File name:

image001.wmz

Full analysis: https://app.any.run/tasks/9989085a-2a5c-4c31-ac65-42e78d7ad36b
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 14, 2025, 14:55:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
lua
Indicators:
MIME: application/gzip
File info: gzip compressed data, max speed, from NTFS filesystem (NT), original size modulo 2^32 1712672
MD5:

FF41EC7A7294D20132CA5B26B665FC61

SHA1:

3C13BF83BB182822FA7DBE9C1232524A81ED4E61

SHA256:

A5CB26D2B0F2B6F24242420F7C6E478EFE7081774B4EB89AC40CD4F0FBBFB48A

SSDEEP:

1536:VPFnbrgmluILtNs1lmXcjY/CVBw4pMunMImRVbFFeZi6WIIW0jwgvg0FVH:5FI+1iTnj/YunMzVo/P0jsQH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RANSOMWARE has been detected

      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 5400)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • setup_wm.exe (PID: 904)
      • wmplayer.exe (PID: 6132)
      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 5400)
      • vlc.exe (PID: 5084)

    • SQL CE related mutex has been found

      • unregmp2.exe (PID: 5064)
      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 5400)

    • Reads Microsoft Outlook installation path

      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 5400)

    • Reads Internet Explorer settings

      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 5400)

    • There is functionality for taking screenshot (YARA)

      • vlc.exe (PID: 5084)

  • INFO

    • Reads the software policy settings

      • slui.exe (PID: 7300)
      • wmplayer.exe (PID: 4000)
      • slui.exe (PID: 6476)

    • Manual execution by a user

      • wmplayer.exe (PID: 6132)
      • notepad++.exe (PID: 7660)
      • wmplayer.exe (PID: 5400)
      • vlc.exe (PID: 5084)

    • Reads the computer name

      • wmplayer.exe (PID: 6132)
      • setup_wm.exe (PID: 904)
      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 5400)
      • vlc.exe (PID: 5084)

    • Reads security settings of Internet Explorer

      • unregmp2.exe (PID: 5156)
      • unregmp2.exe (PID: 5640)

    • Checks proxy server information

      • setup_wm.exe (PID: 904)
      • wmplayer.exe (PID: 4000)
      • slui.exe (PID: 6476)
      • wmplayer.exe (PID: 5400)

    • Create files in a temporary directory

      • unregmp2.exe (PID: 5156)
      • setup_wm.exe (PID: 904)

    • Process checks computer location settings

      • setup_wm.exe (PID: 904)
      • wmplayer.exe (PID: 6132)
      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 5400)

    • Checks supported languages

      • setup_wm.exe (PID: 904)
      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 6132)
      • wmplayer.exe (PID: 5400)
      • vlc.exe (PID: 5084)

    • Creates files or folders in the user directory

      • unregmp2.exe (PID: 5064)
      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 5400)

    • Reads the machine GUID from the registry

      • wmplayer.exe (PID: 4000)
      • wmplayer.exe (PID: 5400)

    • The process uses Lua

      • vlc.exe (PID: 5084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

Compression: Deflated
Flags: (none)
ModifyDate: 0000:00:00 00:00:00
ExtraFlags: Fastest Algorithm
OperatingSystem: NTFS filesystem (NT)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
16
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe wmplayer.exe no specs setup_wm.exe no specs unregmp2.exe no specs unregmp2.exe no specs slui.exe unregmp2.exe no specs unregmp2.exe no specs THREAT wmplayer.exe notepad++.exe no specs THREAT wmplayer.exe no specs vlc.exe no specs openwith.exe no specs vlc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
900"C:\WINDOWS\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANTC:\Windows\System32\unregmp2.exe—unregmp2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\unregmp2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
904"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /layout:"C:\Users\admin\Desktop\image001.wmz"C:\Program Files (x86)\Windows Media Player\setup_wm.exe—wmplayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Configuration Utility
Exit code:
1
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows media player\setup_wm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2284"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\image001.wmz.gzC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4000"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /layout:"C:\Users\admin\Desktop\image001.wmz"C:\Program Files (x86)\Windows Media Player\wmplayer.exe
setup_wm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows media player\wmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5064"C:\WINDOWS\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANTC:\Windows\System32\unregmp2.exe—unregmp2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\unregmp2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5084"C:\Program Files\VideoLAN\VLC\vlc.exe" C:\Program Files\VideoLAN\VLC\vlc.exe—explorer.exe
User:
admin
Company:
VideoLAN
Integrity Level:
MEDIUM
Description:
VLC media player
Exit code:
0
Version:
3.0.11
Modules
Images
c:\program files\videolan\vlc\vlc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5156"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogonC:\Windows\SysWOW64\unregmp2.exe—wmplayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\unregmp2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5400"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /layout:"C:\Users\admin\Desktop\image001.wmz"C:\Program Files (x86)\Windows Media Player\wmplayer.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows media player\wmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5640C:\WINDOWS\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibraryC:\Windows\SysWOW64\unregmp2.exe—setup_wm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\unregmp2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6132"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /layout:"C:\Users\admin\Desktop\image001.wmz"C:\Program Files (x86)\Windows Media Player\wmplayer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows media player\wmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
21 350
Read events
20 977
Write events
342
Delete events
31

Modification events

(PID) Process:(2284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\image001.wmz.gz
(PID) Process:(2284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(904) setup_wm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences
Operation:delete valueName:UsageTracking
Value:
(PID) Process:(904) setup_wm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences
Operation:delete valueName:ForceUsageTracking
Value:
Executable files
9
Suspicious files
13
Text files
36
Unknown types
0

Dropped files

PID
Process
Filename
Type
5064unregmp2.exeC:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.baktext
MD5:7050D5AE8ACFBE560FA11073FEF8185D
SHA256:CB87767C4A384C24E4A0F88455F59101B1AE7B4FB8DE8A5ADB4136C5F7EE545B
4000wmplayer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:5B63C0144C61100C949E65C9B4C7B790
SHA256:51E7A9D4403161514027724D012C19E4717FD92CC87B31049944A37B40228B8E
2284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2284.42300\image001.wmzimage
MD5:3A57C15C972FBB27CDC9017A9B1CE22D
SHA256:B0303D253A734F6370D369210521F5504CA4FEA2518BE8E39FCB2A469F77C102
4000wmplayer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LEE0Q2MFEQI13OCI3ZNQ.tempbinary
MD5:1EF7B842C619F6F39BA52B61ADD71CFC
SHA256:9D4F692056F671C56D39DBD436CEFF6063A27B7933C3743C2B2DAF60CA5519B4
4000wmplayer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:874995197D809A7AA1A724435F5E2960
SHA256:CDE1FF961B1C9C20BE355F27E6A9447ABBD167EC686618CFD03896DC190CCDF2
4000wmplayer.exeC:\Users\admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000AEDD\06_Pictures_rated_4_or_5_stars.wplhtml
MD5:0A8A40CA87323DC16893194B00C7FE77
SHA256:9AA433BED2E090CC6904F1C24D5A7B5A1ED6D8F71A997E661B886C69383FD53E
5064unregmp2.exeC:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XMLtext
MD5:A9B5DA9AEC61657B32393D96217165F0
SHA256:9F4611369CF65B33D886489B2486FCA7B1E83E0DC998D35B15B3AA4C8478A28D
4000wmplayer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:141BC325067E48E1648B4FCF60375EA2
SHA256:F0DB287BFDDE3B1062CE6A35EF94E6F572E9FE617947895A9801702B844F948A
4000wmplayer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-msbinary
MD5:1EF7B842C619F6F39BA52B61ADD71CFC
SHA256:9D4F692056F671C56D39DBD436CEFF6063A27B7933C3743C2B2DAF60CA5519B4
5064unregmp2.exeC:\Users\admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbbinary
MD5:79AEACC048DB9CA31E1BAF148FFC66C6
SHA256:9974FC100ABF3300E5EBCAB88D7BA8F66158429E8EBB155F7118AECCC062FFF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
28
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4000
wmplayer.exe
GET
200
23.53.42.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4000
wmplayer.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8000
SIHClient.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8000
SIHClient.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.53.42.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
23.53.42.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
300
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.53.42.18
  • 23.53.41.248
whitelisted
www.microsoft.com
  • 72.246.169.155
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.23
  • 40.126.31.1
  • 20.190.159.68
  • 20.190.159.128
  • 40.126.31.73
  • 40.126.31.67
  • 20.190.159.129
  • 40.126.32.74
  • 40.126.32.76
  • 20.190.160.131
  • 20.190.160.130
  • 20.190.160.128
  • 20.190.160.66
  • 40.126.32.138
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
image001.wmz