File name:

zapret_build.zip

Full analysis: https://app.any.run/tasks/513f3710-f1b2-4095-adfc-f5ad9a887540
Verdict: Malicious activity
Analysis date: December 13, 2024, 15:24:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-scr
arch-doc
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

E9CAF5D3B51C2E7AA2FD6B9E84362A0C

SHA1:

932FC5785D1D49050B9DFE0323F99815A5ED69C0

SHA256:

4FC3E517B7855FDC966FDFCA0431317D5B4A22D46C757045B5070112B39F4FF4

SSDEEP:

98304:H6UYPkxljOp5lZ3BVJh/8fiuhpeFEP6th02KcUD6etsfNZPZQ2+i+4sHSXGRpljv:OPbSkdiDOYZnTUOKTPqZad4cMp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6536)

    • Detects Cygwin installation

      • WinRAR.exe (PID: 6536)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 2972)
      • net.exe (PID: 5748)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 6536)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2972)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6536)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6536)
      • cmd.exe (PID: 4596)

    • Manual execution by a user

      • cmd.exe (PID: 6856)
      • cmd.exe (PID: 2972)
      • cmd.exe (PID: 4596)
      • cmd.exe (PID: 6372)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6536)

    • UPX packer has been detected

      • winws.exe (PID: 7000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:10:17 16:12:24
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: zapret_build/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
24
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs cmd.exe no specs conhost.exe no specs winws.exe no specs winws.exe no specs winws.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs winws.exe no specs winws.exe no specs winws.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2972C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\zapret_build\create_service_discord_goodbye.cmd" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3260"C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\winws.exe" --wf-raw="@lists\rules.txt" --filter-udp=443 --hostlist="lists\list-general.txt" --dpi-desync=fake --dpi-desync-udplen-increment=10 --dpi-desync-repeats=6 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake,tamper --dpi-desync-any-protocol --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\quic_initial_www_google_com.bin" --new --filter-tcp=80 --dpi-desync=split --dpi-desync-ttl=4 --dpi-desync-fooling=md5sig --new --filter-tcp=443 --hostlist="lists\list-general.txt" --dpi-desync=fake,split2 --dpi-desync-ttl=2 --dpi-desync-split-pos=1 --dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sigC:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\winws.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\zapret_build\zapret\zapret-winws\winws.exe
c:\windows\system32\ntdll.dll
3420sc description "zapret" "zapret DPI bypass software"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3772"C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\winws.exe" --wf-raw="@lists\rules.txt" --filter-udp=443 --hostlist="lists\list-general.txt" --dpi-desync=fake --dpi-desync-udplen-increment=10 --dpi-desync-repeats=6 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake,tamper --dpi-desync-any-protocol --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\quic_initial_www_google_com.bin" --new --filter-tcp=80 --dpi-desync=split --dpi-desync-ttl=4 --dpi-desync-fooling=md5sig --new --filter-tcp=443 --hostlist="lists\list-general.txt" --dpi-desync=fake,split2 --dpi-desync-ttl=2 --dpi-desync-split-pos=1 --dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sigC:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\winws.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\zapret_build\zapret\zapret-winws\winws.exe
c:\windows\system32\ntdll.dll
4076C:\WINDOWS\system32\net1 stop "zapret"C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
4516"C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\winws.exe" --wf-raw="@lists\rules.txt" --filter-udp=443 --hostlist="lists\list-general.txt" --dpi-desync=fake --dpi-desync-udplen-increment=10 --dpi-desync-repeats=6 --dpi-desync-udplen-pattern=0xDEADBEEF --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\quic_initial_www_google_com.bin" --new --filter-udp=50000-65535 --dpi-desync=fake,tamper --dpi-desync-any-protocol --dpi-desync-fake-quic="C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\quic_initial_www_google_com.bin" --new --filter-tcp=80 --dpi-desync=split --dpi-desync-ttl=4 --dpi-desync-fooling=md5sig --new --filter-tcp=443 --hostlist="lists\list-general.txt" --dpi-desync=fake,split2 --dpi-desync-ttl=2 --dpi-desync-split-pos=1 --dpi-desync=fake,disorder2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sigC:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\winws.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\zapret_build\zapret\zapret-winws\winws.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\users\admin\desktop\zapret_build\zapret\zapret-winws\cygwin1.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4596C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\zapret_build\mgts.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4672sc create "zapret" binPath="\"C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\winws.exe\" --wf-raw=\"@C:\Users\admin\Desktop\zapret_build\lists\rules.txt\" --filter-udp=443 --hostlist=\"C:\Users\admin\Desktop\zapret_build\lists\list-discord.txt\" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic=\"C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\quic_initial_www_google_com.bin\" --new --filter-udp=50000-65535 --dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-cutoff=d3 --dpi-desync-repeats=6 --dpi-desync-fake-quic=\"C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\quic_initial_www_google_com.bin\" --new --filter-tcp=443 --hostlist=\"C:\Users\admin\Desktop\zapret_build\lists\list-discord.txt\" --dpi-desync=fake,split --dpi-desync-autottl=2 --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=\"C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\tls_clienthello_www_google_com.bin\"" DisplayName="zapret DPI bypass: Discord (GoodbyeDPI)" start=auto depend="GoodbyeDPI"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
5
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5000sc delete "zapret"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5548sc start "zapret"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
2 868
Read events
2 856
Write events
12
Delete events
0

Modification events

(PID) Process:(6536) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6536) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6536) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6536) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\zapret_build.zip
(PID) Process:(6536) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6536) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6536) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6536) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7000) winws.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\WinDivert
Operation:writeName:EventMessageFile
Value:
C:\Users\admin\Desktop\zapret_build\zapret\zapret-winws\WinDivert64.sys
(PID) Process:(7000) winws.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\WinDivert
Operation:writeName:TypesSupported
Value:
7
Executable files
143
Suspicious files
190
Text files
73
Unknown types
3

Dropped files

PID
Process
Filename
Type
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\discord.battext
MD5:16C7BB99BA93AC058F3EC4188D8D4A8D
SHA256:7373867722E2618B809FCED190D15188DA926DC20C64DC24ED231DFBA5B40FC0
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\create_service_discord_goodbye.cmdtext
MD5:7BFDCECD62053A57AD095E1D35527354
SHA256:C58D6DA183C32BD012303A98D60434F059C7A211E31CA07210F25D1BDA8039FD
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\lists\list-discord.txttext
MD5:C3BFC48C92E5BF637073300BF7FA2D89
SHA256:DD108096CE5D89CF94273BED34D3280F1B72DED285917E628EEF53EEB2A53032
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\extended.battext
MD5:BC9D08055ADC8A6FB747C81A75D7B443
SHA256:212EAA0C00A3C54E77AFF45D65B71175CF8CC4E4EED843159D12027AC9928205
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\lists\list-youtube.txttext
MD5:A33C3A6C0469EC472A25CC3CDF91FFE5
SHA256:079E524C8B19DCF75C8ACF1B7A2C266B1F967D1FDDCA2E422183A0BBA73A0EFB
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\lists\list-general.txttext
MD5:A03D2C9945CD2C801C3CE17519513BE9
SHA256:0D1ABA287A4DBE47A4F077E527C34FACC459DFA715CD89E990C8C5FC4C9C672F
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\mgts.battext
MD5:D21A15E45CA079CFAAE968D3DCE549BA
SHA256:8D4AE506F99B5187157DE99FB2979B9224670AB7D20727AC4BFEC8F4D6B9C863
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\general.battext
MD5:12FF6B5E3CD58C225DE766DD4F6E350D
SHA256:739E4478D46FD81ECA9C51C843C0DD321E41B440DC252BCBE941840838AF386D
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\zapret\blockcheck\cygwin\bin\basename.exeexecutable
MD5:88910994D984FE1EC33239D4AA91CCEF
SHA256:1D36AF5EF59CF397DE184E23B4C9A32C2FBD4D0AA8E33309578E400976E42244
6536WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6536.27568\zapret_build\zapret\blockcheck\cygwin\bin\awktext
MD5:11E6D956542C3DCBD393F274F1090297
SHA256:96B5687E64A6B4B5692CB9344F0D4B239C549FD88BC5599C2E3560D6E3E81F4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
34
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4
System
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4
System
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
132
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
132
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
92.123.104.43:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.138:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
23.48.23.138:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.bing.com
  • 92.123.104.43
  • 92.123.104.64
  • 92.123.104.51
  • 92.123.104.63
  • 92.123.104.47
  • 92.123.104.65
  • 92.123.104.40
  • 92.123.104.59
  • 92.123.104.62
whitelisted
crl.microsoft.com
  • 23.48.23.138
  • 23.48.23.146
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.181.238
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.64
  • 40.126.31.69
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.23
whitelisted
go.microsoft.com
  • 69.192.162.125
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zapret_build.zip