File name:

38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.zip

Full analysis: https://app.any.run/tasks/527d2a12-cc29-4c0b-ae34-a8890149ce74
Verdict: Malicious activity
Analysis date: May 18, 2025, 18:20:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

DC2C64C56DE23D1117F9D3F9F092474F

SHA1:

2C2BD51543C6FA84DE44EF2D91D0B9D7B415C975

SHA256:

217355AC71E74109781470A3205DC2D47817D5423915C5B6F6932E72B9486A22

SSDEEP:

192:N4DEIHLnLBXCoi5lzJTxZQchg/F7BDGsZ4p5HwGvRtBxA:urNO5Dx0XyLTRi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1676)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 5176)
      • powershell.exe (PID: 6372)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6372)
      • powershell.exe (PID: 4208)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6372)

    • Adds path to the Windows Defender exclusion list

      • powershell.exe (PID: 4208)

    • Changes Windows Defender settings

      • powershell.exe (PID: 4208)

    • Starts CMD.EXE for self-deleting

      • powershell.exe (PID: 4208)

    • Create files in the Startup directory

      • cmd.exe (PID: 5728)

  • SUSPICIOUS

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 728)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 728)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1676)

    • The process executes VB scripts

      • WinRAR.exe (PID: 1676)

    • Base64-obfuscated command line is found

      • wscript.exe (PID: 728)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 728)
      • powershell.exe (PID: 5176)
      • powershell.exe (PID: 6372)
      • powershell.exe (PID: 4208)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 728)
      • powershell.exe (PID: 5176)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 5176)
      • powershell.exe (PID: 6372)
      • powershell.exe (PID: 4208)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 6372)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 5176)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 5176)
      • powershell.exe (PID: 6372)

    • The process executes Powershell scripts

      • powershell.exe (PID: 5176)
      • powershell.exe (PID: 6372)

    • Probably download files using WebClient

      • powershell.exe (PID: 5176)

    • Application launched itself

      • powershell.exe (PID: 5176)
      • powershell.exe (PID: 6372)
      • powershell.exe (PID: 4208)

    • Get information on the list of running processes

      • powershell.exe (PID: 5176)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 4220)
      • cmd.exe (PID: 6972)
      • cmd.exe (PID: 5728)
      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 4736)
      • cmd.exe (PID: 6184)

    • Script adds exclusion path to Windows Defender

      • powershell.exe (PID: 4208)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4428)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 4208)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 1676)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 5176)
      • powershell.exe (PID: 4208)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5176)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 5176)

    • Reads the software policy settings

      • powershell.exe (PID: 6372)

    • Create files in a temporary directory

      • powershell.exe (PID: 6372)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6372)

    • Disables trace logs

      • powershell.exe (PID: 6372)
      • powershell.exe (PID: 4208)

    • Checks proxy server information

      • powershell.exe (PID: 6372)
      • powershell.exe (PID: 4208)

    • Creates a new folder

      • cmd.exe (PID: 3676)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3300)
      • powershell.exe (PID: 3332)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3332)
      • powershell.exe (PID: 3300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:18 18:16:14
ZipCRC: 0xab22557f
ZipCompressedSize: 6317
ZipUncompressedSize: 166220
ZipFileName: 38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.vbs
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
39
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe no specs wscript.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe powershell.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs reg.exe no specs cmd.exe cmd.exe no specs ping.exe no specs ping.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs ping.exe no specs ping.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs ping.exe no specs ping.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs ping.exe no specs ping.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616ping 127.0.0.1 -n 1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nsi.dll
720ping 127.0.0.1 -n 1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nsi.dll
728"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb1676.27235\38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.vbs" C:\Windows\System32\wscript.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896ping 127.0.0.1 -n C:\Users\admin\AppData\Local\Temp\Rar$DIb1676.27235\38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.vbs C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
1280ping 127.0.0.1 -n 1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nsi.dll
1452ping 127.0.0.1 -n 1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nsi.dll
1676"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1852cmd.exe /c del "C:\Users\admin\AppData\Local\Temp\Rar$DIb1676.27235\38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.vbs"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2088cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\admin\AppData\Local\Temp\Rar$DIb1676.27235\38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.vbs" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.vbs"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2240cmd.exe /c ping 127.0.0.1 -n C:\Users\admin\AppData\Local\Temp\Rar$DIb1676.27235\38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.vbs & del "1"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
29 107
Read events
29 097
Write events
10
Delete events
0

Modification events

(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.zip
(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
Executable files
0
Suspicious files
2
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
4208powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_krfjo4ky.us4.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6372powershell.exeC:\Users\admin\AppData\Local\Temp\dll01.txttext
MD5:80033919BC4841E15469CEED08E52B75
SHA256:8D8746C4A46EB4355C557E7328740AB07FC1A65DA1F3902647770E10BB2CA7F7
5176powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cdcxzgnp.p4g.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5176powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uap4hbx5.bri.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6372powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3aybp0dx.hv3.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6372powershell.exeC:\Users\admin\AppData\Local\Temp\dll02.txttext
MD5:F4F8C44510A36E76D5AE4AFEE447162D
SHA256:195C61ED85B683A10B2BB80189C37B15731C059D41B1647AEFAFA85EED895312
6372powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xsa53qaj.3xu.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5728cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.vbstext
MD5:7670B3C3B05613000677C09ACAFF72E8
SHA256:38A88896B098C8508B1EE5A9CCAFC772C58EE853C2D3D177C5F0B53868E3A019
4208powershell.exeC:\Users\admin\AppData\LocalLow\Daft Sytem (x86)\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\server.txttext
MD5:EF851AD0268F163AE625F3800D6408E4
SHA256:516D3B50A3C957BEE1C4435ED316A362B575CB17D2C047C05A324B004B3594BB
3300powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_w1kcctvb.lln.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2420
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2420
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.5:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.238
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.5
  • 20.190.160.65
  • 20.190.160.132
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.130
  • 20.190.160.66
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
www.pastery.net
  • 104.21.32.1
  • 104.21.96.1
  • 104.21.80.1
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.112.1
  • 104.21.16.1
unknown
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
38a88896b098c8508b1ee5a9ccafc772c58ee853c2d3d177c5f0b53868e3a019.zip