File name:

184E87B6-6153-4E90-9CE8-7AE54D687DFC.zip

Full analysis: https://app.any.run/tasks/e9669922-979b-4769-955f-5a6d23c5cf31
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 26, 2025, 01:59:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
silverfox
backdoor
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

28029812B774DD1164925607393A83E3

SHA1:

0A68B83CD783B57ED2E5C72555544A9A1F5EE68B

SHA256:

626FBD5CAC2153AABC7422DC8BD94DED02E9D7EC4FA8CC29A8CBBA98E07CFE3B

SSDEEP:

98304:ksoKA0ifcR0pk9aMJYPzCXExyCfPep/S/5cw2NIa1unlpJDgLa4osoKA0ifcRw1p:+lviKK3W9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • zfon.exe (PID: 7260)
      • zfon.exe (PID: 6036)
      • zfon.exe (PID: 1628)
      • zfon.exe (PID: 920)

    • Executing a file with an untrusted certificate

      • {98111573-2325-4924-8BCF-3175A15E9D76}.exe (PID: 5972)

    • SILVERFOX mutex has been found

      • hh.exe (PID: 616)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7356)

    • The process verifies whether the antivirus software is installed

      • zfon.exe (PID: 6036)
      • zfon.exe (PID: 920)
      • zfon.exe (PID: 1628)
      • zfon.exe (PID: 7260)

    • Application launched itself

      • zfon.exe (PID: 7260)
      • zfon.exe (PID: 920)
      • zfon.exe (PID: 4012)
      • zfon.exe (PID: 7884)
      • zfon.exe (PID: 7100)
      • zfon.exe (PID: 4660)
      • zfon.exe (PID: 6056)
      • zfon.exe (PID: 5700)
      • zfon.exe (PID: 6820)
      • zfon.exe (PID: 6960)
      • zfon.exe (PID: 1280)

    • Reads security settings of Internet Explorer

      • zfon.exe (PID: 7260)

    • Reads the date of Windows installation

      • zfon.exe (PID: 7260)

    • Executable content was dropped or overwritten

      • zfon.exe (PID: 6036)

    • Executes application which crashes

      • zfon.exe (PID: 920)
      • zfon.exe (PID: 1628)
      • zfon.exe (PID: 5448)
      • zfon.exe (PID: 7884)
      • zfon.exe (PID: 7060)
      • zfon.exe (PID: 552)
      • zfon.exe (PID: 2664)
      • zfon.exe (PID: 5700)
      • zfon.exe (PID: 1280)
      • zfon.exe (PID: 7336)
      • zfon.exe (PID: 4560)

    • Likely accesses (executes) a file from the Public directory

      • {98111573-2325-4924-8BCF-3175A15E9D76}.exe (PID: 5972)

    • Connects to unusual port

      • hh.exe (PID: 616)

    • Uses REG/REGEDIT.EXE to modify registry

      • {98111573-2325-4924-8BCF-3175A15E9D76}.exe (PID: 5972)

    • The process executes via Task Scheduler

      • zfon.exe (PID: 4012)
      • zfon.exe (PID: 6056)
      • zfon.exe (PID: 6820)

  • INFO

    • The sample compiled with chinese language support

      • WinRAR.exe (PID: 7356)

    • Manual execution by a user

      • zfon.exe (PID: 7260)
      • {98111573-2325-4924-8BCF-3175A15E9D76}.exe (PID: 5972)

    • Checks supported languages

      • zfon.exe (PID: 7260)
      • zfon.exe (PID: 6036)
      • zfon.exe (PID: 920)
      • zfon.exe (PID: 1628)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7356)

    • Creates files in the program directory

      • zfon.exe (PID: 6036)

    • Reads the computer name

      • zfon.exe (PID: 6036)
      • zfon.exe (PID: 7260)

    • Process checks computer location settings

      • zfon.exe (PID: 7260)

    • Creates files or folders in the user directory

      • zfon.exe (PID: 6036)
      • WerFault.exe (PID: 1228)
      • WerFault.exe (PID: 3240)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7356)

    • Reads the software policy settings

      • slui.exe (PID: 7544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:01:04 19:57:10
ZipCRC: 0xc4c60b22
ZipCompressedSize: 663056
ZipUncompressedSize: 667748
ZipFileName: aut.png
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
203
Monitored processes
45
Malicious processes
5
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs slui.exe zfon.exe zfon.exe #SILVERFOX hh.exe zfon.exe zfon.exe werfault.exe no specs werfault.exe no specs startmenuexperiencehost.exe no specs textinputhost.exe no specs tiworker.exe no specs searchapp.exe mobsync.exe no specs {98111573-2325-4924-8bcf-3175a15e9d76}.exe no specs reg.exe no specs conhost.exe no specs zfon.exe no specs zfon.exe no specs zfon.exe zfon.exe zfon.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs zfon.exe no specs zfon.exe no specs zfon.exe zfon.exe zfon.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs rundll32.exe no specs zfon.exe no specs zfon.exe no specs zfon.exe zfon.exe zfon.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
552"C:\Users\admin\asdf421f\zfon.exe" /autC:\Users\admin\asdf421f\zfon.exe
zfon.exe
User:
admin
Company:
云蟾网络科技有限公司
Integrity Level:
HIGH
Description:
云蟾更新客户端
Exit code:
3221225477
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\asdf421f\zfon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
616C:\windows\hh.exeC:\Windows\hh.exe
zfon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\hh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
664C:\WINDOWS\system32\WerFault.exe -u -p 7060 -s 504C:\Windows\System32\WerFault.exe—zfon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
920"C:\Users\admin\asdf421f\zfon.exe" C:\Users\admin\asdf421f\zfon.exe
zfon.exe
User:
admin
Company:
云蟾网络科技有限公司
Integrity Level:
HIGH
Description:
云蟾更新客户端
Exit code:
3221225477
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\asdf421f\zfon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1228C:\WINDOWS\system32\WerFault.exe -u -p 920 -s 504C:\Windows\System32\WerFault.exe—zfon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
1276C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1280"C:\Users\admin\asdf421f\zfon.exe" C:\Users\admin\asdf421f\zfon.exe
zfon.exe
User:
admin
Company:
云蟾网络科技有限公司
Integrity Level:
HIGH
Description:
云蟾更新客户端
Exit code:
3221225477
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\asdf421f\zfon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1628C:\Users\admin\asdf421f\zfon.exe /autC:\Users\admin\asdf421f\zfon.exe
zfon.exe
User:
admin
Company:
云蟾网络科技有限公司
Integrity Level:
HIGH
Description:
云蟾更新客户端
Exit code:
3221225477
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\asdf421f\zfon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2384C:\WINDOWS\system32\WerFault.exe -u -p 5700 -s 500C:\Windows\System32\WerFault.exe—zfon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
Total events
42 997
Read events
42 793
Write events
168
Delete events
36

Modification events

(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\184E87B6-6153-4E90-9CE8-7AE54D687DFC.zip
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6036) zfon.exeKey:HKEY_CURRENT_USER\SOFTWARE\AiServer
Operation:writeName:OpenAi_Service
Value:
C:\Users\admin\asdf421f\zfon.exe
(PID) Process:(1628) zfon.exeKey:HKEY_CURRENT_USER\SOFTWARE\AiServer
Operation:writeName:OpenAi_Service
Value:
C:\Users\admin\asdf421f\zfon.exe
Executable files
13
Suspicious files
60
Text files
208
Unknown types
2

Dropped files

PID
Process
Filename
Type
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.14862\libcef.dll —
MD5:—
SHA256:—
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.17094\libcef.dll —
MD5:—
SHA256:—
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.14862\aut.pngimage
MD5:9C052FEF43CFC052B51C8F3321DBEEB8
SHA256:CE08FA71FBC8AF4D9D1FED5F247D52483FFB19792826B3B019BE115465B98BDF
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.14862\vcruntime140_1.dllexecutable
MD5:EB49C1D33B41EB49DFED58AAFA9B9A8F
SHA256:6D3A6CDE6FC4D3C79AABF785C04D2736A3E2FD9B0366C9B741F054A13ECD939E
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.14862\view.pngimage
MD5:1068E719597E4E0DAEFCF0D6DC97D2BA
SHA256:45A601337FB5703C17339C68E5D838720AD0F36D8DEAF03D40D40130792688D3
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.17094\zfon.exeexecutable
MD5:5835860464091402F7EB23734B9B441C
SHA256:6FF313C489D078274510C562C58EF3F916EE5361F344E52BA7C60D0D136A7FD3
6036zfon.exeC:\ProgramData\aut.txttext
MD5:2D282102FA671256327D4767EC23BC6B
SHA256:649B8B471E7D7BC175EEC758A7006AC693C434C8297C07DB15286788C837154A
7356WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7356.17094\MSVCP140.dllexecutable
MD5:C1B066F9E3E2F3A6785161A8C7E0346A
SHA256:99E3E25CDA404283FBD96B25B7683A8D213E7954674ADEFA2279123A8D0701FD
1228WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zfon.exe_65bc38d4153f3b5055313b5c2a9217e01c706ef5_791dc52c_fa5d1812-216d-402c-8d70-c8a407951a5e\Report.wer —
MD5:—
SHA256:—
3240WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zfon.exe_65bc38d4153f3b5055313b5c2a9217e01c706ef5_791dc52c_53d29e86-a4ff-43b5-ad99-15106ff01da6\Report.wer —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
43
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4212
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4628
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.46
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.65
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.131
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.31.131
  • 20.190.159.128
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.23
  • 40.126.31.129
  • 40.126.31.128
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
184E87B6-6153-4E90-9CE8-7AE54D687DFC.zip