File name:

184E87B6-6153-4E90-9CE8-7AE54D687DFC.zip

Full analysis: https://app.any.run/tasks/e9669922-979b-4769-955f-5a6d23c5cf31
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 26, 2025, 01:59:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
silverfox
backdoor
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

28029812B774DD1164925607393A83E3

SHA1:

0A68B83CD783B57ED2E5C72555544A9A1F5EE68B

SHA256:

626FBD5CAC2153AABC7422DC8BD94DED02E9D7EC4FA8CC29A8CBBA98E07CFE3B

SSDEEP:

98304:ksoKA0ifcR0pk9aMJYPzCXExyCfPep/S/5cw2NIa1unlpJDgLa4osoKA0ifcRw1p:+lviKK3W9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • zfon.exe (PID: 7260)
      • zfon.exe (PID: 6036)
      • zfon.exe (PID: 920)
      • zfon.exe (PID: 1628)

    • SILVERFOX mutex has been found

      • hh.exe (PID: 616)

    • Executing a file with an untrusted certificate

      • {98111573-2325-4924-8BCF-3175A15E9D76}.exe (PID: 5972)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7356)

    • The process verifies whether the antivirus software is installed

      • zfon.exe (PID: 7260)
      • zfon.exe (PID: 6036)
      • zfon.exe (PID: 920)
      • zfon.exe (PID: 1628)

    • Application launched itself

      • zfon.exe (PID: 7260)
      • zfon.exe (PID: 920)
      • zfon.exe (PID: 4012)
      • zfon.exe (PID: 6056)
      • zfon.exe (PID: 7100)
      • zfon.exe (PID: 7884)
      • zfon.exe (PID: 4660)
      • zfon.exe (PID: 5700)
      • zfon.exe (PID: 6820)
      • zfon.exe (PID: 6960)
      • zfon.exe (PID: 1280)

    • Reads security settings of Internet Explorer

      • zfon.exe (PID: 7260)

    • Reads the date of Windows installation

      • zfon.exe (PID: 7260)

    • Executes application which crashes

      • zfon.exe (PID: 920)
      • zfon.exe (PID: 1628)
      • zfon.exe (PID: 2664)
      • zfon.exe (PID: 5448)
      • zfon.exe (PID: 7884)
      • zfon.exe (PID: 5700)
      • zfon.exe (PID: 7060)
      • zfon.exe (PID: 552)
      • zfon.exe (PID: 1280)
      • zfon.exe (PID: 4560)
      • zfon.exe (PID: 7336)

    • Executable content was dropped or overwritten

      • zfon.exe (PID: 6036)

    • The process executes via Task Scheduler

      • zfon.exe (PID: 4012)
      • zfon.exe (PID: 6056)
      • zfon.exe (PID: 6820)

    • Likely accesses (executes) a file from the Public directory

      • {98111573-2325-4924-8BCF-3175A15E9D76}.exe (PID: 5972)

    • Uses REG/REGEDIT.EXE to modify registry

      • {98111573-2325-4924-8BCF-3175A15E9D76}.exe (PID: 5972)

    • Connects to unusual port

      • hh.exe (PID: 616)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7356)

    • The sample compiled with chinese language support

      • WinRAR.exe (PID: 7356)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7356)

    • Reads the software policy settings

      • slui.exe (PID: 7544)

    • Manual execution by a user

      • zfon.exe (PID: 7260)
      • {98111573-2325-4924-8BCF-3175A15E9D76}.exe (PID: 5972)

    • Checks supported languages

      • zfon.exe (PID: 7260)
      • zfon.exe (PID: 6036)
      • zfon.exe (PID: 920)
      • zfon.exe (PID: 1628)

    • Creates files in the program directory

      • zfon.exe (PID: 6036)

    • Reads the computer name

      • zfon.exe (PID: 6036)
      • zfon.exe (PID: 7260)

    • Creates files or folders in the user directory

      • zfon.exe (PID: 6036)
      • WerFault.exe (PID: 1228)
      • WerFault.exe (PID: 3240)

    • Process checks computer location settings

      • zfon.exe (PID: 7260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:01:04 19:57:10
ZipCRC: 0xc4c60b22
ZipCompressedSize: 663056
ZipUncompressedSize: 667748
ZipFileName: aut.png
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
203
Monitored processes
45
Malicious processes
5
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs slui.exe zfon.exe zfon.exe #SILVERFOX hh.exe zfon.exe zfon.exe werfault.exe no specs werfault.exe no specs startmenuexperiencehost.exe no specs textinputhost.exe no specs tiworker.exe no specs searchapp.exe mobsync.exe no specs {98111573-2325-4924-8bcf-3175a15e9d76}.exe no specs reg.exe no specs conhost.exe no specs zfon.exe no specs zfon.exe no specs zfon.exe zfon.exe zfon.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs zfon.exe no specs zfon.exe no specs zfon.exe zfon.exe zfon.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs rundll32.exe no specs zfon.exe no specs zfon.exe no specs zfon.exe zfon.exe zfon.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
552"C:\Users\admin\asdf421f\zfon.exe" /autC:\Users\admin\asdf421f\zfon.exe
zfon.exe
User:
admin
Company:
云蟾网络科技有限公司
Integrity Level:
HIGH
Description:
云蟾更新客户端
Exit code:
3221225477
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\asdf421f\zfon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
616C:\windows\hh.exeC:\Windows\hh.exe
zfon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\hh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
664C:\WINDOWS\system32\WerFault.exe -u -p 7060 -s 504C:\Windows\System32\WerFault.exe—zfon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
920"C:\Users\admin\asdf421f\zfon.exe" C:\Users\admin\asdf421f\zfon.exe
zfon.exe
User:
admin
Company:
云蟾网络科技有限公司
Integrity Level:
HIGH
Description:
云蟾更新客户端
Exit code:
3221225477
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\asdf421f\zfon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1228C:\WINDOWS\system32\WerFault.exe -u -p 920 -s 504C:\Windows\System32\WerFault.exe—zfon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
1276C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1280"C:\Users\admin\asdf421f\zfon.exe" C:\Users\admin\asdf421f\zfon.exe
zfon.exe
User:
admin
Company:
云蟾网络科技有限公司
Integrity Level:
HIGH
Description:
云蟾更新客户端
Exit code:
3221225477
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\asdf421f\zfon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1628C:\Users\admin\asdf421f\zfon.exe /autC:\Users\admin\asdf421f\zfon.exe
zfon.exe
User:
admin
Company:
云蟾网络科技有限公司
Integrity Level:
HIGH
Description:
云蟾更新客户端
Exit code:
3221225477
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\asdf421f\zfon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2384C:\WINDOWS\system32\WerFault.exe -u -p 5700 -s 500C:\Windows\System32\WerFault.exe—zfon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
Total events
42 997
Read events
42 793
Write events
168
Delete events
36

Modification events

(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\184E87B6-6153-4E90-9CE8-7AE54D687DFC.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6036) zfon.exeKey:HKEY_CURRENT_USER\SOFTWARE\AiServer
Operation:writeName:OpenAi_Service
Value:
C:\Users\admin\asdf421f\zfon.exe
(PID) Process:(1628) zfon.exeKey:HKEY_CURRENT_USER\SOFTWARE\AiServer
Operation:writeName:OpenAi_Service
Value:
C:\Users\admin\asdf421f\zfon.exe
Executable files
13
Suspicious files
60
Text files
208
Unknown types
2

Dropped files

PID
Process
Filename
Type
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.14862\libcef.dll —
MD5:—
SHA256:—
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.17094\libcef.dll —
MD5:—
SHA256:—
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.14862\vcruntime140_1.dllexecutable
MD5:EB49C1D33B41EB49DFED58AAFA9B9A8F
SHA256:6D3A6CDE6FC4D3C79AABF785C04D2736A3E2FD9B0366C9B741F054A13ECD939E
6036zfon.exeC:\Users\Public\Downloads\{98111573-2325-4924-8BCF-3175A15E9D76}.exeexecutable
MD5:6C44A0500E7266F48A68555665D00935
SHA256:45CDF68970B3A08880DF75EF68063BD97571106B296FC32E629AA587BC9B470A
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.14862\zfon.exeexecutable
MD5:5835860464091402F7EB23734B9B441C
SHA256:6FF313C489D078274510C562C58EF3F916EE5361F344E52BA7C60D0D136A7FD3
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.14862\view.pngimage
MD5:1068E719597E4E0DAEFCF0D6DC97D2BA
SHA256:45A601337FB5703C17339C68E5D838720AD0F36D8DEAF03D40D40130792688D3
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.17094\view.pngimage
MD5:1068E719597E4E0DAEFCF0D6DC97D2BA
SHA256:45A601337FB5703C17339C68E5D838720AD0F36D8DEAF03D40D40130792688D3
6036zfon.exeC:\ProgramData\MyLnk\zfon.lnkbinary
MD5:D32C0C99BF0EC72BD18E7F712EC0AC43
SHA256:F47CF6F2F178323609E1BD82ABF7E7202792E17D165A0D108BB2A14BED5B63FB
1228WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zfon.exe_65bc38d4153f3b5055313b5c2a9217e01c706ef5_791dc52c_fa5d1812-216d-402c-8d70-c8a407951a5e\Report.wer —
MD5:—
SHA256:—
3240WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zfon.exe_65bc38d4153f3b5055313b5c2a9217e01c706ef5_791dc52c_53d29e86-a4ff-43b5-ad99-15106ff01da6\Report.wer —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
43
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4212
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4628
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.46
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.65
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.131
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.31.131
  • 20.190.159.128
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.23
  • 40.126.31.129
  • 40.126.31.128
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
184E87B6-6153-4E90-9CE8-7AE54D687DFC.zip