File name:

W10 Digital Activation Program v1.3.3 Portable.7z

Full analysis: https://app.any.run/tasks/07abe98f-5a8d-4aaa-b8da-701ac0589877
Verdict: Malicious activity
Analysis date: October 02, 2024, 20:22:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.3
MD5:

78253C1C61CD01C3B821ADCF359F34FF

SHA1:

727AB579C28C1E1AA6794F40929E10685D105562

SHA256:

9D0A673C999FEF8369E44B649282DC0EFF9D17640A1E619529F2AAA4279EECDD

SSDEEP:

49152:jeQ/kxtvo9tms3pw++TgQe/IusAbFnlko11TDI9s4Hdm3+lRspHyhjPWUxV8hFYB:jTSns5wH9eAusGk+HGsMmOlRspsjPHrL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • W10DigitalActivation.exe (PID: 1020)
      • W10DigitalActivation.exe (PID: 7052)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 2980)
      • cmd.exe (PID: 3860)
      • cmd.exe (PID: 2632)
      • cmd.exe (PID: 4896)
      • cmd.exe (PID: 6308)
      • cmd.exe (PID: 8)
      • cmd.exe (PID: 3876)
      • cmd.exe (PID: 7016)
      • cmd.exe (PID: 3588)
      • cmd.exe (PID: 2912)
      • cmd.exe (PID: 5984)

    • Starts CMD.EXE for commands execution

      • W10DigitalActivation.exe (PID: 1020)
      • W10DigitalActivation.exe (PID: 7052)

    • The process executes VB scripts

      • cmd.exe (PID: 3916)
      • cmd.exe (PID: 6644)
      • cmd.exe (PID: 68)
      • cmd.exe (PID: 368)
      • cmd.exe (PID: 5060)
      • cmd.exe (PID: 2180)
      • cmd.exe (PID: 3188)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 3180)
      • cmd.exe (PID: 4544)
      • cmd.exe (PID: 6832)
      • cmd.exe (PID: 7112)
      • cmd.exe (PID: 32)
      • cmd.exe (PID: 2424)

    • Executable content was dropped or overwritten

      • W10DigitalActivation.exe (PID: 1020)
      • W10DigitalActivation.exe (PID: 7052)

    • Application launched itself

      • ClipUp.exe (PID: 5092)
      • ClipUp.exe (PID: 1744)

    • Starts a Microsoft application from unusual location

      • gatherosstate.exe (PID: 2932)
      • gatherosstate.exe (PID: 7100)

  • INFO

    • Manual execution by a user

      • W10DigitalActivation.exe (PID: 5524)
      • W10DigitalActivation.exe (PID: 3028)
      • W10DigitalActivation.exe (PID: 7052)
      • W10DigitalActivation.exe (PID: 1020)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4276)

    • UPX packer has been detected

      • W10DigitalActivation.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (gen) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
256
Monitored processes
102
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs w10digitalactivation.exe no specs THREAT w10digitalactivation.exe cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs gatherosstate.exe no specs cmd.exe no specs conhost.exe no specs clipup.exe no specs clipup.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs slui.exe no specs cscript.exe no specs w10digitalactivation.exe no specs w10digitalactivation.exe cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs gatherosstate.exe no specs cmd.exe no specs conhost.exe no specs clipup.exe no specs clipup.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
8"C:\WINDOWS\Sysnative\cmd.exe" /c C:\WINDOWS\System32\sc.exe start wuauservC:\Windows\System32\cmd.exe—W10DigitalActivation.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
32"C:\WINDOWS\Sysnative\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens\Kernel" /f /v "Kernel-ProductInfo" /t REG_DWORD /d 48C:\Windows\System32\cmd.exe—W10DigitalActivation.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
68"C:\WINDOWS\Sysnative\cmd.exe" /c cscript.exe C:\WINDOWS\System32\slmgr.vbs //NoLogo /xprC:\Windows\System32\cmd.exe—W10DigitalActivation.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
368"C:\WINDOWS\Sysnative\cmd.exe" /c cscript.exe C:\WINDOWS\System32\slmgr.vbs //NoLogo /ipk VK7JG-NPHTM-C97JM-9MPGT-3V66TC:\Windows\System32\cmd.exe—W10DigitalActivation.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
660reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens" /f /v "Channel" /t REG_SZ /d RetailC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
876\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
892C:\WINDOWS\System32\sc.exe start licensemanagerC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1056
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1008"C:\WINDOWS\Sysnative\cmd.exe" /c C:\WINDOWS\System32\ClipUp.exe -v -o -altto C:\WINDOWS\Temp\BIN\C:\Windows\System32\cmd.exe—W10DigitalActivation.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1020"C:\Users\admin\Desktop\W10 Digital Activation Program v1.3.3 Portable\W10DigitalActivation.exe" C:\Users\admin\Desktop\W10 Digital Activation Program v1.3.3 Portable\W10DigitalActivation.exe
explorer.exe
User:
admin
Company:
Ratiborus
Integrity Level:
HIGH
Description:
W10 Digital Activation Program
Exit code:
0
Modules
Images
c:\users\admin\desktop\w10 digital activation program v1.3.3 portable\w10digitalactivation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 287
Read events
5 247
Write events
25
Delete events
15

Modification events

(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\W10 Digital Activation Program v1.3.3 Portable.7z
(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:13
Value:
(PID) Process:(4276) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:12
Value:
Executable files
5
Suspicious files
0
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
1020W10DigitalActivation.exeC:\Windows\Temp\BIN\slc.dllexecutable
MD5:E2840606372AB67B7107CE757D506C28
SHA256:37E20A504ADE965184D92ED5CA415CDE899090A6A20EA3ABF8C85FF9648B66F4
2300ClipUp.exeC:\Users\admin\AppData\Local\Temp\tem2BCB.tmptext
MD5:7C337AEC9F3BD545225D2874B410E994
SHA256:E9C285F14A435DB90963DA33E9001B7AA86610D6969F186134ED28D1961FE4A8
2300ClipUp.exeC:\ProgramData\Microsoft\Windows\ClipSVC\Install\Migration\94ee03b2-4984-4b4e-a028-d6da9ecb3525.xmltext
MD5:85968406F5F6A5678D5C792518362DBC
SHA256:A89C7722A75368D4E9D8D80BEE1F925161A6E363C8CC4159F5E3F3FFCD423766
7052W10DigitalActivation.exeC:\Windows\Temp\BIN\gatherosstate.exeexecutable
MD5:B13BC5B62F54607C334A6464D9B85CC8
SHA256:51791625054B01802FD5AAA6C4A929827B369DFEF7B2891B5F55E0FA61AF0C7D
2628ClipUp.exeC:\Users\admin\AppData\Local\Temp\tem78B9.tmptext
MD5:2E6B91EAC3ACDC84F0F35300929369E6
SHA256:34725A4EB12DCD8C012CBFD885E96AB6CAD7F8BC04615F3D829E8A1DA1102DBD
7100gatherosstate.exeC:\Windows\Temp\BIN\GenuineTicket.xmlxml
MD5:A55D9F9AFB5A569B5D684AD1BD910858
SHA256:ECB50BD9E53790E35A25D68BC774F2CCCCE28CF8DD74F68964425C9A4B878206
2932gatherosstate.exeC:\Windows\Temp\BIN\GenuineTicket.xmlxml
MD5:1970A5BADA162536396025981F9CF15E
SHA256:0DF8EFCCFC6B4EC0A6D21E12C4150859FEE206A8429CA0600EF166433D3997B9
1020W10DigitalActivation.exeC:\Windows\Temp\BIN\gatherosstate.exeexecutable
MD5:B13BC5B62F54607C334A6464D9B85CC8
SHA256:51791625054B01802FD5AAA6C4A929827B369DFEF7B2891B5F55E0FA61AF0C7D
4276WinRAR.exeC:\Users\admin\Desktop\W10 Digital Activation Program v1.3.3 Portable\readme_en.txttext
MD5:E76FB6DDA71F6F7900F42BAF5CBB58F7
SHA256:84D214B314F28A733401957401277217452C5407F0500D460ECA867A1C581C2B
4276WinRAR.exeC:\Users\admin\Desktop\W10 Digital Activation Program v1.3.3 Portable\readme_ru.txttext
MD5:58E55C4587FBC759665B134768B18DB1
SHA256:8DA72B4220EFCB3312FC1E7BFEF666CFB069A702B6539C447D3F82312010F794
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
84
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2572
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1448
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6956
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4344
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4344
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1448
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2572
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2572
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
google.com
  • 172.217.16.142
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.64
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
browser.pipe.aria.microsoft.com
  • 20.189.173.16
  • 20.44.10.123
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
W10 Digital Activation Program v1.3.3 Portable.7z