File name:

test41.zip

Full analysis: https://app.any.run/tasks/7c91cc9f-fa2e-4a28-8c80-99408ee6e281
Verdict: Malicious activity
Analysis date: July 24, 2024, 06:56:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

8B4255B919E38CF1487EFC9DB01760D9

SHA1:

6367B5D73B3F312B3289561961A5110D9BD8C6E3

SHA256:

8C5E51F3B24F897D5CEA26D529C4FD40F706A1373D7756AA1B9CB529F68C2E7F

SSDEEP:

98304:Ggzxtqff/GNOQcYWMp9VVnfpsI6yW5bEDwQKoqAnDdELs0qHlmZiHEK6Miv60B5W:n/irtVHs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2884)
      • procexp64.exe (PID: 6548)

  • SUSPICIOUS

    • Application launched itself

      • cmd.exe (PID: 4328)
      • AutoIt3.exe (PID: 6316)
      • cmd.exe (PID: 2100)
      • AutoIt3.exe (PID: 4040)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 4328)
      • cmd.exe (PID: 2100)

    • Executes application which crashes

      • AutoIt3.exe (PID: 5552)
      • AutoIt3.exe (PID: 2456)

    • The process checks if it is being run in the virtual environment

      • procexp64.exe (PID: 6548)

    • Executable content was dropped or overwritten

      • procexp64.exe (PID: 6548)

    • Reads security settings of Internet Explorer

      • procexp64.exe (PID: 6548)

    • Drops a system driver (possible attempt to evade defenses)

      • procexp64.exe (PID: 6548)

    • Detected use of alternative data streams (AltDS)

      • procexp64.exe (PID: 6548)

    • Read startup parameters

      • procexp64.exe (PID: 6548)

    • Checks Windows Trust Settings

      • procexp64.exe (PID: 6548)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2884)

    • Manual execution by a user

      • cmd.exe (PID: 4328)
      • procexp64.exe (PID: 6548)
      • cmd.exe (PID: 2100)

    • Reads the machine GUID from the registry

      • AutoIt3.exe (PID: 6316)
      • procexp64.exe (PID: 6548)
      • AutoIt3.exe (PID: 4040)

    • Checks supported languages

      • AutoIt3.exe (PID: 6316)
      • AutoIt3.exe (PID: 5552)
      • procexp64.exe (PID: 6548)
      • AutoIt3.exe (PID: 4040)
      • AutoIt3.exe (PID: 2456)

    • Reads mouse settings

      • AutoIt3.exe (PID: 6316)
      • AutoIt3.exe (PID: 4040)
      • AutoIt3.exe (PID: 2456)
      • AutoIt3.exe (PID: 5552)

    • Checks proxy server information

      • WerFault.exe (PID: 1256)
      • procexp64.exe (PID: 6548)
      • WerFault.exe (PID: 3396)
      • slui.exe (PID: 5032)

    • Reads the software policy settings

      • WerFault.exe (PID: 1256)
      • procexp64.exe (PID: 6548)
      • WerFault.exe (PID: 3396)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 1256)
      • procexp64.exe (PID: 6548)
      • WerFault.exe (PID: 3396)

    • Reads product name

      • procexp64.exe (PID: 6548)

    • Reads the computer name

      • procexp64.exe (PID: 6548)

    • Reads Environment values

      • procexp64.exe (PID: 6548)

    • Create files in a temporary directory

      • procexp64.exe (PID: 6548)

    • Reads Microsoft Office registry keys

      • procexp64.exe (PID: 6548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:07:24 07:49:48
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: test4/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
17
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe slui.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs autoit3.exe no specs autoit3.exe werfault.exe slui.exe procexp64.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs autoit3.exe no specs autoit3.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
504C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1132C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1256C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5552 -s 632C:\Windows\SysWOW64\WerFault.exe
AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2100C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\test4\temp.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2456"C:\Users\admin\Desktop\test4\AutoIt3.exe"C:\Users\admin\Desktop\test4\AutoIt3.exe
AutoIt3.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
3221225477
Version:
3, 3, 16, 1
Modules
Images
c:\users\admin\desktop\test4\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
2884"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\test41.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3396C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2456 -s 616C:\Windows\SysWOW64\WerFault.exe
AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\cryptsp.dll
4040AutoIt3.exe AutoIt3.a3xC:\Users\admin\Desktop\test4\AutoIt3.exe—cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 16, 1
Modules
Images
c:\users\admin\desktop\test4\autoit3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
4328C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\test4\temp.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
Total events
65 073
Read events
65 059
Write events
14
Delete events
0

Modification events

(PID) Process:(2884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(2884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\test41.zip
(PID) Process:(2884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(1256) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
Operation:writeName:00180010F429971D
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000042CB6C300049C042863C8A748EF9A2B2000000000200000000001066000000010000200000006B2169286F19317B6ED27A11CA93F5A2610E22264976B7B9CC72528058C16D11000000000E80000000020000200000003F987F8C9549F2D2BC1684DF073A628D817FACDBD8905010DC5F675665BE78118000000093E3D572910197548E2042B1D480389A3E9D3EB541382D5B096B87A1828385B4026DF4F2D053FE9509938F827F1FDD8FFA61359F4FA8C4F3A81B811CE1DC6ECD13D2B56BAA933524B42AE73E63AC2E6DF157BD347040F0AAFDC05BC6627EB7EB0A5B93C23F52B5B8C93DE99C9C6A74BE469A4C26805021AB9BF64E56FEF62B074000000023E14BA8254B938730A4C4F0712720FF40AC640EF1649CF2455BE175E4A097108C96D219643B8CC44D81642457B08BB29CB201F8B5D8CFA505736D5408D38552
Executable files
4
Suspicious files
64
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
1256WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_AutoIt3.exe_367ab2494e7ebdd990c1283e68eb75327a23a_b05016a0_6c7f39e7-6452-485a-88c8-0dc90afa965a\Report.wer —
MD5:—
SHA256:—
2884WinRAR.exeC:\Users\admin\Desktop\test4\AutoIt3.a3xbinary
MD5:4A1F2CBBA55A6FA758C0F0B1D043812E
SHA256:22EA25EC7A5F8047DB3494648205198F9E3C4EDF1710E784AA82BB47F7A3251D
6548procexp64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\45AE547469FB7137480E06153457A2DDbinary
MD5:6B769DB3020C81D2E526159023B9859E
SHA256:1E929D06F06A034171AB4F6C015C97C8927E5FB43C6DA2FDE645AD16CAE7CDEF
2884WinRAR.exeC:\Users\admin\Desktop\test4\procexp.exeexecutable
MD5:B5E7689F66866281C26503B58733D834
SHA256:0F2081EBD2EF0BAAFDD699DBD1B77853A35B50943418ED6207F896599F41084C
6548procexp64.exeC:\Users\admin\AppData\Local\Temp\PROCEXP152.SYSexecutable
MD5:97E3A44EC4AE58C8CC38EEFC613E950E
SHA256:440883CD9D6A76DB5E53517D0EC7FE13D5A50D2F6A7F91ECFC863BC3490E4F5C
6548procexp64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C7F163ED126D5C3CB9457F68EC64E9Ebinary
MD5:06EEA670780D7B3466A0BD38DC27C6BD
SHA256:95924B9397CFDB5110F5BB0BAE48C7C70E214A0BDD617DC4EE59CBDDE5E77CE9
1256WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\AutoIt3.exe.5552.dmpbinary
MD5:7CD8AE55A90B58106592ED2CD737E147
SHA256:4C9A7129B65460BC13A17CCD6855607DF4B1F09E66CA60936A3422684DB2AF59
1256WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2D42.tmp.WERInternalMetadata.xmlxml
MD5:20CB97F0D785AF4D460A46954588782E
SHA256:C7C4229119B8E12265EECD515547BBC8CA2651B03317F700BE008718DCE09EC8
6548procexp64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\36AC0BE60E1243344AE145F746D881FEbinary
MD5:A20961D8BD1A5A7D241026D0011751FB
SHA256:4D6AE5BBEF0EACFDC09D5ADE4D145E883CF41B131E4C6988738769F1D32E12F3
6548procexp64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0B8A20E1F3F4D73D52A19929F922C892binary
MD5:0840F3C261E695105CD15C84EA85BEED
SHA256:F60632399A87485A7417DDF8B407DA66794C37347B3AA9E995EC389ECD091947
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
76
DNS requests
59
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5904
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6548
procexp64.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
6544
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6548
procexp64.exe
GET
200
2.16.164.51:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
3148
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6548
procexp64.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
6548
procexp64.exe
GET
200
2.16.164.43:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
unknown
—
—
whitelisted
6548
procexp64.exe
GET
200
152.199.19.74:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCEF5t3Ic3UIKEWBT0QtHYKiU%3D
unknown
—
—
whitelisted
6548
procexp64.exe
GET
200
104.18.38.233:80
http://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEHkXSqkUFzb%2BFafKnyz%2FRYg%3D
unknown
—
—
whitelisted
6548
procexp64.exe
GET
200
104.18.38.233:80
http://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEHkXSqkUFzb%2BFafKnyz%2FRYg%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4136
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3076
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4204
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3076
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4012
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5272
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.110
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted
www.bing.com
  • 2.23.209.130
  • 2.23.209.133
  • 2.23.209.191
  • 2.23.209.192
  • 2.23.209.193
  • 2.23.209.185
  • 2.23.209.189
  • 2.23.209.182
  • 2.23.209.186
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.2
  • 20.190.159.23
  • 40.126.31.73
  • 20.190.159.68
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.75
  • 40.126.32.74
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.134
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.31.169.57
  • 20.103.156.88
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
  • 40.68.123.157
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
test41.zip