File name:

zapret-discord-youtube-1.6.1 (1).rar

Full analysis: https://app.any.run/tasks/6c85b1e9-c4b2-4560-9e26-ab5144700445
Verdict: Malicious activity
Analysis date: June 03, 2025, 07:53:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
windivert-sys
mal-driver
arch-exec
arch-doc
github
upx
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

DB6DDF779FEDE5B17A289880EB2CE217

SHA1:

DF3ACA68FB4D28116FD17C286907DE4709E50F2A

SHA256:

2AAC3961D99AB14BEE7BC9D4CC3ABDA083050BE23456BF15C4BAA2B580CF9B70

SSDEEP:

49152:nD2pC3Q/k0bvTtqsyTDWaxsJ/tfjnlcNw7hqnFTII6w8b+IWx8n/cYZrECWSBVcx:Dx3Q/k0dYT6axYhzIZnFkI6fHRcYZr/C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4652)

    • Malicious driver has been detected

      • WinRAR.exe (PID: 4628)

    • Detects Cygwin installation

      • WinRAR.exe (PID: 4628)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 3896)
      • net.exe (PID: 5360)
      • cmd.exe (PID: 5508)
      • net.exe (PID: 772)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 4628)

    • Sets XML DOM element text (SCRIPT)

      • notepad.exe (PID: 4336)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2244)
      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 5156)

    • Application launched itself

      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 6872)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 3896)
      • powershell.exe (PID: 864)
      • powershell.exe (PID: 3884)
      • cmd.exe (PID: 6872)

    • Hides command output

      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 6676)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 5508)
      • cmd.exe (PID: 6872)

    • Starts process via Powershell

      • powershell.exe (PID: 864)
      • powershell.exe (PID: 3884)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 864)
      • cmd.exe (PID: 3896)
      • powershell.exe (PID: 3884)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3896)

    • Windows service management via SC.EXE

      • sc.exe (PID: 3996)
      • sc.exe (PID: 5984)
      • sc.exe (PID: 6872)
      • sc.exe (PID: 2908)
      • sc.exe (PID: 6676)
      • sc.exe (PID: 6620)

    • Creates a new Windows service

      • sc.exe (PID: 1616)
      • sc.exe (PID: 5256)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 5508)

    • Executes as Windows Service

      • winws.exe (PID: 5416)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 4628)
      • notepad.exe (PID: 4336)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 6872)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4628)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4628)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4336)

    • Changes the display of characters in the console

      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 6872)
      • cmd.exe (PID: 5508)

    • Checks supported languages

      • chcp.com (PID: 4756)
      • chcp.com (PID: 732)
      • chcp.com (PID: 5416)

    • Disables trace logs

      • powershell.exe (PID: 5064)

    • UPX packer has been detected

      • winws.exe (PID: 5416)

    • Checks proxy server information

      • powershell.exe (PID: 5064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 2826
UncompressedSize: 7925
OperatingSystem: Win32
ArchivedFileName: README.md
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
78
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs THREAT winrar.exe rundll32.exe no specs notepad.exe no specs cmd.exe conhost.exe no specs chcp.com no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs chcp.com no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs winws.exe no specs slui.exe no specs cmd.exe conhost.exe no specs chcp.com no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe conhost.exe no specs chcp.com no specs chcp.com no specs cmd.exe no specs powershell.exe no specs winws.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
732chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
772net stop zapretC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wkscli.dll
856"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\service_goodbye_discord.bat" C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
864powershell -Command "Start-Process 'cmd.exe' -ArgumentList '/k \"\"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\service_install.bat\" admin\"' -Verb RunAs"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228C:\WINDOWS\system32\cmd.exe /c powershell -command "(Invoke-WebRequest -Uri https://raw.githubusercontent.com/Flowseal/zapret-discord-youtube/refs/heads/main/.service/version.txt -Headers @{\"Cache-Control\"=\"no-cache\"} -TimeoutSec 5).Content" 2>nulC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388findstr /i "winws.exe" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1616sc create zapret binPath= "\"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\winws.exe\" --wf-tcp 443 --wf-udp 443,50000-50100 --filter-udp 443 --hostlist \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\list-discord.txt\" --dpi-desync fake --dpi-desync-repeats 6 --dpi-desync-fake-quic \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\quic_initial_www_google_com.bin\" --new --filter-udp 50000-50100 --ipset \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\ipset-discord.txt\" --dpi-desync fake --dpi-desync-any-protocol --dpi-desync-cutoff d3 --dpi-desync-repeats 6 --new --filter-tcp 443 --hostlist \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\list-discord.txt\" --dpi-desync fake,split --dpi-desync-autottl 2 --dpi-desync-repeats 6 --dpi-desync-fooling badseq --dpi-desync-fake-tls \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\tls_clienthello_www_google_com.bin\"" DisplayName= "zapret" start= autoC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1764\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 492
Read events
27 430
Write events
61
Delete events
1

Modification events

(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1).rar
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
4
Suspicious files
3
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\service_install.battext
MD5:55D22378709DC7EA40E84CADCED29E4A
SHA256:A77AC7ABD0ADCB995C701019BFE2D67133D6D0F94D90754046A13ADE40ADF693
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\tls_clienthello_www_google_com.binbinary
MD5:7AB7AD857C5B8794FBDF1091B494DC94
SHA256:E5938780152169F720383F80EABB309E9477369B83B5EC40CC137C397F862CDE
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\discord.battext
MD5:C01056F88C8646CAB2D85A31F44F1186
SHA256:21ADF614F58D39396C49BF10AE3F6187905F328E24D7363372D299F821D18CF6
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\WinDivert.dllexecutable
MD5:B2014D33EE645112D5DC16FE9D9FCBFF
SHA256:C1E060EE19444A259B2162F8AF0F3FE8C4428A1C6F694DCE20DE194AC8D7D9A2
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\check_updates.battext
MD5:C0AF479B986A7E2095929A68136CD97C
SHA256:438ADFB9F66429E1B6B0474FE0CDBD397098D58C4B80FF2C74237C6F9B99DF23
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\WinDivert64.sysexecutable
MD5:89ED5BE7EA83C01D0DE33D3519944AA5
SHA256:8DA085332782708D8767BCACE5327A6EC7283C17CFB85E40B03CD2323A90DDC2
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\cygwin1.dllexecutable
MD5:C50B50303FAE4AFE7248307339A00D13
SHA256:712C39A069541AFA69CFCBE01B422BD67B4201EEE7E94CC1327D4ED8B4FA2167
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\general (ALT2).battext
MD5:4B24D1B6ACA069DFFB4A55C003AD89CF
SHA256:16113CF48D720D27BEFBCDDCF26C890515D5586967A0B536838D2C8F5D42974F
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\winws.exeexecutable
MD5:444FE359CA183016B93D8BFE398D5103
SHA256:0453FCE6906402181DBFF7E09B32181EB1C08BB002BE89849E8992B832F43B89
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\general (ALT).battext
MD5:F2DFDB0EC74378D6DEFC004BCFCEE491
SHA256:ADFA52BEACE1FF288D2CC20D6814E8EB04FAE5A9256B600C402F91AB94AF5886
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5796
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4628
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4628
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5796
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
6592
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5796
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zapret-discord-youtube-1.6.1 (1).rar