File name:

affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.zip

Full analysis: https://app.any.run/tasks/3b474d8c-06bd-48d4-ac94-c1b371d6cb5d
Verdict: Malicious activity
Threats:

Cactus ransomware-as-a-service (RaaS) was first caught in March 2023 targeting corporate networks. It became known for its self-encrypting payload and double extortion tactics. Cactus primarily targets large enterprises across industries in finance, manufacturing, IT, and healthcare. It is known for using custom encryption techniques, remote access tools, and penetration testing frameworks to maximize damage.

Malware Trends Tracker     >>>
Analysis date: April 21, 2025, 20:15:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
arch-exec
cactus
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

D6833C801DA2B1C7DBAF7DDA7DE7B01C

SHA1:

556A37C6E365533049C0516A91F47E16AACDA3B4

SHA256:

2711CE2AA32A9E462AFB81CEC038995A950902A4973C54420A79FA0AAF992D54

SSDEEP:

12288:qaU4iOmR0nB03hLXek/GZHisrQayBpb1ZgDIvrhkdO1sLCb:rNxmRKB03hLXJ/GZH1QayBpb1yDIvrhd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1276)

    • GENERIC has been found (auto)

      • WinRAR.exe (PID: 1276)

    • CACTUS mutex has been found

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • CACTUS has been detected

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Starts CMD.EXE for self-deleting

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Deletes shadow copies

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Create files in the Startup directory

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Renames files like ransomware

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • CACTUS has been detected (YARA)

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Changes the autorun value in the registry

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • RANSOMWARE has been detected

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Writes a file to the Word startup folder

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Hides command output

      • cmd.exe (PID: 7488)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7488)

    • Creates file in the systems drive root

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Write to the desktop.ini file (may be used to cloak folders)

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1276)

    • Manual execution by a user

      • mspaint.exe (PID: 1228)
      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)
      • notepad.exe (PID: 7644)

    • Checks supported languages

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Reads the computer name

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Create files in a temporary directory

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 4756)
      • WMIC.exe (PID: 5392)
      • notepad.exe (PID: 7644)

    • Creates files or folders in the user directory

      • affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe (PID: 7928)

    • Reads the software policy settings

      • slui.exe (PID: 7540)
      • slui.exe (PID: 7240)

    • Checks proxy server information

      • slui.exe (PID: 7540)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 7592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:04:21 20:14:06
ZipCRC: 0x5c6d851a
ZipCompressedSize: 389017
ZipUncompressedSize: 896512
ZipFileName: affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
16
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GENERIC winrar.exe sppextcomobj.exe no specs slui.exe #CACTUS affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe mspaint.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs slui.exe openwith.exe no specs notepad.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
516\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\divisionduring.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1276"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1676ping 1.1.1.1 -n 1 -w 3000 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4756c:\evTghw\evTg\..\..\Windows\evTg\evTg\..\..\system32\evTg\evTg\..\..\wbem\evTg\evTgh\..\..\wmic.exe shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
5392c:\NZMuOh\NZMu\..\..\Windows\NZMu\NZMu\..\..\system32\NZMu\NZMu\..\..\wbem\NZMu\NZMuO\..\..\wmic.exe shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
7204C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7240"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7356\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 635
Read events
4 593
Write events
41
Delete events
1

Modification events

(PID) Process:(1276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.zip
(PID) Process:(1276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
(PID) Process:(1228) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Ribbon
Operation:writeName:QatItems
Value:
<siq:customUI xmlns:siq="http://schemas.microsoft.com/windows/2009/ribbon/qat"><siq:ribbon minimized="false"><siq:qat position="0"><siq:sharedControls><siq:control idQ="siq:20002" visible="false" argument="0"/><siq:control idQ="siq:20003" visible="false" argument="0"/><siq:control idQ="siq:20004" visible="true" argument="0"/><siq:control idQ="siq:20014" visible="false" argument="0"/><siq:control idQ="siq:20017" visible="false" argument="0"/><siq:control idQ="siq:20019" visible="false" argument="0"/><siq:control idQ="siq:31001" visible="true" argument="0"/><siq:control idQ="siq:31002" visible="true" argument="0"/></siq:sharedControls></siq:qat></siq:ribbon></siq:customUI>
Executable files
2
Suspicious files
794
Text files
331
Unknown types
0

Dropped files

PID
Process
Filename
Type
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\Decryptfiles.txttext
MD5:6725D4E3EF45C7DDAA913773CC797E90
SHA256:513E27E998F2EBD8F961131027A023BE4CD3CA703741B942E7C822AF0EBE2576
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\divisionduring.pngbinary
MD5:BE3A198186FD98D22E67F1471672C08D
SHA256:6B4B2CABD00AD616BE6AE27170AD9BD4E7ECE44BA90B89A6261D7ADDD3EA1912
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\autoabove.rtfbinary
MD5:9885E4E972281748D0C591F3D079E58F
SHA256:B2A1048CE244A0825711D486E2D898E8C0E7C2725228046A2D67C4AA886CDB06
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\autoabove.rtf.NRotbinary
MD5:9885E4E972281748D0C591F3D079E58F
SHA256:B2A1048CE244A0825711D486E2D898E8C0E7C2725228046A2D67C4AA886CDB06
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\divisionduring.png.snXvbinary
MD5:BE3A198186FD98D22E67F1471672C08D
SHA256:6B4B2CABD00AD616BE6AE27170AD9BD4E7ECE44BA90B89A6261D7ADDD3EA1912
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\individualrated.jpgbinary
MD5:8E211C120BE3FE0C543D593289CD1C7E
SHA256:28F9C685A2A1C1574C3457CCC31388326107CC49A3BA0D6FDBDFEA787DB3632B
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\greenreports.rtf.PtYXbinary
MD5:03FC8317511965AE872CA24815D30CEB
SHA256:4DC0638AEA4EDB4FE1B38E7E71D2D1B7D00AE6152E38176F5844E798D998AB2D
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\greenreports.rtfbinary
MD5:03FC8317511965AE872CA24815D30CEB
SHA256:4DC0638AEA4EDB4FE1B38E7E71D2D1B7D00AE6152E38176F5844E798D998AB2D
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\everykids.png.xNvPbinary
MD5:CD90BA04DD4892D98CCF60F67F7EB79A
SHA256:F3E3E343D1FCE5ED973DA12E8DEB9BF5DAE5997EB5C06C925091B60248B06A54
7928affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.exeC:\Users\admin\Desktop\individualrated.jpg.dUeobinary
MD5:8E211C120BE3FE0C543D593289CD1C7E
SHA256:28F9C685A2A1C1574C3457CCC31388326107CC49A3BA0D6FDBDFEA787DB3632B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7776
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7776
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.16.38.4:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.3
  • 40.126.31.73
  • 20.190.159.64
  • 40.126.31.130
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.75
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.16.38.4
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
affa4e7daf9d64e4e3660b489bd684249c6f678f4f04a1a5f74bf4d9144cdde1.zip