File name:

revo-uninstaller-portable-2-4-5.zip.7z

Full analysis: https://app.any.run/tasks/573fd1a0-7431-4dba-a3d5-c00462328d17
Verdict: Malicious activity
Analysis date: December 17, 2024, 09:07:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

C55DA5DB0955205756F8ABCC03EBE37A

SHA1:

D1C71D4EA00EFC9F433B2DD3B8ACAFF950B4D9C9

SHA256:

7B0A43859BBB5433EBE80C28B99E736508425E9913C8CD43F0943BC53E6ABC2D

SSDEEP:

98304:yZFM7/+pfB48aWhVWC1VA0zhDfHBmBB/mF4gPFEyv9QKHWwlvF97aHGeFYxI4e5U:wIGEdRmofi+Xi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • RevoUn.exe (PID: 4556)
      • RevoUn.exe (PID: 3832)
      • RevoUn.exe (PID: 5544)

  • SUSPICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6236)

    • Searches for installed software

      • RevoUn.exe (PID: 4556)
      • RevoUn.exe (PID: 3832)
      • dllhost.exe (PID: 6532)
      • dllhost.exe (PID: 2728)
      • Un_A.exe (PID: 7000)

    • Reads security settings of Internet Explorer

      • RevoUn.exe (PID: 4556)
      • RevoUn.exe (PID: 3832)
      • Un_A.exe (PID: 7000)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6516)

    • Starts itself from another location

      • uninst.exe (PID: 7124)

    • Executable content was dropped or overwritten

      • uninst.exe (PID: 7124)
      • Un_A.exe (PID: 7000)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Un_A.exe (PID: 7000)

    • Starts CMD.EXE for commands execution

      • Un_A.exe (PID: 7000)
      • cmd.exe (PID: 4128)

    • Application launched itself

      • cmd.exe (PID: 4128)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 396)
      • schtasks.exe (PID: 4164)
      • schtasks.exe (PID: 4816)

    • Lists all scheduled tasks in specific format

      • schtasks.exe (PID: 6796)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6656)

    • Checks Windows Trust Settings

      • Un_A.exe (PID: 7000)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 3828)

    • Reads the date of Windows installation

      • msiexec.exe (PID: 3828)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 6968)
      • WinRAR.exe (PID: 7160)
      • RevoUPort.exe (PID: 3076)
      • RevoUPort.exe (PID: 5872)
      • RevoUn.exe (PID: 5544)
      • RevoUn.exe (PID: 3832)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6236)
      • WinRAR.exe (PID: 7160)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7160)
      • msiexec.exe (PID: 3828)

    • Checks supported languages

      • RevoUPort.exe (PID: 3076)
      • RevoUn.exe (PID: 4556)
      • RevoUn.exe (PID: 3832)
      • uninst.exe (PID: 7124)
      • Un_A.exe (PID: 7000)
      • CCUpdate.exe (PID: 1752)
      • msiexec.exe (PID: 3828)
      • msiexec.exe (PID: 6604)

    • Reads the computer name

      • RevoUn.exe (PID: 4556)
      • Un_A.exe (PID: 7000)
      • msiexec.exe (PID: 3828)
      • msiexec.exe (PID: 6604)
      • CCUpdate.exe (PID: 1752)

    • Process checks computer location settings

      • RevoUn.exe (PID: 4556)

    • Create files in a temporary directory

      • uninst.exe (PID: 7124)
      • Un_A.exe (PID: 7000)

    • The sample compiled with english language support

      • uninst.exe (PID: 7124)
      • Un_A.exe (PID: 7000)
      • msiexec.exe (PID: 3828)

    • Reads Environment values

      • Un_A.exe (PID: 7000)
      • msiexec.exe (PID: 3828)

    • Manages system restore points

      • SrTasks.exe (PID: 5076)
      • SrTasks.exe (PID: 6508)
      • SrTasks.exe (PID: 2456)

    • Reads the software policy settings

      • Un_A.exe (PID: 7000)

    • Reads the machine GUID from the registry

      • Un_A.exe (PID: 7000)

    • Checks proxy server information

      • Un_A.exe (PID: 7000)

    • Application launched itself

      • msiexec.exe (PID: 3828)

    • Write to the desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 3828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2024:12:17 09:06:29+00:00
ArchivedFileName: revo-uninstaller-portable-2-4-5.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
34
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs winrar.exe rundll32.exe no specs revouport.exe no specs revouport.exe revoun.exe no specs revoun.exe no specs revoun.exe vssvc.exe no specs SPPSurrogate no specs srtasks.exe no specs conhost.exe no specs uninst.exe un_a.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs findstr.exe no specs schtasks.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs ccupdate.exe no specs SPPSurrogate no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe srtasks.exe no specs conhost.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396C:\WINDOWS\system32\schtasks /delete /tn "CCleanerSkipUAC - admin" /fC:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1752"C:\Program Files\CCleaner\ccupdate.exe" /unregC:\Program Files\CCleaner\CCUpdate.exe—Un_A.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner CCleaner emergency updater
Exit code:
0
Version:
23.3.12.0
Modules
Images
c:\program files\ccleaner\ccupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
2148findstr /i CCleanerSkipUACC:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2456C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:14C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
2147942487
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2728C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
3076"C:\Users\admin\Desktop\RevoUninstaller_Portable\RevoUPort.exe" C:\Users\admin\Desktop\RevoUninstaller_Portable\RevoUPort.exe
explorer.exe
User:
admin
Company:
VS Revo Group
Integrity Level:
HIGH
Exit code:
0
Version:
2, 0, 0, 0
Modules
Images
c:\users\admin\desktop\revouninstaller_portable\revouport.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
3828C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3832"C:\Users\admin\Desktop\RevoUninstaller_Portable\x64\RevoUn.exe" C:\Users\admin\Desktop\RevoUninstaller_Portable\x64\RevoUn.exe
explorer.exe
User:
admin
Company:
VS Revo Group
Integrity Level:
HIGH
Description:
Revo Uninstaller
Version:
2.4.5.0
Modules
Images
c:\users\admin\desktop\revouninstaller_portable\x64\revoun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
35 631
Read events
34 266
Write events
633
Delete events
732

Modification events

(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\revo-uninstaller-portable-2-4-5.zip.7z
(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:13
Value:
(PID) Process:(6236) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:12
Value:
Executable files
15
Suspicious files
28
Text files
52
Unknown types
4

Dropped files

PID
Process
Filename
Type
6236WinRAR.exeC:\Users\admin\Desktop\revo-uninstaller-portable-2-4-5.zipcompressed
MD5:5178AEBA4F6DF6D3286DB3279EA5EA42
SHA256:FD8B2FB37D0F146FEF98DD7B6079FE40A4E04879E247F4A37EF12443CCF6C2B3
7160WinRAR.exeC:\Users\admin\Desktop\RevoUninstaller_Portable\lang\albanian.initext
MD5:CD86D5DF4564A5D91934B3383A2B342E
SHA256:09FE4F2A0D1D54C5D374DB235F07F06642404A630F8B981461B0F7998B7C753B
7160WinRAR.exeC:\Users\admin\Desktop\RevoUninstaller_Portable\lang\english.initext
MD5:5F57E969CB8F3AD0BBD859207A283BD5
SHA256:F2E8F9E5CF4F057E3399FF66485A485CBA419881AEEAC997049941396BDF63D8
7160WinRAR.exeC:\Users\admin\Desktop\RevoUninstaller_Portable\lang\bulgarian.initext
MD5:29C6FA77CAFF22CEBEF89FE7CBB7E564
SHA256:8AD919E2DF77256C9DE97E5AB3BCB62669517360051E1F8C3444D2BDCDC9E824
7160WinRAR.exeC:\Users\admin\Desktop\RevoUninstaller_Portable\lang\dutch.initext
MD5:484AAB4E4A291B4C2F2D1718B3754D2B
SHA256:7A47C9E44EF1E4CE0D5FC678DDF505D8213995E55599D7F4779E10462C002880
7160WinRAR.exeC:\Users\admin\Desktop\RevoUninstaller_Portable\lang\finnish.initext
MD5:A3D974340201C1D00AF3A87F4D3DA6DC
SHA256:FEDCC719AC22D45A77F117372E0E124AA0EDE73DFC0768E7CDF7420539140731
7160WinRAR.exeC:\Users\admin\Desktop\RevoUninstaller_Portable\lang\french.initext
MD5:267BCE0C687901EF0C9B94853164FF22
SHA256:F7B544068FCFE69F5A718A9EE0B790620F85477AFBF0C5DB5215A318C67E3B7F
7160WinRAR.exeC:\Users\admin\Desktop\RevoUninstaller_Portable\lang\hellenic.initext
MD5:2750A46C066CE37250BE338D2D4B2C28
SHA256:1FBFEE3E9FB3D7E4BAC9AB89C49B25B1D93D65389A1DB3D9276C0B8C1A9C363B
7160WinRAR.exeC:\Users\admin\Desktop\RevoUninstaller_Portable\lang\german.initext
MD5:00155578B98E07FC6288870E2AECCA68
SHA256:8CEF19D9D89BE0528643C45647085A85B136DF74987F7D25483732D431C70D12
7160WinRAR.exeC:\Users\admin\Desktop\RevoUninstaller_Portable\lang\georgian.initext
MD5:198F4E61DFCEF0808B8EDE2ACBC2B5A0
SHA256:A37876448B2EA24F5FBF964130485BC7A5B7669D6FA5D1DFEFEBE98EA3A967F2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
43
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2356
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7000
Un_A.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1380
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 172.217.16.142
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.170
  • 104.126.37.168
  • 104.126.37.177
  • 104.126.37.184
  • 104.126.37.171
  • 104.126.37.179
  • 104.126.37.178
  • 104.126.37.185
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.71
  • 40.126.31.67
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.0
  • 40.126.31.71
  • 20.190.159.23
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
revo-uninstaller-portable-2-4-5.zip.7z