File name:

SubZero Download_88231676.exe

Full analysis: https://app.any.run/tasks/093eda97-c890-448a-836b-837e83a46059
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 05:59:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
generic
github
autorun-download
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

15D1C495FF66BF7CEA8A6D14BFDF0A20

SHA1:

942814521FA406A225522F208AC67F90DBDE0AE7

SHA256:

61C2C4A5D7C14F77EE88871DED4CC7F1E49DAE3E4EF209504C66FEDF4D22DE42

SSDEEP:

98304:DtjM+LgnHM8mNLNpOmMGl2p9tjIQh+1GHp8PGmDFzMVv3kdcpR41TBN14BC6SkPT:Kw8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • SubZero Download_88231676.exe (PID: 7196)
      • firefox.exe (PID: 4892)

    • Changes Windows Defender settings

      • SubzB.exe (PID: 6344)

    • Changes powershell execution policy (Bypass)

      • SubzB.exe (PID: 6344)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3900)

    • Adds path to the Windows Defender exclusion list

      • SubzB.exe (PID: 6344)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SubZero Download_88231676.exe (PID: 7196)
      • SubzB.exe (PID: 6344)

    • Start notepad (likely ransomware note)

      • SubZero Download_88231676.exe (PID: 7196)

    • There is functionality for taking screenshot (YARA)

      • SubZero Download_88231676.exe (PID: 7196)

    • Potential Corporate Privacy Violation

      • firefox.exe (PID: 4892)

    • The process bypasses the loading of PowerShell profile settings

      • SubzB.exe (PID: 6344)

    • Starts POWERSHELL.EXE for commands execution

      • SubzB.exe (PID: 6344)

    • Script adds exclusion path to Windows Defender

      • SubzB.exe (PID: 6344)

  • INFO

    • Checks proxy server information

      • SubZero Download_88231676.exe (PID: 7196)
      • BackgroundTransferHost.exe (PID: 3300)
      • SubzB.exe (PID: 6344)

    • The sample compiled with english language support

      • SubZero Download_88231676.exe (PID: 7196)

    • Checks supported languages

      • SubZero Download_88231676.exe (PID: 7196)

    • Reads the machine GUID from the registry

      • SubZero Download_88231676.exe (PID: 7196)
      • SubzB.exe (PID: 6344)

    • Reads the computer name

      • SubZero Download_88231676.exe (PID: 7196)
      • SubzB.exe (PID: 6344)

    • Creates files or folders in the user directory

      • SubZero Download_88231676.exe (PID: 7196)
      • BackgroundTransferHost.exe (PID: 3300)

    • Reads the software policy settings

      • SubZero Download_88231676.exe (PID: 7196)
      • BackgroundTransferHost.exe (PID: 3300)

    • Process checks computer location settings

      • SubZero Download_88231676.exe (PID: 7196)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8068)
      • notepad.exe (PID: 8016)
      • BackgroundTransferHost.exe (PID: 1184)
      • BackgroundTransferHost.exe (PID: 3300)
      • BackgroundTransferHost.exe (PID: 7900)
      • BackgroundTransferHost.exe (PID: 7700)

    • Manual execution by a user

      • firefox.exe (PID: 5772)

    • Application launched itself

      • firefox.exe (PID: 4892)
      • firefox.exe (PID: 5772)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 4892)

    • Disables trace logs

      • SubzB.exe (PID: 6344)

    • Autorun file from Downloads

      • firefox.exe (PID: 4892)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3900)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:18 17:00:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4353024
InitializedDataSize: 1675776
UninitializedDataSize: -
EntryPoint: 0x398c98
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Download Manager
FileVersion: 1
InternalName: Download Manager
LegalCopyright: Download Manager
OriginalFileName: Download Manager
ProductName: Download Manager
ProductVersion: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
25
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start subzero download_88231676.exe sppextcomobj.exe no specs slui.exe no specs notepad.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs firefox.exe no specs #GENERIC firefox.exe backgroundtransferhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs backgroundtransferhost.exe no specs subzb.exe no specs subzb.exe powershell.exe no specs conhost.exe no specs subzero download_88231676.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1184"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1328"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240213221259 -prefsHandle 1840 -prefMapHandle 1824 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f00b354c-eab5-4ba1-abaf-5e43ec65883f} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 15e385f1210 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
1628"C:\Users\admin\AppData\Local\Temp\SubZero Download_88231676.exe" C:\Users\admin\AppData\Local\Temp\SubZero Download_88231676.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Download Manager
Exit code:
3221226540
Version:
1
Modules
Images
c:\users\admin\appdata\local\temp\subzero download_88231676.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2136"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4948 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 4844 -prefMapHandle 3064 -prefsLen 38179 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f073792-f84c-4cbe-ab6a-4a64b890310d} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 15e417a8510 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3268"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2612 -childID 1 -isForBrowser -prefsHandle 2784 -prefMapHandle 2780 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1516 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {176bfc1c-a647-4ced-b1ff-8fcd7c0aab0b} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 15e3d19df50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
3300"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3900"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\admin\Downloads""C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—SubzB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4892"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5400"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2148 -parentBuildID 20240213221259 -prefsHandle 2128 -prefMapHandle 2116 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbdbf217-1fb8-4ce2-99e8-e2c020344e3e} 4892 "\\.\pipe\gecko-crash-server-pipe.4892" 15e2b57f310 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
Total events
22 122
Read events
22 087
Write events
35
Delete events
0

Modification events

(PID) Process:(7196) SubZero Download_88231676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7196) SubZero Download_88231676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7196) SubZero Download_88231676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7196) SubZero Download_88231676.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids
Operation:writeName:txtfile
Value:
(PID) Process:(8068) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8068) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8068) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3300) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3300) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3300) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
2
Suspicious files
158
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
7196SubZero Download_88231676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517binary
MD5:35EB5940ABB6B88A7B03C4FB81D7513F
SHA256:A82306E0A7DD7D7C575BF373C377F08D05A1AAA75E768104C92ACE1D5A67FA6D
7196SubZero Download_88231676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:83E82145F171FBA2F5F35B7AA68BAE9A
SHA256:61976A77C5F5BB27E26B475434B48231FF6A27F6F08E15ADD1E8FD1B3AFFCD1D
7196SubZero Download_88231676.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\logo[1].pngimage
MD5:2D4E9E8198F0C3EADE53C619CD1FE4EA
SHA256:C97E703578120C1F7A570ACAC3B461178A5E051CE16BE9E266C1789C1D610AC0
7196SubZero Download_88231676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B77FAD61EB4A40E3443FA60D1451BEB4_5F55BE09F9262B37AA5427711092D3D4binary
MD5:AC3F3A721E8C2B386B2D703E34F10CBE
SHA256:E5414B8F73345C420A71D182500A9A2FE7E2D29B1051A2B9E67EBBBB96FC608B
3300BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5f454260-045f-45e2-8c8c-fe58e2d8deb5.down_data —
MD5:—
SHA256:—
7196SubZero Download_88231676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:BBAC714CD8BA49057C136FB519C6CB23
SHA256:D1EE33BFA61050224F29FB7B662735630ADEF1321F2D1E303EF84DC9FC30F2B1
7196SubZero Download_88231676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
7196SubZero Download_88231676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\83D863F495E7D991917B3ABB3E1EB382_4D9C2C5E642FAF6FA3B8098AB3241EF2binary
MD5:0C653FE4C712FEFC11090C82B4B0D685
SHA256:33B7C4073173D33E3CE9D4733E58994AA208405933EA1B0229DCB9F41DBC71EF
7196SubZero Download_88231676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\83D863F495E7D991917B3ABB3E1EB382_4D9C2C5E642FAF6FA3B8098AB3241EF2binary
MD5:0923A89C5E4606054A44FAAE6FA9D150
SHA256:1D434EC158463EBFE394DF5842D8AD4DFA939F5CB2208D8A5F2ECAB9BBB2C6A1
7196SubZero Download_88231676.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517binary
MD5:C8CFD188C1BC1607392DEE494F83B57B
SHA256:4F5DBB651E22D64B2EDCA961E520EC995D92A631EBE054822452885541FC7A89
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
80
DNS requests
117
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7196
SubZero Download_88231676.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
7196
SubZero Download_88231676.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
7196
SubZero Download_88231676.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
7196
SubZero Download_88231676.exe
GET
200
142.250.185.99:80
http://o.pki.goog/s/wr3/Vdw/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEFXcf42tINpLCbnQS8S2feE%3D
unknown
—
—
whitelisted
7196
SubZero Download_88231676.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
unknown
—
—
whitelisted
7196
SubZero Download_88231676.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7196
SubZero Download_88231676.exe
GET
200
142.250.185.99:80
http://o.pki.goog/s/wr3/mV0/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEQCZXRxDEgK4oBBPRElcaU8c
unknown
—
—
whitelisted
4892
firefox.exe
POST
200
184.24.77.79:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7196
SubZero Download_88231676.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
7196
SubZero Download_88231676.exe
142.250.184.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted
7196
SubZero Download_88231676.exe
172.217.16.195:80
c.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 88.221.110.122
  • 88.221.110.114
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.130
  • 40.126.31.3
  • 20.190.159.68
  • 20.190.159.23
  • 40.126.31.130
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
www.dlsft.com
  • 35.190.60.70
unknown
ocsp.pki.goog
  • 142.250.184.227
whitelisted
c.pki.goog
  • 172.217.16.195
whitelisted
o.pki.goog
  • 142.250.185.99
whitelisted

Threats

PID
Process
Class
Message
4892
firefox.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4892
firefox.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SubZero Download_88231676.exe