File name:

zapret-discord-youtube-1.6.1 (1).rar

Full analysis: https://app.any.run/tasks/6c85b1e9-c4b2-4560-9e26-ab5144700445
Verdict: Malicious activity
Analysis date: June 03, 2025, 07:53:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
windivert-sys
mal-driver
arch-exec
arch-doc
github
upx
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

DB6DDF779FEDE5B17A289880EB2CE217

SHA1:

DF3ACA68FB4D28116FD17C286907DE4709E50F2A

SHA256:

2AAC3961D99AB14BEE7BC9D4CC3ABDA083050BE23456BF15C4BAA2B580CF9B70

SSDEEP:

49152:nD2pC3Q/k0bvTtqsyTDWaxsJ/tfjnlcNw7hqnFTII6w8b+IWx8n/cYZrECWSBVcx:Dx3Q/k0dYT6axYhzIZnFkI6fHRcYZr/C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4652)

    • Detects Cygwin installation

      • WinRAR.exe (PID: 4628)

    • Malicious driver has been detected

      • WinRAR.exe (PID: 4628)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 3896)
      • net.exe (PID: 5360)
      • cmd.exe (PID: 5508)
      • net.exe (PID: 772)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 2244)
      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 5156)

    • Starts process via Powershell

      • powershell.exe (PID: 864)
      • powershell.exe (PID: 3884)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 5508)
      • cmd.exe (PID: 6872)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 864)
      • cmd.exe (PID: 3896)
      • powershell.exe (PID: 3884)
      • cmd.exe (PID: 6872)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 864)
      • cmd.exe (PID: 3896)
      • powershell.exe (PID: 3884)

    • Application launched itself

      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 6872)

    • Hides command output

      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 6676)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3896)

    • Windows service management via SC.EXE

      • sc.exe (PID: 3996)
      • sc.exe (PID: 5984)
      • sc.exe (PID: 6872)
      • sc.exe (PID: 6620)
      • sc.exe (PID: 2908)
      • sc.exe (PID: 6676)

    • Executes as Windows Service

      • winws.exe (PID: 5416)

    • Creates a new Windows service

      • sc.exe (PID: 1616)
      • sc.exe (PID: 5256)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 5508)

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 4628)

    • Sets XML DOM element text (SCRIPT)

      • notepad.exe (PID: 4336)

  • INFO

    • Checks supported languages

      • chcp.com (PID: 4756)
      • chcp.com (PID: 732)
      • chcp.com (PID: 5416)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4628)

    • Manual execution by a user

      • WinRAR.exe (PID: 4628)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 6872)
      • notepad.exe (PID: 4336)
      • cmd.exe (PID: 5360)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4628)

    • Changes the display of characters in the console

      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 6872)
      • cmd.exe (PID: 5508)
      • cmd.exe (PID: 5360)

    • Checks proxy server information

      • powershell.exe (PID: 5064)

    • Disables trace logs

      • powershell.exe (PID: 5064)

    • UPX packer has been detected

      • winws.exe (PID: 5416)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 2826
UncompressedSize: 7925
OperatingSystem: Win32
ArchivedFileName: README.md
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
78
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs THREAT winrar.exe rundll32.exe no specs notepad.exe no specs cmd.exe conhost.exe no specs chcp.com no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs chcp.com no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs winws.exe no specs slui.exe no specs cmd.exe conhost.exe no specs chcp.com no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe conhost.exe no specs chcp.com no specs chcp.com no specs cmd.exe no specs powershell.exe no specs winws.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
732chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
772net stop zapretC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wkscli.dll
856"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\service_goodbye_discord.bat" C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
864powershell -Command "Start-Process 'cmd.exe' -ArgumentList '/k \"\"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\service_install.bat\" admin\"' -Verb RunAs"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228C:\WINDOWS\system32\cmd.exe /c powershell -command "(Invoke-WebRequest -Uri https://raw.githubusercontent.com/Flowseal/zapret-discord-youtube/refs/heads/main/.service/version.txt -Headers @{\"Cache-Control\"=\"no-cache\"} -TimeoutSec 5).Content" 2>nulC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388findstr /i "winws.exe" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1616sc create zapret binPath= "\"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\winws.exe\" --wf-tcp 443 --wf-udp 443,50000-50100 --filter-udp 443 --hostlist \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\list-discord.txt\" --dpi-desync fake --dpi-desync-repeats 6 --dpi-desync-fake-quic \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\quic_initial_www_google_com.bin\" --new --filter-udp 50000-50100 --ipset \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\ipset-discord.txt\" --dpi-desync fake --dpi-desync-any-protocol --dpi-desync-cutoff d3 --dpi-desync-repeats 6 --new --filter-tcp 443 --hostlist \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\list-discord.txt\" --dpi-desync fake,split --dpi-desync-autottl 2 --dpi-desync-repeats 6 --dpi-desync-fooling badseq --dpi-desync-fake-tls \"C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\tls_clienthello_www_google_com.bin\"" DisplayName= "zapret" start= autoC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1764\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 492
Read events
27 430
Write events
61
Delete events
1

Modification events

(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1).rar
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4652) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
4
Suspicious files
3
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\README.mdhtml
MD5:1C1C8E2DA620A9988B305ECD13E8E8FF
SHA256:A3D9D6C4BA590F5B8790BCDB68258425FD268534588A7B74E4EF926336FD653B
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\service_install.battext
MD5:55D22378709DC7EA40E84CADCED29E4A
SHA256:A77AC7ABD0ADCB995C701019BFE2D67133D6D0F94D90754046A13ADE40ADF693
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\service_remove.battext
MD5:F7AD12616404A382B1689C9E3937C9E5
SHA256:9D8F0B7105D86DE09B9408515F30B2BC2BB935430F4E73196021368906B7F128
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\tls_clienthello_www_google_com.binbinary
MD5:7AB7AD857C5B8794FBDF1091B494DC94
SHA256:E5938780152169F720383F80EABB309E9477369B83B5EC40CC137C397F862CDE
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\check_updates.battext
MD5:C0AF479B986A7E2095929A68136CD97C
SHA256:438ADFB9F66429E1B6B0474FE0CDBD397098D58C4B80FF2C74237C6F9B99DF23
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\service_goodbye_discord.battext
MD5:8B043F2A0EC87328DC40542B9739988F
SHA256:263102816588BD719FC628A75C8B73185110050564EA21A62B360F3AE545022B
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\bin\WinDivert64.sysexecutable
MD5:89ED5BE7EA83C01D0DE33D3519944AA5
SHA256:8DA085332782708D8767BCACE5327A6EC7283C17CFB85E40B03CD2323A90DDC2
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\general (ALT3).battext
MD5:6E0FD8729815F1941C5FD4016C888EC5
SHA256:198FDA8A2FC02A4A501F13B67D1232DFCB3157075D3AB76494D17C64742E82D3
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\general (ALT4).battext
MD5:D731B6B9E4E68B70CAB7721FD84AF920
SHA256:8CA143406A8D2007CF6E123DA7D7DD8898BF230DAEA1A6D79DE5A104D323E82B
4628WinRAR.exeC:\Users\admin\Desktop\zapret-discord-youtube-1.6.1 (1)\discord.battext
MD5:C01056F88C8646CAB2D85A31F44F1186
SHA256:21ADF614F58D39396C49BF10AE3F6187905F328E24D7363372D299F821D18CF6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
13
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5796
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4628
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4628
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5796
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
6592
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5796
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zapret-discord-youtube-1.6.1 (1).rar