File name:

Bandizip Professional 7.33 (x64).zip

Full analysis: https://app.any.run/tasks/e57c6188-c93e-4617-a612-9914d8764f3d
Verdict: Malicious activity
Analysis date: February 23, 2025, 18:43:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
mpress
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

F2FE6D74F52BA39C6656B91E232D5A3E

SHA1:

D4E386F071316E9E3C78BADF9C08744F5B10CD00

SHA256:

4F15E8FC35D6DB63A5759BD8A904135A9DA5CC7079CB726EDC13FE2291B89A33

SSDEEP:

98304:VjHQrrFe6ToREw+qcfMlpFgAbpGp5ReagpqLqOYkmvDFqdrTQ34ChLFAkoVbenqB:W49egR/HbzgQtt+rhJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6372)

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 2728)
      • Setup.exe (PID: 3224)
      • Bandizip.exe (PID: 1576)
      • RegDll.x86.exe (PID: 1344)
      • RegDll.x86.exe (PID: 2512)
      • RegDll.x86.exe (PID: 4052)
      • RegDll.x86.exe (PID: 5540)
      • RegDll.x64.exe (PID: 4984)
      • RegDll.x64.exe (PID: 4528)
      • RegDll.x64.exe (PID: 5872)
      • RegDll.x64.exe (PID: 5748)
      • Bandizip.exe (PID: 6344)
      • Bandizip.exe (PID: 4540)
      • web32.exe (PID: 6896)
      • Updater.exe (PID: 5432)
      • Bandizip.exe (PID: 536)
      • RegPackage.x86.exe (PID: 7104)
      • Bandizip.exe (PID: 3524)
      • web32.exe (PID: 776)
      • web32.exe (PID: 5568)
      • RegDll.x86.exe (PID: 4932)
      • RegPackage.x86.exe (PID: 2164)
      • Amsiman.x64.exe (PID: 4912)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6372)
      • Setup.exe (PID: 2728)
      • Bandizip.exe (PID: 6344)
      • Updater.exe (PID: 5432)
      • web32.exe (PID: 6896)
      • Bandizip.exe (PID: 536)
      • Bandizip.exe (PID: 3524)

    • Checks Windows Trust Settings

      • Setup.exe (PID: 2728)
      • Updater.exe (PID: 5432)
      • web32.exe (PID: 6896)
      • Bandizip.exe (PID: 536)
      • Bandizip.exe (PID: 3524)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2728)
      • dllhost.exe (PID: 1596)

    • Changes Internet Explorer settings (feature browser emulation)

      • RegDll.x86.exe (PID: 1344)
      • RegDll.x86.exe (PID: 2512)
      • RegDll.x86.exe (PID: 4052)

    • Creates/Modifies COM task schedule object

      • RegDll.x86.exe (PID: 5540)
      • RegDll.x64.exe (PID: 5872)

    • Reads the date of Windows installation

      • RegDll.x64.exe (PID: 4528)
      • Bandizip.exe (PID: 6344)

    • Creates a software uninstall entry

      • Setup.exe (PID: 2728)

    • Reads Microsoft Outlook installation path

      • Updater.exe (PID: 5432)
      • web32.exe (PID: 6896)

    • Reads Internet Explorer settings

      • Updater.exe (PID: 5432)
      • web32.exe (PID: 6896)

    • Application launched itself

      • Bandizip.exe (PID: 6344)

  • INFO

    • Local mutex for internet shortcut management

      • WinRAR.exe (PID: 6372)

    • Manual execution by a user

      • Setup.exe (PID: 3224)
      • Setup.exe (PID: 2728)
      • RegDll.x64.exe (PID: 4528)
      • Bandizip.exe (PID: 6344)
      • Bandizip.exe (PID: 3524)
      • notepad++.exe (PID: 5748)
      • notepad.exe (PID: 4384)
      • web32.exe (PID: 776)
      • web32.exe (PID: 5568)
      • Amsiman.x64.exe (PID: 4912)
      • RegDll.x86.exe (PID: 4932)
      • RegPackage.x86.exe (PID: 2164)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6372)

    • Checks proxy server information

      • Setup.exe (PID: 2728)
      • Bandizip.exe (PID: 6344)
      • Updater.exe (PID: 5432)
      • web32.exe (PID: 6896)
      • Bandizip.exe (PID: 536)
      • Bandizip.exe (PID: 3524)

    • Checks supported languages

      • Setup.exe (PID: 2728)
      • Bandizip.exe (PID: 1576)
      • RegDll.x86.exe (PID: 1344)
      • RegDll.x86.exe (PID: 2512)
      • RegDll.x86.exe (PID: 4052)
      • RegDll.x86.exe (PID: 5540)
      • RegDll.x64.exe (PID: 5872)
      • RegDll.x64.exe (PID: 5748)
      • RegDll.x64.exe (PID: 4528)
      • Bandizip.exe (PID: 6344)
      • RegDll.x64.exe (PID: 4984)
      • Bandizip.exe (PID: 4540)
      • web32.exe (PID: 6896)
      • Updater.exe (PID: 5432)
      • Bandizip.exe (PID: 536)
      • RegPackage.x86.exe (PID: 7104)
      • Bandizip.exe (PID: 3524)
      • web32.exe (PID: 776)
      • web32.exe (PID: 5568)
      • RegPackage.x86.exe (PID: 2164)
      • Amsiman.x64.exe (PID: 4912)
      • RegDll.x86.exe (PID: 4932)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6372)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 2728)
      • RegDll.x64.exe (PID: 4528)
      • web32.exe (PID: 6896)
      • Updater.exe (PID: 5432)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 2728)
      • Updater.exe (PID: 5432)
      • web32.exe (PID: 6896)
      • Bandizip.exe (PID: 536)
      • Bandizip.exe (PID: 3524)

    • Reads the computer name

      • Setup.exe (PID: 2728)
      • RegDll.x64.exe (PID: 4528)
      • web32.exe (PID: 6896)
      • Bandizip.exe (PID: 6344)
      • Updater.exe (PID: 5432)
      • RegPackage.x86.exe (PID: 7104)
      • Bandizip.exe (PID: 536)
      • Bandizip.exe (PID: 3524)
      • RegPackage.x86.exe (PID: 2164)
      • Amsiman.x64.exe (PID: 4912)
      • RegDll.x86.exe (PID: 4932)

    • Reads the software policy settings

      • Setup.exe (PID: 2728)
      • Updater.exe (PID: 5432)
      • web32.exe (PID: 6896)
      • Bandizip.exe (PID: 536)
      • Bandizip.exe (PID: 3524)

    • Creates files in the program directory

      • Setup.exe (PID: 2728)

    • The sample compiled with korean language support

      • Setup.exe (PID: 2728)

    • Process checks computer location settings

      • RegDll.x64.exe (PID: 4528)
      • Bandizip.exe (PID: 6344)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 1596)
      • notepad.exe (PID: 4384)

    • Create files in a temporary directory

      • Bandizip.exe (PID: 3524)

    • Mpress packer has been detected

      • Bandizip.exe (PID: 3524)

    • UPX packer has been detected

      • Bandizip.exe (PID: 3524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:02:23 21:34:50
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Crack/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
28
Malicious processes
8
Suspicious processes
15

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs setup.exe no specs setup.exe bandizip.exe no specs regdll.x86.exe no specs regdll.x86.exe no specs regdll.x86.exe no specs regdll.x86.exe no specs regdll.x64.exe no specs regdll.x64.exe no specs regdll.x64.exe no specs regdll.x64.exe no specs bandizip.exe no specs bandizip.exe no specs updater.exe web32.exe bandizip.exe regpackage.x86.exe no specs Copy/Move/Rename/Delete/Link Object bandizip.exe notepad++.exe notepad.exe no specs web32.exe no specs web32.exe no specs regdll.x86.exe no specs regpackage.x86.exe no specs amsiman.x64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Program Files\Bandizip\Bandizip.exe" C:\Program Files\Bandizip\Bandizip.exe
Bandizip.exe
User:
admin
Company:
Bandisoft International Inc.
Integrity Level:
MEDIUM
Description:
Bandizip
Exit code:
0
Version:
7.33.0.1
Modules
Images
c:\program files\bandizip\bandizip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
776"C:\Program Files\Bandizip\data\web32.exe" C:\Program Files\Bandizip\data\web32.exe—explorer.exe
User:
admin
Company:
Bandisoft.com
Integrity Level:
MEDIUM
Description:
Web32 web control process
Exit code:
2
Version:
1.0.0.1
Modules
Images
c:\program files\bandizip\data\web32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1344"C:\Program Files\Bandizip\data\RegDll.x86.exe" /regieemulation Bandizip.exeC:\Program Files\Bandizip\data\RegDll.x86.exe—Setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\bandizip\data\regdll.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1576"C:\Program Files\Bandizip\Bandizip.exe" /regmandatoryadminC:\Program Files\Bandizip\Bandizip.exe—Setup.exe
User:
admin
Company:
Bandisoft International Inc.
Integrity Level:
HIGH
Description:
Bandizip
Exit code:
0
Version:
7.33.0.1
Modules
Images
c:\program files\bandizip\bandizip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1596C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2164"C:\Program Files\Bandizip\data\RegPackage.x86.exe" C:\Program Files\Bandizip\data\RegPackage.x86.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
286326785
Modules
Images
c:\program files\bandizip\data\regpackage.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2512"C:\Program Files\Bandizip\data\RegDll.x86.exe" /regieemulation Updater.exeC:\Program Files\Bandizip\data\RegDll.x86.exe—Setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\bandizip\data\regdll.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2728"C:\Users\admin\Desktop\Bandizip Professional 7.33 (x64)\Setup\Setup.exe" C:\Users\admin\Desktop\Bandizip Professional 7.33 (x64)\Setup\Setup.exe
explorer.exe
User:
admin
Company:
Bandisoft
Integrity Level:
HIGH
Description:
Bandizip 7.33 0 Setup
Exit code:
0
Version:
7.33
Modules
Images
c:\users\admin\desktop\bandizip professional 7.33 (x64)\setup\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3224"C:\Users\admin\Desktop\Bandizip Professional 7.33 (x64)\Setup\Setup.exe" C:\Users\admin\Desktop\Bandizip Professional 7.33 (x64)\Setup\Setup.exe—explorer.exe
User:
admin
Company:
Bandisoft
Integrity Level:
MEDIUM
Description:
Bandizip 7.33 0 Setup
Exit code:
3221226540
Version:
7.33
Modules
Images
c:\users\admin\desktop\bandizip professional 7.33 (x64)\setup\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3524"C:\Program Files\Bandizip\Bandizip.exe" C:\Program Files\Bandizip\Bandizip.exe
explorer.exe
User:
admin
Company:
Bandisoft International Inc.
Integrity Level:
MEDIUM
Description:
Bandizip
Version:
7.33.0.1
Modules
Images
c:\program files\bandizip\bandizip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
13 830
Read events
12 139
Write events
1 676
Delete events
15

Modification events

(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Bandizip Professional 7.33 (x64).zip
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6372) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
25
Suspicious files
61
Text files
49
Unknown types
0

Dropped files

PID
Process
Filename
Type
6372WinRAR.exeC:\Users\admin\Desktop\Bandizip Professional 7.33 (x64)\Crack\Bandizip.exeexecutable
MD5:F7E6FFF2FB2AA299E027A6EA0789E9E5
SHA256:0A171633DBF3659CBEAF43FFE8B6ADAE9DA3F02B127F39CFDD939D0F38411D46
2728Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:7367C4E9FA9D5B89CC2072FD24581695
SHA256:864CBAF6F6681E069018624BCCE17775059172B9CCC5A06328652DD640698D64
6372WinRAR.exeC:\Users\admin\Desktop\Bandizip Professional 7.33 (x64)\HaxNode.Net.urlbinary
MD5:D2DBDD8CC5165FF6E4122B9F15B82EE9
SHA256:CB92547DBACFB6D6C102C2C0ED1D280C6AEA32210F280A85CE01BCEAC765C91E
6372WinRAR.exeC:\Users\admin\Desktop\Bandizip Professional 7.33 (x64)\Setup\Setup.exeexecutable
MD5:E30461839158144FF5AC897D2E7A96C1
SHA256:E20BD0A77802EFE4274FDDB7198977AF6B0FE01845B4E1776052881B267B1AA5
2728Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\035E52AEDA0CBD41F7A1EE1F14E33688binary
MD5:9477BE617479F833549DA6322F9486BA
SHA256:CA27232C373DFEE29E8FBA8E2E7DA136B876FEDC3ED560920193CC5472C471CE
6372WinRAR.exeC:\Users\admin\Desktop\Bandizip Professional 7.33 (x64)\Crack\Crack.zipcompressed
MD5:7E680EC30A261A2BFFDFCD9DC464DC14
SHA256:4123BDD28EC70F43A7D4D326CD8EB63DAEE05E149FF7C6882CD557C535D7BC24
6372WinRAR.exeC:\Users\admin\Desktop\Bandizip Professional 7.33 (x64)\Read Me.txttext
MD5:27F7E9FE736B1D8EFB645A6B4166CFB0
SHA256:71C9D8EB468EB555BA692249F55FFB37B96EE5BFDFCAA07C90BF790C8D04C22A
2728Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:C9FE32E693620E2CCD1AAF1BBBB2ACDF
SHA256:9E366B9C72A9E9550597F5C7C3B7E27483A2BCC9B061887BCD6F66357F67AC58
2728Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:0CB76E0439CD88EB91C9CFC1F779060C
SHA256:D1444AB750204141AF3D4BD1086A41752384DB8E9983DF0689B5B451E8804D44
2728Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\035E52AEDA0CBD41F7A1EE1F14E33688binary
MD5:5E29D4CE2A2E4954697BA3E4B6712DC3
SHA256:668CA1875E8D96DA93428A487323012E551C0F07EA026A532DE29BAD45A97C00
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
48
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.164:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6600
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2728
Setup.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
2728
Setup.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
5432
Updater.exe
GET
200
142.250.181.227:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
2728
Setup.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHby99qPBsQR44pGbdwfRPc%3D
unknown
—
—
whitelisted
5432
Updater.exe
GET
200
142.250.181.227:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5564
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2324
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.164:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
92.123.104.32:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.164
  • 23.48.23.143
  • 23.48.23.162
  • 23.48.23.166
  • 23.48.23.156
  • 23.48.23.139
  • 23.48.23.140
  • 23.48.23.147
  • 23.48.23.150
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.52.120.96
whitelisted
www.bing.com
  • 92.123.104.32
  • 92.123.104.59
  • 92.123.104.11
  • 92.123.104.62
  • 92.123.104.8
  • 92.123.104.33
  • 92.123.104.19
  • 92.123.104.52
  • 92.123.104.44
whitelisted
google.com
  • 142.250.181.238
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.72
  • 20.190.160.4
  • 20.190.160.67
  • 20.190.160.20
  • 20.190.160.3
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: error while getting certificate informations
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bandizip Professional 7.33 (x64).zip