZipFileName: 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
10
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe no specs powershell.exe conhost.exe no specs msiexec.exe rundll32.exe no specs svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4164C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6112C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6872"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7392"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Winmalware2.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7524C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7556"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7988"C:\Users\admin\AppData\Local\Temp\Rar$EXb7392.25317\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb7392.25317\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe—WinRAR.exe
User:
admin
Company:
skovgrnsernes
Integrity Level:
MEDIUM
Description:
tilsjofledes signy teknikumet
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb7392.25317\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
8020"powershell.exe" -windowstyle minimized "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" "$Limites=gc -Raw 'C:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pen';$Pedometrically=$Limites.SubString(40041,3);.$Pedometrically($Limites)" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
8032\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
11 460
Read events
11 435
Write events
25
Delete events
0

Modification events

(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Winmalware2.zip
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7392) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7988) 00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeKey:HKEY_CURRENT_USER\Sheepdog\skotvingernes\sjoflest
Operation:writeName:pjankende
Value:
%felttegnet%\whenso\indpak.jpg
Executable files
2
Suspicious files
8
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\munkeordnerne.polbinary
MD5:C15F434E740C7A3BD904A8292A226F6F
SHA256:8D0D6DB5C400E0FE3241C749A6BA272A5F567F03D308BDDDFD679828243B82C3
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Kogeri.jpgimage
MD5:B5EF401EFA67FD2CB6B812CABDED093D
SHA256:382E5D828F34622C0DDD0149E87804B6F45F2213D08E49EF6689187BD93B18DE
7392WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb7392.25317\00af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeexecutable
MD5:F68C9EE5BAF1F69A879EF27A8FD4E3D9
SHA256:00AF8460BF334E146F7C6328269126476919D9E69D7E1439A9984B4227D06591
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Heredes.initext
MD5:5B1E73C4F05F69D079AC262B0E46ED41
SHA256:22287491EFFA705126FC3268494EDEFF9474677DE1969322E9C23091AAAD0B5F
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Balija.Pentext
MD5:AB67BDFB35AE2DE3E05BE0911750123D
SHA256:DD17C10E7B01056C2AFAD81F8E9EBDB367754D8861A96DA484BD1D679DC1F874
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Eleventeenth.initext
MD5:AF3DD803B1558C99556EB3A508B683DF
SHA256:18E0DF5E7B55E4D24E5DFF154E3C0197A06EDBEEA0BEFB94B954328973F11F04
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Rotundify223.txttext
MD5:2A772047C6E682E6A14D8731154D9474
SHA256:B51A6405198B74AFBFF4876A3757290EA80EF65C74532675FDA0EED640B7041C
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\krgebr.hesbinary
MD5:E9D35B5819A8938EE82FFC38B545A4E8
SHA256:87F9735CA7AF9C9A8BDADB6D7F0F0CC4ECE96580873DDC66B35EAE66D1807FA4
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\Netstatus.jpgimage
MD5:22F316F3F0218F9C3CC1F5C79DFB5752
SHA256:FF5CB1A7C5EF1F5CC6E44EB93ACB8C2802CE1C1F4CF9907E6ADB1B22E1F8E11D
798800af8460bf334e146f7c6328269126476919d9e69d7e1439a9984b4227d06591.exeC:\Users\admin\AppData\Roaming\arbejdskrfters\ymeres\certifikatpligten\Afskridtedes\ingenirsekvensernes.prebinary
MD5:7A60EC14504DEA7D547407850100DDF7
SHA256:1A50D79C41680CDDEF3F3F50F6990FC2D86E885A8E64C7095EF23F4EB2FEDD48
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
17
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.146:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6872
msiexec.exe
GET
200
185.29.9.64:80
http://185.29.9.64/gKihuwGhxt122.bin
unknown
—
—
unknown
6872
msiexec.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5024
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.146:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.146
  • 23.48.23.143
  • 23.48.23.193
  • 23.48.23.145
  • 23.48.23.191
  • 23.48.23.180
  • 23.48.23.140
  • 23.48.23.181
  • 23.48.23.194
whitelisted
google.com
  • 142.250.185.110
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.130
  • 20.190.159.23
  • 40.126.31.129
  • 40.126.31.130
  • 20.190.159.128
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted

Threats

PID
Process
Class
Message
6872
msiexec.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6872
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6872
msiexec.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6872
msiexec.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Winmalware2.zip