File name:

3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.zip

Full analysis: https://app.any.run/tasks/7833c1cf-f73e-434d-a75a-f27d851f4288
Verdict: Malicious activity
Analysis date: May 25, 2025, 05:03:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

8382FFC5D998D53F086325FB3D5827E5

SHA1:

70BF02CFB038FC3D2E7A208A96887410F1D44217

SHA256:

48BE60BDFE8F6A6141EB26875A464AA375230CC6E7B7ADB2BCDB51748569C595

SSDEEP:

98304:Po7VCD3VgBswk7q6jes8CglWtT9erYBZoCshmMUMDWIyBdfxVbzNr/RvjIEqE8YG:fmNjjAZPU4J3sVD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5968)

    • Changes the autorun value in the registry

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Create files in the Startup directory

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Uses Task Scheduler to autorun other applications

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Changes Windows Defender settings

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Adds path to the Windows Defender exclusion list

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Starts CMD.EXE for commands execution

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • The executable file from the user directory is run by the CMD process

      • Demon.exe (PID: 8184)
      • Demon.exe (PID: 7908)

    • Reads security settings of Internet Explorer

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)

    • Reads the date of Windows installation

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)

    • Starts POWERSHELL.EXE for commands execution

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Connects to unusual port

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)

    • Script adds exclusion path to Windows Defender

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

  • INFO

    • Manual execution by a user

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5968)

    • Reads the computer name

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • Demon.exe (PID: 8184)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)
      • Demon.exe (PID: 7908)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 5968)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Reads the machine GUID from the registry

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Failed to create an executable file in Windows directory

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)

    • Checks supported languages

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)
      • Demon.exe (PID: 8184)
      • Demon.exe (PID: 7908)

    • Creates files or folders in the user directory

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)

    • Creates files in the program directory

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Create files in a temporary directory

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)

    • Reads the software policy settings

      • slui.exe (PID: 7240)
      • slui.exe (PID: 5720)

    • Process checks computer location settings

      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 6112)
      • 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe (PID: 7704)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7444)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7444)

    • Checks proxy server information

      • slui.exe (PID: 5720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:25 05:02:50
ZipCRC: 0x24599978
ZipCompressedSize: 5613582
ZipUncompressedSize: 7591424
ZipFileName: 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
25
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs demon.exe no specs slui.exe 3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs demon.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240"schtasks" /create /tn "IpFilterDriver" /tr "C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wlidsvc.exe" /sc ONLOGON /ru "SYSTEM" /rl HIGHESTC:\Windows\System32\schtasks.exe—3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2420"schtasks" /create /tn "HidSpiCx" /tr "C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\BluetoothUserService_136e52.exe" /sc ONLOGON /ru "SYSTEM" /rl HIGHESTC:\Windows\System32\schtasks.exe—3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2504\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3900\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5720C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5968"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5988"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\admin\AppData\Local\Temp\Demon.exe"C:\Windows\System32\cmd.exe—3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
6112"C:\Users\admin\Downloads\3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe" C:\Users\admin\Downloads\3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
het0xd1py5p7b
Modules
Images
c:\users\admin\downloads\3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
10 994
Read events
10 959
Write events
22
Delete events
13

Modification events

(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.zip
(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(5968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
44
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
77043f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\SmsRouter\ScDeviceEnum\CAD\xboxgip.exeexecutable
MD5:76C3FAF31FBC45AD770DC17482B28B10
SHA256:3F5078E471686CD0A8A2E3A98D5835B988D49772C8CF512E84CCC8D18E214BDA
77043f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeC:\Users\Public\Videos\NdisCap\UdeCx\StateRepository.exeexecutable
MD5:76C3FAF31FBC45AD770DC17482B28B10
SHA256:3F5078E471686CD0A8A2E3A98D5835B988D49772C8CF512E84CCC8D18E214BDA
77043f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\AcpiPmi\WebClient\SgrmAgent\RCXF908.tmpexecutable
MD5:A93E16DE82864AC4609C2D1EF1EEE5AC
SHA256:71F33292728B555B12D928563F2EA8845A4AC1081C5B5645D56AEA0A4F44275B
77043f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\SmsRouter\ScDeviceEnum\CAD\RCXFE69.tmpexecutable
MD5:8138DBC8694E5809A251D3812594B447
SHA256:A509D67E38BD2F828EDB62B42D521A11BFA85F9C8F45463EEB251B6E69954D16
77043f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HdAudAddService.lnkbinary
MD5:0D65BF28301E57181A453C742BF26B52
SHA256:B561F68AD7B98407C965CEF4610B32507AEFD313C6C1019EEB3A5FCE51505142
5968WinRAR.exeC:\Users\admin\Downloads\3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeexecutable
MD5:76C3FAF31FBC45AD770DC17482B28B10
SHA256:3F5078E471686CD0A8A2E3A98D5835B988D49772C8CF512E84CCC8D18E214BDA
77043f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\AcpiPmi\WebClient\SgrmAgent\XblGameSave.exeexecutable
MD5:76C3FAF31FBC45AD770DC17482B28B10
SHA256:3F5078E471686CD0A8A2E3A98D5835B988D49772C8CF512E84CCC8D18E214BDA
77043f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VerifierExt.lnkbinary
MD5:1E29BF3B427CEACDF97EA39A7A280CAA
SHA256:C45ACBB9F89D7FFE2DBB10C01FB7B0AA6F2F7E714D45CC00C4D32F792F57DC39
77043f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\netvsc\kbdhid\RCXFB2.tmpexecutable
MD5:0F9C6DD9ACD109FC3DEEB0AD9B0CEC1A
SHA256:5993C8A500D87B4DAD91E0A9566DC58F18DA503FF7B4EC6247FDCD6607961818
77043f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Burn\Burn\wscsvc\diagnosticshub.standardcollector.service\AarSvc_136e52\RCX1262.tmpexecutable
MD5:13A267AE0F35BE03D687903C5ECB75D1
SHA256:223B000CF2FFEE65D5EBC76DA5C40FF2ADE7B4CC57AE4065CCBB1DB2831A2E9E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8008
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8008
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7704
3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.exe
66.245.195.83:26
—
Canopy Flow, LLC
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.181.156
whitelisted
google.com
  • 172.217.18.14
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.129
  • 40.126.31.0
  • 40.126.31.131
  • 20.190.159.75
  • 40.126.31.3
  • 20.190.159.128
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3f5078e471686cd0a8a2e3a98d5835b988d49772c8cf512e84ccc8d18e214bda.zip