File name:

Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.7z

Full analysis: https://app.any.run/tasks/168d8190-9fa7-43ed-94d1-466bf52d0b25
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: March 23, 2025, 19:30:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
ransomware
babuk
babyk
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

9BB9A37B8A86B0B2472B2F17C153B0AE

SHA1:

DFF394B6B6065FE6401DE143A3FC059371B2228D

SHA256:

4B845FB2D6B1574714F9E7F14E5ABECAD2BB0A3D27BA754C44FB7DE95E23A909

SSDEEP:

384:W7+RsJUDvFghJ59Ul+c1AtwajwRkpjc0+7JzfUuUU7eHWdnKhkTx:Wi7DvFgzLuWTi0+NwuUYeHOKc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2136)

    • Deletes shadow copies

      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 6080)

    • BABUK mutex has been found

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)

    • BABYK has been detected

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)

    • RANSOMWARE has been detected

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)

    • Renames files like ransomware

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5116)

    • Starts CMD.EXE for commands execution

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)

    • Reads security settings of Internet Explorer

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)
      • ShellExperienceHost.exe (PID: 900)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2136)

    • Reads the computer name

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)
      • ShellExperienceHost.exe (PID: 900)

    • Checks supported languages

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)
      • ShellExperienceHost.exe (PID: 900)

    • Manual execution by a user

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)
      • notepad.exe (PID: 7564)

    • Reads the machine GUID from the registry

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)

    • Process checks computer location settings

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 7564)

    • Creates files or folders in the user directory

      • Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe (PID: 864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:07:10 12:07:16+00:00
ArchivedFileName: Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs THREAT trojan-ransom.win32.babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs shellexperiencehost.exe no specs notepad.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\Users\admin\Desktop\Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
900"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
2136"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4188vssadmin.exe delete shadows /all /quietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5116C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5260\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6080"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quietC:\Windows\System32\cmd.exe—Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
6156"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quietC:\Windows\System32\cmd.exe—Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
6184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6644vssadmin.exe delete shadows /all /quietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
3 704
Read events
3 681
Write events
23
Delete events
0

Modification events

(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.7z
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
2
Suspicious files
167
Text files
161
Unknown types
0

Dropped files

PID
Process
Filename
Type
864Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe\\?\Volume{2f5c5e71-85a9-11eb-90a8-9a9b76358421}\EFI\Microsoft\Recovery\BCD.LOG2.babyk —
MD5:—
SHA256:—
864Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe\\?\Volume{2f5c5e71-85a9-11eb-90a8-9a9b76358421}\EFI\Microsoft\Recovery\BCD.LOG1.babyk —
MD5:—
SHA256:—
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2136.7434\Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exeexecutable
MD5:E5ADC80639046A5C69BCFEEE458E0833
SHA256:EA95F131BD9B49104D9E7AE83335254549DED9D71D557C6E4746740AECCA2C85
864Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exeC:\$WinREAgent\Backup\Winre.wim.babyk —
MD5:—
SHA256:—
864Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe\\?\Volume{2f5c5e71-85a9-11eb-90a8-9a9b76358421}\EFI\How To Restore Your Files.txttext
MD5:2AF817219BB1D24A11AB839B9453B5F3
SHA256:6A16454CAD4534D51025F65277ABAEC0FF4A30082840154A35889445BB3AD0A0
864Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe\\?\Volume{2f5c5e71-85a9-11eb-90a8-9a9b76358421}\EFI\Microsoft\Recovery\How To Restore Your Files.txttext
MD5:2AF817219BB1D24A11AB839B9453B5F3
SHA256:6A16454CAD4534D51025F65277ABAEC0FF4A30082840154A35889445BB3AD0A0
864Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exeC:\$WinREAgent\RollbackInfo.ini.babyktext
MD5:1BA768628572FE692830D1309623B2DB
SHA256:3E8C88C4D47E4F418D804BB8F485504B30CFD7CD5F8F773FAC679234EC411466
864Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exeC:\$WinREAgent\Scratch\update.wim.babyk —
MD5:—
SHA256:—
864Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe\\?\Volume{2f5c5e71-85a9-11eb-90a8-9a9b76358421}\EFI\Microsoft\How To Restore Your Files.txttext
MD5:2AF817219BB1D24A11AB839B9453B5F3
SHA256:6A16454CAD4534D51025F65277ABAEC0FF4A30082840154A35889445BB3AD0A0
864Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.exe\\?\Volume{2f5c5e71-85a9-11eb-90a8-9a9b76358421}\NvVars.babykbinary
MD5:1B6D8F02332E50665E5F3EBEC68915BF
SHA256:EC144DD3FD496037D3BA6EBE798246B974FA1E228EE2DA4A175CC9CD75C18565
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8080
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7432
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8080
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
6800
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7432
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.3
  • 20.190.159.68
  • 20.190.159.75
  • 20.190.159.128
  • 20.190.159.71
  • 20.190.159.2
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.59.18.102
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Babuk.a-ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85.7z