File name:

93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7

Full analysis: https://app.any.run/tasks/952dac1c-3bd3-4e76-8c5c-f84248a87b5a
Verdict: Malicious activity
Analysis date: February 17, 2025, 14:19:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

1B11867E6C2C94A121B90F448FF89949

SHA1:

2A99BE04FF50278100CE15C608BFB7D7D862CAF1

SHA256:

93A9942D83FCF3CBAFF77D94328976BA9ACD5368275B7E3BAEACA9745EA4B6E7

SSDEEP:

49152:rktSlAf4zkaHhpza1Fz5N08XG6mF7lxel8eeWnMYssnJNfJ9idJn5nN4v914j322:rk0Sf4zkaBpza1FtNTXG68il8LhYssJ4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Detects Cygwin installation

      • WinRAR.exe (PID: 3816)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 6788)
      • net.exe (PID: 6872)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 3816)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3816)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 3816)
      • powershell.exe (PID: 2060)
      • cmd.exe (PID: 6264)
      • powershell.exe (PID: 6536)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 3816)
      • powershell.exe (PID: 2060)
      • powershell.exe (PID: 6536)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3524)
      • cmd.exe (PID: 4328)
      • cmd.exe (PID: 3220)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 3420)
      • cmd.exe (PID: 5752)
      • cmd.exe (PID: 6264)
      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 1016)
      • cmd.exe (PID: 6464)
      • cmd.exe (PID: 6788)

    • Starts process via Powershell

      • powershell.exe (PID: 2060)
      • powershell.exe (PID: 6536)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 6352)
      • cmd.exe (PID: 6464)
      • cmd.exe (PID: 6612)

    • Application launched itself

      • cmd.exe (PID: 6264)

    • Hides command output

      • cmd.exe (PID: 6612)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6788)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6956)
      • sc.exe (PID: 6996)
      • sc.exe (PID: 7016)

    • Creates a new Windows service

      • sc.exe (PID: 6976)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3816)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 3816)

    • Manual execution by a user

      • cmd.exe (PID: 4328)
      • cmd.exe (PID: 3524)
      • cmd.exe (PID: 3220)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 3420)
      • cmd.exe (PID: 6264)
      • cmd.exe (PID: 1016)
      • cmd.exe (PID: 5752)
      • cmd.exe (PID: 6464)

    • Reads the computer name

      • MpCmdRun.exe (PID: 1016)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4328)
      • cmd.exe (PID: 3524)
      • cmd.exe (PID: 3220)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 3420)
      • cmd.exe (PID: 5752)
      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 6264)
      • cmd.exe (PID: 1016)
      • cmd.exe (PID: 6464)
      • cmd.exe (PID: 6788)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 1016)

    • Checks supported languages

      • chcp.com (PID: 4132)
      • MpCmdRun.exe (PID: 1016)
      • chcp.com (PID: 6016)
      • chcp.com (PID: 4952)
      • chcp.com (PID: 2072)
      • chcp.com (PID: 4536)
      • chcp.com (PID: 5628)
      • chcp.com (PID: 5788)
      • chcp.com (PID: 6328)
      • chcp.com (PID: 4504)
      • chcp.com (PID: 6232)
      • chcp.com (PID: 6852)
      • chcp.com (PID: 6516)

    • Disables trace logs

      • powershell.exe (PID: 6628)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6628)

    • Checks proxy server information

      • powershell.exe (PID: 6628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:11:07 15:00:14
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ??室/bin/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
52
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs conhost.exe no specs chcp.com no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe conhost.exe no specs chcp.com no specs cmd.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs powershell.exe no specs cmd.exe no specs powershell.exe cmd.exe conhost.exe no specs chcp.com no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1016"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
1016C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\discord.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
1348C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\service_install.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2060powershell -Command "Start-Process 'cmd.exe' -ArgumentList '/k \"\"C:\Users\admin\Desktop\service_install.bat\" admin\"' -Verb RunAs"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2072chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
2216\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3220C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\general (ALT2).bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3420C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\general (Œƒ’‘2).bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3524C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\general (ALT3).bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
19 964
Read events
19 955
Write events
9
Delete events
0

Modification events

(PID) Process:(3816) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3816) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3816) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3816) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip
(PID) Process:(3816) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3816) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3816) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3816) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3816) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
4
Suspicious files
4
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\bin\quic_initial_www_google_com.binbinary
MD5:312526D39958D89B1F8AB67789AB985F
SHA256:F4589C57749F956BB30538197A521D7005F8B0A8723B4707E72405E51DDAC50A
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\bin\WinDivert.dllexecutable
MD5:B2014D33EE645112D5DC16FE9D9FCBFF
SHA256:C1E060EE19444A259B2162F8AF0F3FE8C4428A1C6F694DCE20DE194AC8D7D9A2
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\discord.battext
MD5:C01056F88C8646CAB2D85A31F44F1186
SHA256:21ADF614F58D39396C49BF10AE3F6187905F328E24D7363372D299F821D18CF6
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\general (ALT5).battext
MD5:DC9657042904B682CDCF34B8AC732168
SHA256:AD49282AF6FC53DA5CC11FFB91C8A3D276B711695AE2777262BEC2685424FB03
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\general.battext
MD5:1F9E2279F96B01B8C1723B77DB9FC8B8
SHA256:AF7CA78237DD2E3E66D581EBBA166DC19D4EF7E02A269FB7A26D079592C72479
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\general (ALT3).battext
MD5:6E0FD8729815F1941C5FD4016C888EC5
SHA256:198FDA8A2FC02A4A501F13B67D1232DFCB3157075D3AB76494D17C64742E82D3
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\general (ALT).battext
MD5:F2DFDB0EC74378D6DEFC004BCFCEE491
SHA256:ADFA52BEACE1FF288D2CC20D6814E8EB04FAE5A9256B600C402F91AB94AF5886
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\bin\cygwin1.dllexecutable
MD5:C50B50303FAE4AFE7248307339A00D13
SHA256:712C39A069541AFA69CFCBE01B422BD67B4201EEE7E94CC1327D4ED8B4FA2167
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\bin\winws.exeexecutable
MD5:444FE359CA183016B93D8BFE398D5103
SHA256:0453FCE6906402181DBFF7E09B32181EB1C08BB002BE89849E8992B832F43B89
3816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR3816.29832\93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7.zip\«ís«ñ\check_updates.battext
MD5:C0AF479B986A7E2095929A68136CD97C
SHA256:438ADFB9F66429E1B6B0474FE0CDBD397098D58C4B80FF2C74237C6F9B99DF23
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
8
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.17:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5392
svchost.exe
GET
200
2.16.164.17:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5392
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
—
140.82.121.3:443
https://raw.githubusercontent.com/Flowseal/zapret-discord-youtube/refs/heads/main/.service/version.txt
unknown
—
—
—
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.19.96.90:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5392
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.17:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5392
svchost.exe
2.16.164.17:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5392
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.19.96.90
  • 2.19.96.83
  • 2.19.96.129
  • 2.19.96.120
  • 2.19.96.66
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 2.16.164.17
  • 2.16.164.40
  • 2.16.164.34
  • 2.16.164.24
  • 2.16.164.106
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.108.133
whitelisted
self.events.data.microsoft.com
  • 13.89.179.10
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
93a9942d83fcf3cbaff77d94328976ba9acd5368275b7e3baeaca9745ea4b6e7