File name:

HavenShieldVPN.zip

Full analysis: https://app.any.run/tasks/0ad826d5-09cd-4c7b-b112-74ece06959b8
Verdict: Malicious activity
Analysis date: May 29, 2025, 06:41:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
evasion
nodejs
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

5EE3EEAEA97469D6266577A8D4F7EAB9

SHA1:

898F1584BC62A01CBFAAD9C1EF6E701665F95B94

SHA256:

6C49A1098A62A06F4F9BBC63FA4D0CDCC0D3CA268D79E05C6047C61CDADFEF7A

SSDEEP:

1572864:yPXBsE3YI3GvP3RdAkKLctXRa3Y9eelSL:y/BsSYI3GvvRdANLc9YWYL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • HavenShield.exe (PID: 1240)

    • Changes powershell execution policy (Unrestricted)

      • HavenShieldVPN.exe (PID: 856)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • HavenShield.exe (PID: 1240)

    • The process creates files with name similar to system file names

      • HavenShield.exe (PID: 1240)

    • Drops 7-zip archiver for unpacking

      • HavenShield.exe (PID: 1240)

    • Executable content was dropped or overwritten

      • HavenShieldVPN.exe (PID: 856)
      • HavenShield.exe (PID: 1240)

    • Starts CMD.EXE for commands execution

      • HavenShieldVPN.exe (PID: 856)

    • Suspicious browser cookie database enumeration

      • HavenShieldVPN.exe (PID: 856)

    • Reads security settings of Internet Explorer

      • HavenShield.exe (PID: 1240)

    • Process drops legitimate windows executable

      • HavenShield.exe (PID: 1240)

    • There is functionality for taking screenshot (YARA)

      • HavenShield.exe (PID: 1240)
      • HavenShieldVPN.exe (PID: 2612)

    • Starts application with an unusual extension

      • cmd.exe (PID: 968)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 6576)

    • The process hides Powershell's copyright startup banner

      • HavenShieldVPN.exe (PID: 856)

    • Starts POWERSHELL.EXE for commands execution

      • HavenShieldVPN.exe (PID: 856)

    • The process bypasses the loading of PowerShell profile settings

      • HavenShieldVPN.exe (PID: 856)

    • Application launched itself

      • HavenShieldVPN.exe (PID: 856)

    • Get information on the list of running processes

      • cmd.exe (PID: 736)
      • HavenShieldVPN.exe (PID: 856)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7868)

    • Checks for external IP

      • svchost.exe (PID: 2196)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7152)
      • HavenShield.exe (PID: 1240)

    • Checks supported languages

      • HavenShield.exe (PID: 1240)
      • chcp.com (PID: 6992)
      • HavenShieldVPN.exe (PID: 856)
      • msiexec.exe (PID: 5592)
      • HavenShieldVPN.exe (PID: 5624)
      • HavenShieldVPN.exe (PID: 2612)

    • Manual execution by a user

      • HavenShield.exe (PID: 1240)

    • Create files in a temporary directory

      • HavenShield.exe (PID: 1240)
      • HavenShieldVPN.exe (PID: 856)

    • Reads the computer name

      • HavenShield.exe (PID: 1240)
      • msiexec.exe (PID: 5592)
      • HavenShieldVPN.exe (PID: 2612)
      • HavenShieldVPN.exe (PID: 5624)
      • HavenShieldVPN.exe (PID: 856)

    • Changes the display of characters in the console

      • cmd.exe (PID: 968)

    • Checks proxy server information

      • slui.exe (PID: 2384)
      • HavenShieldVPN.exe (PID: 856)

    • Reads product name

      • HavenShieldVPN.exe (PID: 856)

    • Reads Environment values

      • HavenShieldVPN.exe (PID: 856)

    • Reads the software policy settings

      • slui.exe (PID: 2384)

    • Node.js compiler has been detected

      • HavenShieldVPN.exe (PID: 856)
      • HavenShieldVPN.exe (PID: 2612)
      • HavenShieldVPN.exe (PID: 5624)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 3124)

    • Reads CPU info

      • HavenShieldVPN.exe (PID: 856)

    • Reads the machine GUID from the registry

      • HavenShieldVPN.exe (PID: 856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:05:28 18:34:38
ZipCRC: 0x5025d40a
ZipCompressedSize: 89329780
ZipUncompressedSize: 89335440
ZipFileName: HavenShield.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
217
Monitored processes
69
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs slui.exe havenshield.exe havenshieldvpn.exe cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs conhost.exe no specs where.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs msiexec.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs havenshieldvpn.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs havenshieldvpn.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs findstr.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs svchost.exe havenshieldvpn.exe no specs ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736C:\WINDOWS\system32\cmd.exe /d /s /c "tasklist"C:\Windows\System32\cmd.exe—HavenShieldVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
744powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—HavenShieldVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
772\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856C:\Users\admin\AppData\Local\Temp\2xk2kex96Sy4Hz5LRLrA5qL6WQS\HavenShieldVPN.exe C:\Users\admin\AppData\Local\Temp\2xk2kex96Sy4Hz5LRLrA5qL6WQS\HavenShieldVPN.exe
HavenShield.exe
User:
admin
Company:
HavenShieldVPN Corporation.
Integrity Level:
MEDIUM
Description:
HavenShieldVPN
Version:
0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2xk2kex96sy4hz5lrlra5ql6wqs\havenshieldvpn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—HavenShieldVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
968C:\WINDOWS\system32\cmd.exe /d /s /c "chcp"C:\Windows\System32\cmd.exe—HavenShieldVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240"C:\Users\admin\Desktop\HavenShield.exe" C:\Users\admin\Desktop\HavenShield.exe
explorer.exe
User:
admin
Company:
HavenShieldVPN Corporation.
Integrity Level:
MEDIUM
Description:
HavenShieldVPN Services
Version:
0.0.0
Modules
Images
c:\users\admin\desktop\havenshield.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—HavenShieldVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
Total events
90 391
Read events
90 373
Write events
18
Delete events
0

Modification events

(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\HavenShieldVPN.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
22
Suspicious files
23
Text files
41
Unknown types
118

Dropped files

PID
Process
Filename
Type
7152WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7152.31397\HavenShield.exe —
MD5:—
SHA256:—
1240HavenShield.exeC:\Users\admin\AppData\Local\Temp\nsb42EE.tmp\app-64.7z —
MD5:—
SHA256:—
1240HavenShield.exeC:\Users\admin\AppData\Local\Temp\nsb42EE.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
1240HavenShield.exeC:\Users\admin\AppData\Local\Temp\nsb42EE.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
1240HavenShield.exeC:\Users\admin\AppData\Local\Temp\nsb42EE.tmp\7z-out\chrome_100_percent.pakpgc
MD5:CB4F128469CD84711ED1C9C02212C7A8
SHA256:7DD5485DEF22A53C0635EFDF8AE900F147EC8C8A22B9ED71C24668075DD605D3
1240HavenShield.exeC:\Users\admin\AppData\Local\Temp\nsb42EE.tmp\7z-out\LICENSE.electron.txttext
MD5:4D42118D35941E0F664DDDBD83F633C5
SHA256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
1240HavenShield.exeC:\Users\admin\AppData\Local\Temp\nsb42EE.tmp\7z-out\locales\en-US.pakmmw
MD5:5C52A86B21633B55B383C20F16859B2F
SHA256:41123D72BD8E289E85BD35227AABB4CC61FE1DE02B5CD7A7834E5EC200BC2078
1240HavenShield.exeC:\Users\admin\AppData\Local\Temp\nsb42EE.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
1240HavenShield.exeC:\Users\admin\AppData\Local\Temp\nsb42EE.tmp\7z-out\locales\ar.pakpgc
MD5:F6CA56D15814DD5AFD5E7FF985257880
SHA256:5CC02570E5F61CBCA791309985DF3A29584E41583B3344F1D9FB6B04CE423E6F
1240HavenShield.exeC:\Users\admin\AppData\Local\Temp\nsb42EE.tmp\7z-out\locales\et.pakpgc
MD5:3CAD945E9AE6E31CFE66C89365E5D353
SHA256:BA4EC85D2306A1F1F178A017FEF4D340B77B33E10BBEE07BD359A8E0FF8EA461
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
58
TCP/UDP connections
96
DNS requests
31
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
compressed
23.9 Kb
whitelisted
6668
SIHClient.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
6668
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
6668
SIHClient.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6668
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6668
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
40.69.42.241:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6668
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6668
SIHClient.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6668
SIHClient.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 23.32.238.112
  • 23.32.238.107
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.14
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.5
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.74
  • 20.190.160.14
  • 20.190.160.128
  • 40.126.32.134
  • 40.126.32.138
  • 20.190.160.64
  • 20.190.160.17
  • 20.190.160.67
  • 20.190.160.132
  • 20.190.160.22
  • 40.126.32.133
  • 20.190.160.65
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (ipapi .co in DNS lookup)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HavenShieldVPN.zip