File name:

3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.zip

Full analysis: https://app.any.run/tasks/e9048a41-3cfd-4e5e-97d9-12e4c32213ac
Verdict: Malicious activity
Threats:

LockBit, a ransomware variant, encrypts data on infected machines, demanding a ransom payment for decryption. Used in targeted attacks, It's a significant risk to organizations.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 19:03:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
stealer
ransomware
lockbit
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

256A5E50FC64289A6A38A1B0052AF12F

SHA1:

3D2B8E82CE239AE1842FB71C99E4A5F9EDBA2936

SHA256:

84FA579A94BE8C050B9EE9D92623BDECDCEFB31330AD8EEA6AFC13EC37CEB154

SSDEEP:

3072:OFS3pfk5aUw6BWeZDiWJtTUfCbdxz3nSBxtQo0l+q:OSNk5agQeZDiWJt6+xzXKTQo0l+q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7412)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7376)

    • RANSOMWARE has been detected

      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 6264)

    • [YARA] LockBit is detected

      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 6264)

    • Actions looks like stealing of personal data

      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 6264)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7412)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 6264)

    • There is functionality for taking screenshot (YARA)

      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 6264)

  • INFO

    • Checks supported languages

      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 1676)
      • SearchApp.exe (PID: 6040)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7412)

    • Creates files in the program directory

      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 6264)

    • Reads the machine GUID from the registry

      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 1676)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7764)
      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 6264)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7764)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7764)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7764)

    • Process checks computer location settings

      • SearchApp.exe (PID: 6040)

    • Create files in a temporary directory

      • 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe (PID: 6264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:03:23 05:23:14
ZipCRC: 0x932956c5
ZipCompressedSize: 99397
ZipUncompressedSize: 153600
ZipFileName: 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe no specs CMSTPLUA THREAT 3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe shellexperiencehost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs openwith.exe no specs rundll32.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
1676"C:\Users\admin\AppData\Local\Temp\Rar$EXb7412.30829\3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb7412.30829\3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb7412.30829\3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
4776"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6040"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wincorlib.dll
6264"C:\Users\admin\AppData\Local\Temp\Rar$EXb7412.30829\3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb7412.30829\3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb7412.30829\3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
6744"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
6964"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7376C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
7412"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7600C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7612"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
9 248
Read events
9 174
Write events
73
Delete events
1

Modification events

(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.zip
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7376) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
16
Suspicious files
1 387
Text files
1 479
Unknown types
0

Dropped files

PID
Process
Filename
Type
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHHbinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\BBBBBBBBBBBbinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGGbinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\desktop.inibinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\LLLLLLLLLLLbinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\PPPPPPPPPPPbinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\DDDDDDDDDDDbinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\MMMMMMMMMMMbinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\FFFFFFFFFFFbinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
62643e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.exeC:\$Recycle.Bin\S-1-5-18\JJJJJJJJJJJbinary
MD5:E5044AD748A0D7664C5C66EDA08EC617
SHA256:B1B86AA59FB05F3E663529316A7202E8C0DF9DB4490657C1AE2EA2878F6C2CE4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7920
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7764
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7756
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7756
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6040
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.131
  • 40.126.31.0
  • 20.190.159.23
  • 40.126.31.2
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
  • 2.19.122.49
  • 2.19.122.51
  • 2.19.122.64
  • 2.19.122.57
  • 2.19.122.58
  • 2.19.122.63
  • 2.19.122.54
  • 2.19.122.48
  • 2.19.122.50
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61.zip