File name:

master.zip

Full analysis: https://app.any.run/tasks/bc0baf07-4a69-4fde-98b1-cd90db2ad555
Verdict: Malicious activity
Analysis date: May 30, 2025, 18:23:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

EE6E2702BF5889749740A8D310776E4D

SHA1:

FD3291F4E2473189CF69BE6D7CDA57A349FEB129

SHA256:

A829BD71DC30486EC7CEB7E44B84684F0A745077FB922060F235A5CD5E2195D6

SSDEEP:

98304:3xH/crdz4VMhrhwwOsETppQM3JtD80H1fCi/Bvc8mFtsC9OJHG78xG7x+y9LcFtf:Weh5hx/L+q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1176)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • RunAsTI64.exe (PID: 5760)

    • Reads security settings of Internet Explorer

      • RunAsTI64.exe (PID: 5760)

    • Starts CMD.EXE for commands execution

      • RunAsTI64.exe (PID: 7964)
      • RunAsTI64.exe (PID: 6092)
      • RunFromToken64.exe (PID: 2064)
      • RunFromToken64.exe (PID: 5176)

    • Executable content was dropped or overwritten

      • RunAsTI64.exe (PID: 7964)
      • rundll32.exe (PID: 8140)
      • RunAsTI64.exe (PID: 6092)
      • rundll32.exe (PID: 5256)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 8000)
      • cmd.exe (PID: 5964)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7184)
      • sc.exe (PID: 5644)

    • Application launched itself

      • RunAsTI64.exe (PID: 5760)
      • RunAsTI64.exe (PID: 5256)

    • The system shut down or reboot

      • rundll32.exe (PID: 8140)
      • rundll32.exe (PID: 5256)
      • cmd.exe (PID: 6196)
      • firefox.exe (PID: 6800)
      • rundll32.exe (PID: 1260)
      • cmd.exe (PID: 1112)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 4748)
      • cmd.exe (PID: 1112)

    • The process creates files with name similar to system file names

      • rundll32.exe (PID: 8140)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4132)
      • shutdown.exe (PID: 4620)

  • INFO

    • Manual execution by a user

      • RunAsTI64.exe (PID: 5760)
      • RunAsTI64.exe (PID: 5256)
      • cmd.exe (PID: 6196)
      • WinRAR.exe (PID: 2668)
      • RunAsTI32.exe (PID: 6768)
      • firefox.exe (PID: 928)
      • RunAsTI64.exe (PID: 6204)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1176)
      • WinRAR.exe (PID: 2668)

    • Reads mouse settings

      • RunAsTI64.exe (PID: 5760)
      • RunAsTI64.exe (PID: 7964)
      • RunFromToken64.exe (PID: 2064)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 1176)
      • RunAsTI64.exe (PID: 7964)
      • RunAsTI64.exe (PID: 6092)
      • WinRAR.exe (PID: 2668)

    • Process checks computer location settings

      • RunAsTI64.exe (PID: 5760)

    • Checks supported languages

      • RunAsTI64.exe (PID: 5760)
      • RunAsTI64.exe (PID: 7964)
      • RunFromToken64.exe (PID: 2064)

    • Reads the computer name

      • RunAsTI64.exe (PID: 5760)
      • RunAsTI64.exe (PID: 7964)
      • RunFromToken64.exe (PID: 2064)

    • Create files in a temporary directory

      • RunAsTI64.exe (PID: 7964)

    • Application launched itself

      • firefox.exe (PID: 6800)
      • firefox.exe (PID: 928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:09:28 01:42:02
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: RunAsTI-master/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
414
Monitored processes
63
Malicious processes
0
Suspicious processes
7

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs rundll32.exe no specs runasti64.exe no specs conhost.exe no specs runasti64.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs runfromtoken64.exe sc.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs rundll32.exe shutdown.exe no specs conhost.exe no specs plugscheduler.exe no specs searchapp.exe runasti64.exe no specs conhost.exe no specs runasti64.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs runfromtoken64.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs rundll32.exe shutdown.exe no specs conhost.exe no specs rundll32.exe no specs shutdown.exe no specs conhost.exe no specs shutdown.exe no specs shutdown.exe no specs shutdown.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs shutdown.exe no specs winrar.exe runasti64.exe no specs conhost.exe no specs runasti32.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe shutdown.exe no specs conhost.exe no specs shutdown.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—shutdown.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
928"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
1112cmd.exeC:\Windows\System32\cmd.exe—RunFromToken64.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
1132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—RunAsTI64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1176"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\master.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1260rundll32.exe C:\Users\admin\Desktop\brick.dll,nothingC:\Windows\System32\rundll32.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
1420"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1888 -parentBuildID 20240213221259 -prefsHandle 1816 -prefMapHandle 1808 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf362783-c376-4cea-859f-59437e70edca} 6800 "\\.\pipe\gecko-crash-server-pipe.6800" 27cfbfbd110 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1524"shutdown" /r /t 0C:\Windows\System32\shutdown.exe—rundll32.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Shutdown and Annotation Tool
Exit code:
1115
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shutdownext.dll
1592\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—shutdown.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2064C:\Users\admin\AppData\Local\Temp\RunFromToken64.exe trustedinstaller.exe 5 cmd.exeC:\Users\admin\AppData\Local\Temp\RunFromToken64.exe
RunAsTI64.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
Start a program based on the privileges from a given process' token
Exit code:
0
Version:
1.0.0.3
Modules
Images
c:\users\admin\appdata\local\temp\runfromtoken64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
Total events
30 050
Read events
29 786
Write events
239
Delete events
25

Modification events

(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\master.zip
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(1176) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
218
Suspicious files
160
Text files
233
Unknown types
3

Dropped files

PID
Process
Filename
Type
8140rundll32.exeC:\Windows\System32\pfclient.dllexecutable
MD5:C5ABCA4CBEEC2C289BA71AE3994581B1
SHA256:024CE8922E468C4F66E15BC4BED96F7BEB3541BD553B3815AFA45A1BA9900DD1
8140rundll32.exeC:\Windows\System32\umpodev.dllexecutable
MD5:C5ABCA4CBEEC2C289BA71AE3994581B1
SHA256:024CE8922E468C4F66E15BC4BED96F7BEB3541BD553B3815AFA45A1BA9900DD1
1176WinRAR.exeC:\Users\admin\Desktop\master\RunAsTI-master\RunFromToken.au3text
MD5:9B8A3B85C206CAAD62E0BD6D0E324351
SHA256:0F854A55C48BE095F561B23A0072A7EDC23E76C527EF5C277B7083DA2C090B38
1176WinRAR.exeC:\Users\admin\Desktop\master\RunAsTI-master\LICENSE.mdtext
MD5:0CC0F65A3B9749B2070F2CBDFB426336
SHA256:54E72028E80627A0687E9DF6947B1100EFB0B68E7824486A8D8E7F2632B5066B
1176WinRAR.exeC:\Users\admin\Desktop\master\RunAsTI-master\.gitignoretext
MD5:69E7DD8DBF58A60418B04DDB157AD1A5
SHA256:A5E54048202DEF346FCD461496AAAF0B42D313153BEE1D54F46242E7B4ED9D20
1176WinRAR.exeC:\Users\admin\Desktop\master\RunAsTI-master\RunAsTI.au3text
MD5:3E16493C4DE00472602DE91E48986CB9
SHA256:6B5ED8AB26C41D00B731BA13FD24681EEFBB0F0966D11CD94158BCFF38F07374
1176WinRAR.exeC:\Users\admin\Desktop\master\RunAsTI-master\RunAsTI32.exeexecutable
MD5:214AFA30F54EE551FBFB640F6ABC32F5
SHA256:07E1FA6A80739C9939EAFB80C4D575FF1CD9A5680B7CEE401636F9AFD856887F
1176WinRAR.exeC:\Users\admin\Desktop\master\RunAsTI-master\RunAsTI64.exeexecutable
MD5:9B9F954F38F4987F1735F2A4AE15DDE0
SHA256:BF365D7D5BC3076E5A7F41BB9F0B9E9BEB58AE900BFFCB3BBB10B575C08D66DB
1176WinRAR.exeC:\Users\admin\Desktop\master\RunAsTI-master\readme.txttext
MD5:C8FECDE0137BC4EAEC69BF5C0A275A8A
SHA256:4C15AF9475A822EA88390AC77B0FD8755127CA063F0FD01C78DF5EBBF16CE41C
8140rundll32.exeC:\Windows\System32\directxdatabasehelper.dllexecutable
MD5:C5ABCA4CBEEC2C289BA71AE3994581B1
SHA256:024CE8922E468C4F66E15BC4BED96F7BEB3541BD553B3815AFA45A1BA9900DD1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
111
DNS requests
97
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6800
firefox.exe
POST
200
172.217.23.99:80
http://o.pki.goog/s/wr3/3H4
unknown
—
—
whitelisted
5140
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5140
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5116
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5140
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5140
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5140
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4608
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4608
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
self.events.data.microsoft.com
  • 20.42.65.84
  • 20.189.173.28
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
master.zip