File name:

ZipThis.exe.zip

Full analysis: https://app.any.run/tasks/9bcc7c02-cb24-45c7-a8c5-22abc6154473
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 14, 2025, 22:44:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
auto
generic
reflection
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

15DB35DF8AC09548A7A9B9844143BF85

SHA1:

43F3CB6172022C5D1A537455059E92322642DC0B

SHA256:

72E86E145AA9C8AD3847144184B224ED23FFAF8D120DDDE53C20392E937D5299

SSDEEP:

98304:RZNf34+RWuF2zehSiNIwV8YIgojxuI0V/Y7DNsbdYhJ5UynXGsvKNPUko90m7D9U:CLfKRm6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6260)

    • Changes powershell execution policy (RemoteSigned)

      • ZipThis.exe (PID: 6436)

    • GENERIC has been found (auto)

      • ZipThis.exe (PID: 6436)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)

    • Reads security settings of Internet Explorer

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)

    • Application launched itself

      • ZipThis.exe (PID: 7132)

    • The process executes Powershell scripts

      • ZipThis.exe (PID: 6436)

    • Starts POWERSHELL.EXE for commands execution

      • ZipThis.exe (PID: 6436)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 5320)

    • Executable content was dropped or overwritten

      • ZipThis.exe (PID: 6436)

    • Process drops legitimate windows executable

      • ZipThis.exe (PID: 6436)

    • The process drops C-runtime libraries

      • ZipThis.exe (PID: 6436)

    • Creates a software uninstall entry

      • ZipThis.exe (PID: 6436)

    • Searches for installed software

      • ZipThis.exe (PID: 6436)

    • Detects reflection assembly loader (YARA)

      • powershell.exe (PID: 768)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6260)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6260)
      • ZipThis.exe (PID: 7132)
      • powershell.exe (PID: 5320)
      • ZipThis.exe (PID: 6436)
      • chrome.exe (PID: 4264)
      • chrome.exe (PID: 4804)
      • chrome.exe (PID: 3920)
      • powershell.exe (PID: 768)

    • Creates files or folders in the user directory

      • ZipThis.exe (PID: 7132)

    • Reads the software policy settings

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)
      • ZipThisApp.exe (PID: 1988)
      • Updater.exe (PID: 6496)

    • Process checks computer location settings

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)

    • Reads the computer name

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)
      • ZipThisApp.exe (PID: 1988)
      • Updater.exe (PID: 6496)

    • Checks proxy server information

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)
      • ZipThisApp.exe (PID: 1988)

    • Checks supported languages

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)
      • ZipThisApp.exe (PID: 1988)
      • Updater.exe (PID: 6496)

    • Disables trace logs

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)
      • ZipThisApp.exe (PID: 1988)

    • Reads Environment values

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)
      • ZipThisApp.exe (PID: 1988)
      • Updater.exe (PID: 6496)

    • Manual execution by a user

      • ZipThis.exe (PID: 7132)
      • Updater.exe (PID: 6496)
      • powershell.exe (PID: 768)

    • Reads the machine GUID from the registry

      • ZipThis.exe (PID: 7132)
      • ZipThis.exe (PID: 6436)
      • ZipThisApp.exe (PID: 1988)
      • Updater.exe (PID: 6496)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5320)

    • Creates files in the program directory

      • ZipThis.exe (PID: 6436)

    • The sample compiled with english language support

      • ZipThis.exe (PID: 6436)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 768)

    • Application launched itself

      • chrome.exe (PID: 5720)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 768)

    • Gets or sets the time when the file was last written to (POWERSHELL)

      • powershell.exe (PID: 768)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:01:14 22:07:22
ZipCRC: 0x1c470906
ZipCompressedSize: 1811512
ZipUncompressedSize: 2821416
ZipFileName: ZipThis.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
35
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs zipthis.exe #GENERIC zipthis.exe powershell.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs zipthisapp.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs updater.exe powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
768"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1076"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6088 --field-trial-handle=1936,i,7623486373372613203,13841200263551881557,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1156"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5376 --field-trial-handle=1936,i,7623486373372613203,13841200263551881557,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1520"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5388 --field-trial-handle=1936,i,7623486373372613203,13841200263551881557,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1988"C:\Program Files\ZipThis\ZipThisApp.exe" C:\Program Files\ZipThis\ZipThisApp.exe
ZipThis.exe
User:
admin
Integrity Level:
HIGH
Description:
ZipThisApp
Exit code:
0
Version:
9.10.100.100
Modules
Images
c:\program files\zipthis\zipthisapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2976"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3648 --field-trial-handle=1936,i,7623486373372613203,13841200263551881557,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3544"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4580 --field-trial-handle=1936,i,7623486373372613203,13841200263551881557,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3640"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5288 --field-trial-handle=1936,i,7623486373372613203,13841200263551881557,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3744"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4764 --field-trial-handle=1936,i,7623486373372613203,13841200263551881557,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3920"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5876 --field-trial-handle=1936,i,7623486373372613203,13841200263551881557,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
31 062
Read events
30 961
Write events
86
Delete events
15

Modification events

(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\ZipThis.exe.zip
(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6260) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
26
Suspicious files
119
Text files
47
Unknown types
3

Dropped files

PID
Process
Filename
Type
6436ZipThis.exeC:\Program Files\ZipThis\zipthisUserId.txttext
MD5:5E325475B09F3F11D0A3CC3D7BC476F0
SHA256:0D3DA0858EFC481D7C5DFB2B1D36FD964F19BA2A390E3FCE7D799950B0942629
6260WinRAR.exeC:\Users\admin\Desktop\ZipThis.exe\ZipThis.exeexecutable
MD5:34E759DF0CB0BF304C9FD1D6B9631BCE
SHA256:7D607EE9ACBB7C4747B79F4E891736AD4AB30BF7BBF9B3519CA2B6E6553766DC
7132ZipThis.exeC:\Users\admin\AppData\Local\ZipThis\zipthisUserId.txttext
MD5:5E325475B09F3F11D0A3CC3D7BC476F0
SHA256:0D3DA0858EFC481D7C5DFB2B1D36FD964F19BA2A390E3FCE7D799950B0942629
7132ZipThis.exeC:\Users\admin\AppData\Roaming\SMCR\userId.txttext
MD5:5E325475B09F3F11D0A3CC3D7BC476F0
SHA256:0D3DA0858EFC481D7C5DFB2B1D36FD964F19BA2A390E3FCE7D799950B0942629
6436ZipThis.exeC:\Program Files\ZipThis\update_task.ps1text
MD5:86FA452EE3F425733FDC5F1402600312
SHA256:0B1B02BA2B4DF19AE324757517E85220574DFC63F0F900DF2B52FAC8E885AAB5
6436ZipThis.exeC:\Program Files\ZipThis\msvcp140_1.dllexecutable
MD5:7B0A25EEE764D8747F02CB3ED980F07A
SHA256:1274292F4CC655F295272B37E08A9683B8BB8C419B61EA2E1F43EB4D22F02F90
5320powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:45C0C1766A5AF6684EADDE20379CBB0D
SHA256:94ECE010B867CA9EA9190E0721689E78031DC22495FE4DB56B1D8D9A236D51BB
6436ZipThis.exeC:\Program Files\ZipThis\concrt140.dllexecutable
MD5:9485D003573E0EAF7952AB23CC82EF7B
SHA256:5E0E8EAC57B86E2DE7CA7D6E8D34DDDEA602CE3660208FB53947A027635D59A1
6436ZipThis.exeC:\Program Files\ZipThis\vcamp140.dllexecutable
MD5:8441A618D2CEF67BDEDCA224FD61AFA2
SHA256:6CD300E597C477260809C5CA036993D923CD8BE304AE323C9C4D7776115FE62D
6436ZipThis.exeC:\Program Files\ZipThis\msvcp140.dllexecutable
MD5:C3D497B0AFEF4BD7E09C7559E1C75B05
SHA256:1E57A6DF9E3742E31A1C6D9BFF81EBEEAE8A7DE3B45A26E5079D5E1CCE54CD98
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
86
DNS requests
91
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
440
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
440
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7032
SIHClient.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7032
SIHClient.exe
GET
200
23.200.189.225:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2728
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
440
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
440
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.16.106.200:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.200.189.225
whitelisted
www.bing.com
  • 2.16.106.200
  • 2.16.106.196
  • 2.23.227.208
  • 2.23.227.215
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.22
  • 40.126.32.68
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.23
  • 40.126.31.67
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.0
  • 20.190.159.71
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com)
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com)
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] BootstrapCDN (stackpath .bootstrapcdn .com)
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] BootstrapCDN (stackpath .bootstrapcdn .com)
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] BootstrapCDN (stackpath .bootstrapcdn .com)
6628
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZipThis.exe.zip