File name:

Urgent Contract Action.exe

Full analysis: https://app.any.run/tasks/912c88ae-e57a-4392-8242-5735a7a43b9f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 16, 2025, 19:29:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
badrabbit
ransomware
webdav
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

FBBDC39AF1139AEBBA4DA004475E8839

SHA1:

DE5C8D858E6E41DA715DCA1C019DF0BFB92D32C0

SHA256:

630325CAC09AC3FAB908F903E3B00D0DADD5FDAA0875ED8496FCBB97A558D0DA

SSDEEP:

12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Urgent Contract Action.exe (PID: 7484)
      • Urgent Contract Action.exe (PID: 7568)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7868)
      • cmd.exe (PID: 7960)

    • BADRABBIT has been detected

      • Urgent Contract Action.exe (PID: 7568)
      • rundll32.exe (PID: 7640)

    • WebDav connection (SURICATA)

      • rundll32.exe (PID: 7640)

    • Scans artifacts that could help determine the target

      • MSACCESS.EXE (PID: 7572)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Urgent Contract Action.exe (PID: 7568)
      • rundll32.exe (PID: 7640)

    • Starts application with an unusual extension

      • rundll32.exe (PID: 7640)

    • Connects to the server without a host name

      • rundll32.exe (PID: 7640)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 7724)

    • Starts CMD.EXE for commands execution

      • rundll32.exe (PID: 7640)

    • Potential Corporate Privacy Violation

      • rundll32.exe (PID: 7640)

    • Reads security settings of Internet Explorer

      • MSACCESS.EXE (PID: 7572)

    • Reads the date of Windows installation

      • MSACCESS.EXE (PID: 7572)

  • INFO

    • The sample compiled with english language support

      • Urgent Contract Action.exe (PID: 7568)

    • Checks supported languages

      • Urgent Contract Action.exe (PID: 7568)
      • CC0C.tmp (PID: 8016)
      • MSACCESS.EXE (PID: 7572)

    • Checks proxy server information

      • rundll32.exe (PID: 7640)
      • MSACCESS.EXE (PID: 7572)
      • slui.exe (PID: 7184)

    • Manual execution by a user

      • mspaint.exe (PID: 3784)
      • mspaint.exe (PID: 5956)
      • MSACCESS.EXE (PID: 7572)

    • Reads the software policy settings

      • slui.exe (PID: 7792)
      • MSACCESS.EXE (PID: 7572)
      • slui.exe (PID: 7184)

    • Reads the computer name

      • MSACCESS.EXE (PID: 7572)

    • Reads Microsoft Office registry keys

      • MSACCESS.EXE (PID: 7572)

    • Reads product name

      • MSACCESS.EXE (PID: 7572)

    • Process checks computer location settings

      • MSACCESS.EXE (PID: 7572)

    • Create files in a temporary directory

      • MSACCESS.EXE (PID: 7572)

    • Reads Environment values

      • MSACCESS.EXE (PID: 7572)

    • Creates files or folders in the user directory

      • MSACCESS.EXE (PID: 7572)

    • Reads CPU info

      • MSACCESS.EXE (PID: 7572)

    • Reads the machine GUID from the registry

      • MSACCESS.EXE (PID: 7572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:10:22 02:33:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 12288
InitializedDataSize: 43520
UninitializedDataSize: -
EntryPoint: 0x12c0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows command line
FileVersionNumber: 27.0.0.170
ProductVersionNumber: 27.0.0.170
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Adobe Systems Incorporated
FileDescription: Adobe® Flash® Player Installer/Uninstaller 27.0 r0
FileVersion: 27,0,0,170
InternalName: Adobe® Flash® Player Installer/Uninstaller 27.0
LegalCopyright: Copyright © 1996-2017 Adobe Systems Incorporated
LegalTrademarks: Adobe® Flash® Player
OriginalFileName: FlashUtil.exe
ProductName: Adobe® Flash® Player Installer/Uninstaller
ProductVersion: 27,0,0,170
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
22
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #BADRABBIT urgent contract action.exe conhost.exe no specs #BADRABBIT rundll32.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cc0c.tmp no specs conhost.exe no specs schtasks.exe no specs mspaint.exe no specs mspaint.exe no specs slui.exe rundll32.exe no specs msaccess.exe urgent contract action.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2100C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3784"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\asianships.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5956"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\accountslonger.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7184C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7484"C:\Users\admin\Desktop\Urgent Contract Action.exe" C:\Users\admin\Desktop\Urgent Contract Action.exe—explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 27.0 r0
Exit code:
3221226540
Version:
27,0,0,170
Modules
Images
c:\users\admin\desktop\urgent contract action.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7568"C:\Users\admin\Desktop\Urgent Contract Action.exe" C:\Users\admin\Desktop\Urgent Contract Action.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
HIGH
Description:
Adobe® Flash® Player Installer/Uninstaller 27.0 r0
Exit code:
0
Version:
27,0,0,170
Modules
Images
c:\users\admin\desktop\urgent contract action.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7572"C:\Program Files\Microsoft Office\Root\Office16\MSACCESS.EXE" /NOSTARTUP "C:\Users\admin\Documents\Database1.accdb" C:\Program Files\Microsoft Office\root\Office16\MSACCESS.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Access
Exit code:
3221225547
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\msaccess.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7580\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Urgent Contract Action.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7640C:\WINDOWS\system32\rundll32.exe C:\Windows\infpub.dat,#1 15C:\Windows\SysWOW64\rundll32.exe
Urgent Contract Action.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7672/c schtasks /Delete /F /TN rhaegalC:\Windows\SysWOW64\cmd.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
8 458
Read events
8 007
Write events
411
Delete events
40

Modification events

(PID) Process:(7640) rundll32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}
Operation:writeName:LowerFilters
Value:
cscc
(PID) Process:(7640) rundll32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e965-e325-11ce-bfc1-08002be10318}
Operation:writeName:UpperFilters
Value:
cscc
(PID) Process:(7640) rundll32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl
Operation:writeName:DumpFilters
Value:
cscc
(PID) Process:(3784) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:WindowPlacement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF4E0000004E0000000E04000037020000
(PID) Process:(3784) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowThumbnail
Value:
0
(PID) Process:(3784) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPWidth
Value:
0
(PID) Process:(3784) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPHeight
Value:
0
(PID) Process:(3784) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbXPos
Value:
0
(PID) Process:(3784) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbYPos
Value:
0
(PID) Process:(3784) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbWidth
Value:
0
Executable files
4
Suspicious files
16
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
7640rundll32.exeC:\Windows\dispci.exeexecutable
MD5:B14D8FAF7F0CBCFAD051CEFE5F39645F
SHA256:8EBC97E05C8E1073BDA2EFB6F4D00AD7E789260AFA2C276F0C72740B838A0A93
7572MSACCESS.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\DTS\en-US{A483E7E2-F2C6-4AC2-B4C9-CC71B2519D5F}\{262B8423-97D9-470E-9CD4-0AF5247C7EEE}mt22238896.pngimage
MD5:014E5E2D4A04DB32671D8AF03132E977
SHA256:928094AE0F48DF080668BA62901FEE071293C56B4D4C8039E6E9D74B1B0AF39E
7572MSACCESS.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\DTS\en-US{A483E7E2-F2C6-4AC2-B4C9-CC71B2519D5F}\{20CD7005-9EE0-42D2-839C-9037AC55F80D}mt01225343.pngimage
MD5:28D825FED592B6B24FD4A632F4AC24F5
SHA256:895688D88A7B3F5B7372D07584AD0DE540D9032EF13942A417D909EEE9471007
7640rundll32.exeC:\Windows\CC0C.tmpexecutable
MD5:347AC3B6B791054DE3E5720A7144A977
SHA256:301B905EB98D8D6BB559C04BBDA26628A942B2C4107C07A02E8F753BDCFE347C
7640rundll32.exeC:\Users\admin\Documents\Database1.accdbbinary
MD5:E12F553501A0733B7847F3589CA45D1F
SHA256:57AC3066867881755503861E317AB14793E611FCBDB4CC9DBA5038E3318DB8DE
7568Urgent Contract Action.exeC:\Windows\infpub.datexecutable
MD5:1D724F95C61F1055F0D02C2154BBCCD3
SHA256:579FD8A0385482FB4C789561A30B09F25671E86422F40EF5CCA2036B28F99648
7572MSACCESS.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\DTS\en-US{A483E7E2-F2C6-4AC2-B4C9-CC71B2519D5F}\{3F04CBBC-521E-44B5-93C6-5E36B57A7C7C}mt01225355.pngimage
MD5:377B5ECED0E2105A899F7D0D9989EFEB
SHA256:E295597799CFC910B656FED12B6E6B29C32776E0E88DBC2CCB4A1B79C32638C7
7572MSACCESS.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:2310FD6EC9D129DDA1A235CC44549FCC
SHA256:55215ED0F56BBAE9D021A2B644A16C0E3B6C3E1425CE8B3AA3332C9879AED7E8
7640rundll32.exeC:\Windows\cscc.datexecutable
MD5:EDB72F4A46C39452D1A5414F7D26454A
SHA256:0B2F863F4119DC88A22CC97C0A136C88A0127CB026751303B045F7322A8972F6
7572MSACCESS.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:AD43DAF1D72E5A9F4C056A4ADB68B1BD
SHA256:6D287BBD60A982DDC37945DC47D6BDBDEE823D00CCC9AC90E8B5C3D9A18BC57C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
72
DNS requests
23
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7640
rundll32.exe
OPTIONS
400
2.16.241.19:80
http://2.16.241.19/
unknown
—
—
unknown
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7572
MSACCESS.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.2:445
—
—
—
whitelisted
4
System
2.16.241.19:445
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
2.16.241.19:139
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.2:139
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.22
  • 20.190.160.64
  • 20.190.160.20
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
7640
rundll32.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] WebDav activity has been detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Urgent Contract Action.exe