File name:

VYNLA85.zip

Full analysis: https://app.any.run/tasks/b15e3383-dad8-4155-8b63-5b614bc8ee97
Verdict: Malicious activity
Analysis date: January 18, 2025, 15:55:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

BF5789285A91F5932B6AE4A90F8D9DDE

SHA1:

BFABAAFC617381CB2ABDE85C45F0275EDD47780C

SHA256:

3AC5E00D4E1CE29D586D253985752560C2CFBC7E0CF18D12385DA97B74EF1CA1

SSDEEP:

24576:FObUHDV2+CA9gwYVo2cUBmUNdTqz/WHWN/GwJC:FObUHDV0A9gwYe2cUBmUNdTqz/WHWN/C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1864)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 1864)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1864)
      • StartMenuExperienceHost.exe (PID: 848)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 1688)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4596)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4596)

    • Reads the date of Windows installation

      • StartMenuExperienceHost.exe (PID: 848)
      • SearchApp.exe (PID: 4992)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 1864)

    • Checks supported languages

      • MpCmdRun.exe (PID: 5748)
      • MpCmdRun.exe (PID: 2136)
      • TextInputHost.exe (PID: 5720)
      • SearchApp.exe (PID: 4992)
      • StartMenuExperienceHost.exe (PID: 848)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 5748)

    • Reads the computer name

      • MpCmdRun.exe (PID: 5748)
      • MpCmdRun.exe (PID: 2136)
      • TextInputHost.exe (PID: 5720)
      • StartMenuExperienceHost.exe (PID: 848)
      • SearchApp.exe (PID: 4992)

    • Disables trace logs

      • netsh.exe (PID: 3364)

    • Manual execution by a user

      • cmd.exe (PID: 1688)
      • cmd.exe (PID: 5588)
      • cmd.exe (PID: 4596)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 2280)

    • Checks proxy server information

      • SearchApp.exe (PID: 4992)
      • explorer.exe (PID: 2280)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 4992)

    • Process checks computer location settings

      • StartMenuExperienceHost.exe (PID: 848)
      • SearchApp.exe (PID: 4992)

    • Sends debugging messages

      • StartMenuExperienceHost.exe (PID: 848)

    • Reads the software policy settings

      • SearchApp.exe (PID: 4992)

    • Reads Environment values

      • SearchApp.exe (PID: 4992)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 2280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (36.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: None
ZipModifyDate: 2023:09:08 22:36:38
ZipCRC: 0xea69f247
ZipCompressedSize: 442
ZipUncompressedSize: 442
ZipFileName: VYNLA 85$/DELAY PRO NA PLAYERS/Attributes.reg
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
22
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs taskkill.exe no specs explorer.exe no specs textinputhost.exe no specs startmenuexperiencehost.exe no specs searchapp.exe mobsync.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
848"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1572C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR1864.8839\Rar$Scan21959.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1688C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\9. TCP Tune.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1864"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\VYNLA85.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2136"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR1864.8839"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
2280explorer.exe C:\Windows\explorer.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
2324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3364netsh int tcp set global autotuninglevel=disabledC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
23 593
Read events
23 371
Write events
209
Delete events
13

Modification events

(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\VYNLA85.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
(PID) Process:(2280) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{2f5c5e72-85a9-11eb-90a8-9a9b76358421}
Operation:writeName:Data
Value:
D60D00000DF0ADBA41000000080000000000008000000000000000300000000000000000FF06E703FF00000016000000FA99B7261F00000004400000030000000000000000000000000000000000000000005C005C003F005C00530054004F005200410047004500230056006F006C0075006D00650023007B00390030006300660033006400640036002D0030006100660037002D0031003100650063002D0062003400380030002D003800300036006500360066003600650036003900360033007D002300300030003000300030003000300030003100460035003000300030003000300023007B00350033006600350036003300300064002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005C005C003F005C0056006F006C0075006D0065007B00320066003500630035006500370032002D0038003500610039002D0031003100650062002D0039003000610038002D003900610039006200370036003300350038003400320031007D005C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004E005400460053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000
Executable files
2
Suspicious files
6
Text files
124
Unknown types
0

Dropped files

PID
Process
Filename
Type
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\Attributes.regtext
MD5:FF528D5E454C2589365DB1AF54C6CF7E
SHA256:5E9B52FB6110CED0A550BD86A76F04A507693503D29AD327186723B5B86094D9
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\TOP regedits for delay\VYNLA (3).regtext
MD5:90D515653DC8B4E8E3F57CAD33A35CF3
SHA256:D6B1089E2E3BA3EE98E2FA41E4978E4F4A223FEFE4D782C8F2486BF29DD2F016
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\Windows_Pro_Activation.battext
MD5:2A93375B85416E32ED487BFA3B8C2919
SHA256:8A4846A093FB51E94131366CE4A94A17A6AE12DA8C3D10C4CE21E048090E47FF
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\TOP regedits for delay\VYNLA (9).regtext
MD5:7E4BF6DD11A30883D006BDC481344BF1
SHA256:D31CA5E85FDF4B947F62E3448338A93700CB61A678687C401CF3B98E17BE143C
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\Remove Gamebar Presence Writer.battext
MD5:0AD293BAE88E1E3BA4665F420574A5BF
SHA256:A9B62350125F4A5F99168FEA70E41F5079A1359E0A8A76F9823D0D114D5282DF
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\TcpAckFrequency.regtext
MD5:B1E24290785C63AFD024A560ED354EEC
SHA256:E0C22912B2607A9E336AFA4272270354A27EF8E1CEB258496B4C869977146C2B
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\TCPNoDelay.regtext
MD5:3827910CE1FD933092B3E34B035475ED
SHA256:6D46BE15D6C95576CB93327C70E0A54B7F0A5E385E18C19CAF373E4ED4796F5B
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\TOP regedits for delay\VYNLA (10).regtext
MD5:FB08E25FA6E1F8BDBC6DF3FFCECEF384
SHA256:DC9F24F65B8E740F7568629B1D0BD6E07A49D5F00296EFD6E231958C13DAD232
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\READ BEFORE U RUN IT\VYNLA BEST TWEAK.battext
MD5:87F2B5F9A73DF862122F26318F6C256A
SHA256:E0E398A5DE9BD8337FD39DED1720B345EDAFA59EAB07E1C67BFBCAF380DADA0A
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR1864.7255\VYNLA85.zip\VYNLA 85$\DELAY PRO NA PLAYERS\TOP regedits for delay\VYNLA CONTROLLER(13).regtext
MD5:943E5FBF55AEAD4042D6BCBEB1D0FB51
SHA256:85B5225A02BDA25650224A0B2D4BD1AD51A944F7A03759AD740118A3C9C1F719
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
21
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.164:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.126.37.176:443
https://www.bing.com/manifest/threshold.appcache
unknown
text
3.46 Kb
—
—
—
POST
204
104.126.37.176:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
—
—
—
POST
204
104.126.37.170:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
—
—
—
GET
200
104.126.37.129:443
https://www.bing.com/rb/19/cir3,ortl,cc,nc/FgBbpIj0thGWZOh_xFnM9i4O7ek.css?bu=C9kK6QOVBbULmgqECowIbW1tbQ&or=w
unknown
text
19.8 Kb
—
—
—
GET
200
104.126.37.171:443
https://www.bing.com/rb/19/cir3,ortl,cc,nc/vOJNaIfAXvJzmnBm845ss-M9YR8.css?bu=B_kCWecCzwFtbYQD&or=w
unknown
text
5.97 Kb
—
—
—
GET
200
104.126.37.179:443
https://www.bing.com/rb/6i/cir3,ortl,cc,nc/wU-YmSK-j9YaNg2gj_x4wAl_UoI.css?bu=M8cKwQrNCsEKsQvBCrcLwQrBCsEKwgvBCskLwQrPC8EK1QvBCtsLwQrfCsEK5QrBCtkKwQrBCqgLwQr0CsEK-grBCu4KwQqAC4oLjQvBCsEKpQuTC8EKmQucC8EKhwzBCuELwQrADA&or=w
unknown
text
444 Kb
—
—
—
GET
200
104.126.37.163:443
https://www.bing.com/rb/6i/ortl,cc,nc/QNBBNqWD9F_Blep-UqQSqnMp-FI.css?bu=AcEK&or=w
unknown
text
6 b
—
—
—
GET
200
104.126.37.128:443
https://www.bing.com/rb/3D/ortl,cc,nc/AptopUBu7_oVDubJxwvaIprW-lI.css?bu=A4gCjAKPAg&or=w
unknown
text
15.5 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.164:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3976
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4992
SearchApp.exe
104.126.37.176:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.176
  • 104.126.37.185
  • 104.126.37.162
  • 104.126.37.178
  • 104.126.37.170
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.163
  • 104.126.37.179
  • 104.126.37.128
  • 104.126.37.129
  • 104.126.37.123
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.48.23.164
  • 23.48.23.145
  • 23.48.23.162
  • 23.48.23.150
  • 23.48.23.173
  • 23.48.23.159
  • 23.48.23.169
  • 23.48.23.177
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
self.events.data.microsoft.com
  • 20.189.173.27
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VYNLA85.zip