File name:

Sample.zip

Full analysis: https://app.any.run/tasks/1c84d13b-0b37-4dd4-a8f2-f1908f4f490e
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 21:35:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-scr
rat
remcos
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

0A39B7D8AC3424D7D9682AEBE5BAE755

SHA1:

EA43DE44B12FE7E78561C34FFC6BE696EC420B0B

SHA256:

91A9FAB8A37BAE5DB8983DEDA3C57B6A694E66102681704DF8FA65E9B0FCF818

SSDEEP:

6144:rpCXhGVXYOMj78vcMRlH++KQhW+U6oDnZpGl3/b9Cp1qbJYz:18OHRH++a+FoDnZUlPb9CWez

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7384)

    • Changes the autorun value in the registry

      • reg.exe (PID: 5164)
      • reg.exe (PID: 6640)

    • REMCOS has been detected

      • Office.exe (PID: 5512)

    • REMCOS mutex has been found

      • Office.exe (PID: 5512)
      • Office.exe (PID: 7736)
      • Office.exe (PID: 5352)
      • Office.exe (PID: 5308)
      • Office.exe (PID: 3300)

    • REMCOS has been detected (YARA)

      • Office.exe (PID: 5512)
      • Office.exe (PID: 8024)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • cmd.exe (PID: 7928)
      • wscript.exe (PID: 2284)
      • wscript.exe (PID: 7984)
      • cmd.exe (PID: 5576)
      • cmd.exe (PID: 4736)
      • wscript.exe (PID: 240)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 8012)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7928)
      • wscript.exe (PID: 2284)
      • wscript.exe (PID: 7984)
      • cmd.exe (PID: 5576)
      • wscript.exe (PID: 240)
      • cmd.exe (PID: 4736)

    • Application launched itself

      • cmd.exe (PID: 7928)
      • cmd.exe (PID: 5576)
      • cmd.exe (PID: 4736)

    • Process copies executable file

      • cmd.exe (PID: 7928)
      • cmd.exe (PID: 5576)
      • cmd.exe (PID: 4736)

    • The process executes VB scripts

      • cmd.exe (PID: 8092)
      • cmd.exe (PID: 8084)
      • cmd.exe (PID: 6752)
      • cmd.exe (PID: 6592)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 6112)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2284)
      • wscript.exe (PID: 4880)
      • wscript.exe (PID: 7984)
      • wscript.exe (PID: 8124)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 8092)
      • cmd.exe (PID: 7340)
      • cmd.exe (PID: 6476)
      • cmd.exe (PID: 6592)
      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 6112)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7340)
      • cmd.exe (PID: 6476)
      • cmd.exe (PID: 1096)

    • Connects to unusual port

      • Office.exe (PID: 5512)
      • Office.exe (PID: 8024)

    • There is functionality for taking screenshot (YARA)

      • Office.exe (PID: 5512)
      • Office.exe (PID: 8024)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 7928)
      • Office.exe (PID: 7736)
      • Office.exe (PID: 5352)
      • cmd.exe (PID: 5576)
      • Office.exe (PID: 3300)
      • cmd.exe (PID: 4736)
      • Taskmgr.exe (PID: 896)
      • Taskmgr.exe (PID: 4180)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7384)

    • Reads the computer name

      • Office.exe (PID: 5512)

    • Checks supported languages

      • Office.exe (PID: 5512)
      • Office.exe (PID: 7736)
      • Office.exe (PID: 5352)
      • Office.exe (PID: 5308)
      • Office.exe (PID: 3300)

    • UPX packer has been detected

      • Office.exe (PID: 5512)
      • Office.exe (PID: 8024)

    • Reads the software policy settings

      • slui.exe (PID: 7548)
      • slui.exe (PID: 7672)

    • Checks proxy server information

      • slui.exe (PID: 7672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:05:10 21:39:26
ZipCRC: 0xa54b2ce8
ZipCompressedSize: 179
ZipUncompressedSize: 216
ZipFileName: Free Microsoft Office 2019/inyector.vbs
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
204
Monitored processes
67
Malicious processes
16
Suspicious processes
7

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs cmd.exe no specs conhost.exe no specs xcopy.exe no specs xcopy.exe xcopy.exe no specs xcopy.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cacls.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs reg.exe #REMCOS office.exe conhost.exe no specs slui.exe #REMCOS office.exe no specs #REMCOS office.exe no specs cmd.exe no specs conhost.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cacls.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs reg.exe #REMCOS office.exe no specs #REMCOS office.exe no specs taskmgr.exe no specs taskmgr.exe cmd.exe no specs conhost.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cacls.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs reg.exe no specs #REMCOS office.exe conhost.exe no specs shellexperiencehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\getadmin.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896"C:\WINDOWS\system32\taskmgr.exe" /7C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
1096"C:\Windows\System32\cmd.exe" /c "C:\Tests\PERSIS~1.BAT" C:\Windows\System32\cmd.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1128xcopy "startup.bat" "C:\Tests" /H /C /YC:\Windows\System32\xcopy.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extended Copy Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\xcopy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ifsutil.dll
c:\windows\system32\ulib.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\devobj.dll
2284"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\getadmin.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2384"C:\WINDOWS\system32\cacls.exe" "C:\WINDOWS\system32\config\system"C:\Windows\System32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\ucrtbase.dll
3008xcopy "inyector.vbs" "C:\Tests" /H /C /YC:\Windows\System32\xcopy.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extended Copy Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\xcopy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\ifsutil.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\devobj.dll
3192\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3300"C:\Users\admin\Desktop\Free Microsoft Office 2019\Office.exe" C:\Users\admin\Desktop\Free Microsoft Office 2019\Office.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\desktop\free microsoft office 2019\office.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 994
Read events
16 951
Write events
42
Delete events
1

Modification events

(PID) Process:(7384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Sample.zip
(PID) Process:(7384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(8084) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(8092) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
Executable files
2
Suspicious files
0
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
7384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7384.22418\Free Microsoft Office 2019\inyector.vbstext
MD5:C92CCF4CFBC720BB9C8380F123A4D874
SHA256:3F8CA1E410A3B7B817FDB5FCD62F67AA018A27801316C27B2F418035568D07C6
7384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7384.22418\Free Microsoft Office 2019\persistence.battext
MD5:076129228214FB6C0DC42953FCF1300D
SHA256:5732292C87F8B564D0B4173E57DBCDCBB445FE15A7A5A62B84DFC218DA3B8348
6592cmd.exeC:\Users\admin\AppData\Local\Temp\getadmin.vbstext
MD5:D14A6C18536B08C2D91CC10129CEC2CA
SHA256:88F0E55BE41422957E8F4FEC8CAF0F9ED4E68D1F0290171BA8F4BD26C19FA17D
8092cmd.exeC:\Users\admin\AppData\Local\Temp\getadmin.vbstext
MD5:D14A6C18536B08C2D91CC10129CEC2CA
SHA256:88F0E55BE41422957E8F4FEC8CAF0F9ED4E68D1F0290171BA8F4BD26C19FA17D
8036xcopy.exeC:\Tests\inyector.vbstext
MD5:C92CCF4CFBC720BB9C8380F123A4D874
SHA256:3F8CA1E410A3B7B817FDB5FCD62F67AA018A27801316C27B2F418035568D07C6
7384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7384.22418\Free Microsoft Office 2019\startup.battext
MD5:8352074E8780FE8618AC2648102A2181
SHA256:75700ECF871D5E78F4969DEC52E18A8DA209C281B43442F50CB6EC94E652ED76
7988xcopy.exeC:\Tests\startup.battext
MD5:8352074E8780FE8618AC2648102A2181
SHA256:75700ECF871D5E78F4969DEC52E18A8DA209C281B43442F50CB6EC94E652ED76
6112cmd.exeC:\Users\admin\AppData\Local\Temp\getadmin.vbstext
MD5:D14A6C18536B08C2D91CC10129CEC2CA
SHA256:88F0E55BE41422957E8F4FEC8CAF0F9ED4E68D1F0290171BA8F4BD26C19FA17D
8012xcopy.exeC:\Tests\Office.exeexecutable
MD5:250B6861E169468A353B5FF11F5A8314
SHA256:4882AB85C057A62D2BEF5E4EB30E042577A404A4B7F333F41A81381A9339BE5A
8060xcopy.exeC:\Tests\persistence.battext
MD5:076129228214FB6C0DC42953FCF1300D
SHA256:5732292C87F8B564D0B4173E57DBCDCBB445FE15A7A5A62B84DFC218DA3B8348
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
52
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7176
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7176
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.130
  • 40.126.32.74
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.159.23
  • 20.190.159.130
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.129
  • 20.190.159.68
  • 20.190.159.2
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sample.zip