File name:

Mumu_essentials.zip

Full analysis: https://app.any.run/tasks/13d58699-20c3-48c5-a546-2911ae1ff7d2
Verdict: Malicious activity
Analysis date: September 03, 2025, 17:22:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

24DC16F9287F55320C1DD4222C25BD3B

SHA1:

1BB99C1651BDF73EC549549D1D147E9D0C336014

SHA256:

65668FE0F9965A5BCA1AC362658FD09AC51B6FAEF8EF633FCD2E0FC38785ED07

SSDEEP:

98304:9pAunivpJDY/nePQJVntPZpvv3i1WPrZ96veKiFS0hXezIaGeWr1KLoBkqEXrFgd:0QA4O6sRsYgfXhZHzWBMzOOCmH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6680)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6680)
      • SecHealthUI.exe (PID: 2028)
      • SecHealthUI.exe (PID: 5780)
      • GameBar.exe (PID: 2064)
      • Fusion.exe (PID: 4060)
      • Fusion.exe (PID: 6648)
      • Fusion.exe (PID: 516)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 6680)

    • Application launched itself

      • WinRAR.exe (PID: 6680)
      • Fusion.exe (PID: 2324)
      • Fusion.exe (PID: 1472)
      • updater.exe (PID: 868)

    • Executing commands from a ".bat" file

      • Fusion.exe (PID: 4060)
      • Fusion.exe (PID: 6648)

    • Reads the date of Windows installation

      • Fusion.exe (PID: 4060)
      • Fusion.exe (PID: 6648)
      • Fusion.exe (PID: 516)

    • Starts CMD.EXE for commands execution

      • Fusion.exe (PID: 4060)
      • Fusion.exe (PID: 6648)

    • The executable file from the user directory is run by the CMD process

      • Fusion.exe (PID: 2324)
      • Fusion.exe (PID: 1472)

    • Executable content was dropped or overwritten

      • Fusion.exe (PID: 4060)
      • Fusion.exe (PID: 6648)
      • cmd.exe (PID: 7064)
      • Fusion.exe (PID: 516)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 7064)

    • Process drops legitimate windows executable

      • Fusion.exe (PID: 516)

    • Executes application which crashes

      • Tools.exe (PID: 6688)

    • The process executes via Task Scheduler

      • updater.exe (PID: 868)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6680)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6212)

    • Reads the computer name

      • SecHealthUI.exe (PID: 2028)
      • SecHealthUI.exe (PID: 5780)
      • Fusion.exe (PID: 6648)
      • Fusion.exe (PID: 516)
      • Tools.exe (PID: 6688)
      • WebVerify.exe (PID: 5960)
      • WebVerify.exe (PID: 1232)
      • updater.exe (PID: 868)
      • WebVerify.exe (PID: 6208)
      • GameBar.exe (PID: 2064)
      • Fusion.exe (PID: 4060)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 828)

    • Checks supported languages

      • SecHealthUI.exe (PID: 2028)
      • SecHealthUI.exe (PID: 5780)
      • Fusion.exe (PID: 4060)
      • Fusion.exe (PID: 6648)
      • Fusion.exe (PID: 2324)
      • GameBar.exe (PID: 2064)
      • Fusion.exe (PID: 516)
      • Fusion.exe (PID: 1472)
      • Tools.exe (PID: 6688)
      • WebVerify.exe (PID: 5960)
      • WebVerify.exe (PID: 1232)
      • updater.exe (PID: 868)
      • WebVerify.exe (PID: 6208)
      • updater.exe (PID: 6820)

    • Create files in a temporary directory

      • Fusion.exe (PID: 4060)

    • Manual execution by a user

      • Fusion.exe (PID: 7124)
      • Fusion.exe (PID: 4060)

    • Process checks computer location settings

      • Fusion.exe (PID: 4060)
      • Fusion.exe (PID: 6648)
      • Fusion.exe (PID: 516)

    • Creates files or folders in the user directory

      • Fusion.exe (PID: 4060)
      • Fusion.exe (PID: 6648)
      • Fusion.exe (PID: 516)
      • WerFault.exe (PID: 5712)

    • Checks proxy server information

      • Fusion.exe (PID: 6648)
      • Fusion.exe (PID: 516)
      • WerFault.exe (PID: 5712)
      • slui.exe (PID: 4800)

    • Reads the software policy settings

      • Fusion.exe (PID: 6648)
      • Fusion.exe (PID: 516)
      • WerFault.exe (PID: 5712)
      • slui.exe (PID: 4800)

    • Reads the machine GUID from the registry

      • Fusion.exe (PID: 6648)
      • Fusion.exe (PID: 516)

    • The sample compiled with english language support

      • Fusion.exe (PID: 516)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:05:06 01:05:58
ZipCRC: 0x6e016e1c
ZipCompressedSize: 6373
ZipUncompressedSize: 34134
ZipFileName: Aio by RoaR.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
186
Monitored processes
30
Malicious processes
0
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe no specs notepad.exe no specs winrar.exe sechealthui.exe no specs securityhealthhost.exe no specs securityhealthhost.exe no specs sechealthui.exe no specs securityhealthhost.exe no specs securityhealthhost.exe no specs securityhealthhost.exe no specs slui.exe fusion.exe no specs fusion.exe gamebar.exe no specs cmd.exe no specs conhost.exe no specs fusion.exe no specs fusion.exe cmd.exe conhost.exe no specs taskkill.exe no specs fusion.exe no specs fusion.exe tools.exe werfault.exe webverify.exe webverify.exe updater.exe no specs updater.exe no specs webverify.exe

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Users\admin\AppData\Local\fusion\Fusion.exe"C:\Users\admin\AppData\Local\fusion\Fusion.exe
Fusion.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\fusion\fusion.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
828"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa6680.31918\Fusion.zipC:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
868"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1232"WebVerify.exe" --ticket=0x33FD7124C:\Users\admin\AppData\Local\fusion\WebVerify.exe
Fusion.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\fusion\webverify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\users\admin\appdata\local\fusion\webview2loader.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1472Fusion.exe C:\Users\admin\AppData\Local\fusion\Fusion.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\fusion\fusion.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1560C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -EmbeddingC:\Windows\System32\SecurityHealthHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Security Health Host
Exit code:
0
Version:
4.18.1907.16384 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\securityhealthhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
2028"C:\WINDOWS\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mcaC:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Defender application
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.sechealthui_cw5n1h2txyewy\sechealthui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
2064"C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe" -ServerName:App.AppXbdkk0yrkwpcgeaem8zk81k8py1eaahny.mcaC:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files\windowsapps\microsoft.xboxgamingoverlay_2.34.28001.0_x64__8wekyb3d8bbwe\gamebar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
2324"C:\Users\admin\AppData\Local\fusion\Fusion.exe" C:\Users\admin\AppData\Local\fusion\Fusion.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\fusion\fusion.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3288\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
14 562
Read events
14 467
Write events
92
Delete events
3

Modification events

(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\Mumu_essentials.zip
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids
Operation:writeName:txtfile
Value:
(PID) Process:(828) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
Executable files
9
Suspicious files
17
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6648Fusion.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:80B36A260B74EEFE0910AC251F1F0240
SHA256:3EF7201F33C97932E59F490C0CE9155C3B336C642E4A403B74BED4E8A4961FDC
6648Fusion.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:7435C550020F853AC1378FA1F8909F33
SHA256:5ED5B0CB83C6704AED98E30715815C0B8FAB1D5A53223A59F6DFB86EFF83A75C
6680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6680.31233\password.txttext
MD5:856DAC7F35E1F86409BFE13550080402
SHA256:FCFBE9286E247648D83F19696843409835FAA3A7DDC79E86DC4D28381DFC281E
6680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6680.31918\Fusion.zipcompressed
MD5:728E900AB6C2D63EFF8CA0D986919E32
SHA256:D6761C28CF099BE9E53602F4D4F4A6E36E797D76959766C167DD30EEE7E33ABE
6648Fusion.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:6DA2E83CF13E1121527F1C027EFC341C
SHA256:2CB658D6DC7D9C6A4E67AEDD7318FFFF2D24F79405872308031389D967DFC123
6648Fusion.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:3AA222D7ABCC490F363B4C5245FED18A
SHA256:AE038F3594ABA0202932168D217B415DE9E02C9DE236C5314B423A8ECAD6083C
4060Fusion.exeC:\Users\admin\AppData\Local\fusion\Fusion.exeexecutable
MD5:422E4D3B6CCD200F3C0DF013306BE122
SHA256:4823D20B933C5530BCFA52C9182FFB1C388B7B8472C6F4378B90E855B8E580D6
6648Fusion.exeC:\Users\admin\AppData\Local\fusion\updated.exeexecutable
MD5:20081B7867970B6C7C4E6242C9758EC3
SHA256:D7BAF7971071892D0BDC7E62A53A76C63D32C94AF92D573756467841C56E3125
6648Fusion.exeC:\Users\admin\AppData\Local\fusion\updater.battext
MD5:8F1A6E457C30761BDF5525459043BDE9
SHA256:33E0EFB2B9492D0745B7070BE0A6247FDACD9824E50A3821DBEDAEAEE30D011C
7064cmd.exeC:\Users\admin\AppData\Local\fusion\Fusion.exeexecutable
MD5:20081B7867970B6C7C4E6242C9758EC3
SHA256:D7BAF7971071892D0BDC7E62A53A76C63D32C94AF92D573756467841C56E3125
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
57
DNS requests
38
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6756
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6128
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6128
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6648
Fusion.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
6648
Fusion.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
6648
Fusion.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
6648
Fusion.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.164.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5712
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6648
Fusion.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5968
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6756
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6756
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
2.16.164.114:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.142
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.67
  • 20.190.160.130
  • 20.190.160.2
  • 20.190.160.20
  • 20.190.160.64
  • 20.190.160.65
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 2.16.164.114
  • 2.16.164.96
  • 2.16.164.82
  • 2.16.164.122
  • 2.16.164.107
  • 2.16.164.129
  • 2.16.164.120
  • 2.16.164.98
  • 2.16.164.104
  • 2.16.164.58
  • 2.16.164.48
  • 2.16.164.24
  • 2.16.164.89
  • 2.16.164.128
  • 2.16.164.35
  • 2.16.164.105
whitelisted
www.microsoft.com
  • 69.192.161.161
  • 95.101.149.131
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
www.bing.com
  • 2.16.241.205
  • 2.16.241.207
  • 2.16.241.218
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access release user assets on GitHub
Process
Message
WebVerify.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WebVerify.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WebVerify.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WebVerify.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WebVerify.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WebVerify.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mumu_essentials.zip