File name:

malware.zip

Full analysis: https://app.any.run/tasks/69f75e1b-5ba8-412d-bcea-8e1a88015955
Verdict: Malicious activity
Analysis date: June 13, 2025, 15:17:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
delphi
inno
installer
arch-doc
antivm
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

27414B404803B738BB12F0B9104529CB

SHA1:

A6E3CA0308BC057917665F122B01323A090B8356

SHA256:

AA55951CC57AC36852FD982332CC33E76B4EC27A8D78E1FBCF2E760434CBF31C

SSDEEP:

98304:if0NinOMpPkIP7hUG8zG1eES2SnmEsgeziqyauY/52Vc+eC4YvFr5FvgJCAM6+wj:30mioNUDu6MT7pe2Q/P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2076)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2076)
      • javaw.exe (PID: 1652)

    • Executable content was dropped or overwritten

      • SKlauncher-3.2.12_Setup.exe (PID: 5496)
      • 7za.exe (PID: 4816)
      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)
      • javaw.exe (PID: 1652)

    • Reads the Windows owner or organization settings

      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)

    • Process drops legitimate windows executable

      • 7za.exe (PID: 4816)
      • javaw.exe (PID: 1652)

    • The process drops C-runtime libraries

      • 7za.exe (PID: 4816)
      • javaw.exe (PID: 1652)

    • Drops 7-zip archiver for unpacking

      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)

    • There is functionality for VM detection VMWare (YARA)

      • javaw.exe (PID: 1652)

    • There is functionality for VM detection antiVM strings (YARA)

      • javaw.exe (PID: 1652)

    • There is functionality for VM detection VirtualBox (YARA)

      • javaw.exe (PID: 1652)

    • There is functionality for taking screenshot (YARA)

      • javaw.exe (PID: 1652)

  • INFO

    • Checks supported languages

      • SKlauncher-3.2.12_Setup.exe (PID: 5496)
      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)
      • 7za.exe (PID: 4816)
      • javaw.exe (PID: 1652)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2076)

    • Create files in a temporary directory

      • SKlauncher-3.2.12_Setup.exe (PID: 5496)
      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)
      • javaw.exe (PID: 1652)

    • Reads the computer name

      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)
      • 7za.exe (PID: 4816)
      • javaw.exe (PID: 1652)

    • Checks proxy server information

      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)

    • Detects InnoSetup installer (YARA)

      • SKlauncher-3.2.12_Setup.exe (PID: 5496)
      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)

    • Compiled with Borland Delphi (YARA)

      • SKlauncher-3.2.12_Setup.exe (PID: 5496)
      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)

    • Creates a software uninstall entry

      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)

    • Creates files or folders in the user directory

      • 7za.exe (PID: 4816)
      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)
      • javaw.exe (PID: 1652)

    • The sample compiled with english language support

      • 7za.exe (PID: 4816)
      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)
      • javaw.exe (PID: 1652)

    • Reads Environment values

      • javaw.exe (PID: 1652)

    • Reads the software policy settings

      • SKlauncher-3.2.12_Setup.tmp (PID: 5008)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 1652)

    • Process checks computer location settings

      • javaw.exe (PID: 1652)

    • Reads CPU info

      • javaw.exe (PID: 1652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0008
ZipCompression: Deflated
ZipModifyDate: 2025:06:13 17:17:30
ZipCRC: 0xd2d45f21
ZipCompressedSize: 2231025
ZipUncompressedSize: 2235523
ZipFileName: fabric-api-0.126.0+1.21.5.jar
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
10
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sklauncher-3.2.12_setup.exe sklauncher-3.2.12_setup.tmp 7za.exe conhost.exe no specs javaw.exe slui.exe reg.exe no specs conhost.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1652"C:\Users\admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe" -Xmx512M -jar "C:\Users\admin\AppData\Roaming\sklauncher\SKlauncher.jar"C:\Users\admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe
SKlauncher-3.2.12_Setup.tmp
User:
admin
Company:
Eclipse Adoptium
Integrity Level:
MEDIUM
Description:
OpenJDK Platform binary
Version:
21.0.6.0
Modules
Images
c:\users\admin\appdata\roaming\sklauncher\jre\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\roaming\sklauncher\jre\bin\jli.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2076"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\malware.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2792C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3760C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4476reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightThemeC:\Windows\System32\reg.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
4816"C:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\7za.exe" x -y C:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\jre.zipC:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\7za.exe
SKlauncher-3.2.12_Setup.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
24.09
Modules
Images
c:\users\admin\appdata\local\temp\is-1as0o.tmp\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
5008"C:\Users\admin\AppData\Local\Temp\is-A01KO.tmp\SKlauncher-3.2.12_Setup.tmp" /SL5="$50304,2553666,803840,C:\Users\admin\AppData\Local\Temp\Rar$EXa2076.19380\SKlauncher-3.2.12_Setup.exe" C:\Users\admin\AppData\Local\Temp\is-A01KO.tmp\SKlauncher-3.2.12_Setup.tmp
SKlauncher-3.2.12_Setup.exe
User:
admin
Company:
skmedix.pl
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-a01ko.tmp\sklauncher-3.2.12_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5496"C:\Users\admin\AppData\Local\Temp\Rar$EXa2076.19380\SKlauncher-3.2.12_Setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2076.19380\SKlauncher-3.2.12_Setup.exe
WinRAR.exe
User:
admin
Company:
skmedix.pl
Integrity Level:
MEDIUM
Description:
SKlauncher 3.2 Setup
Exit code:
0
Version:
3.2.12.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2076.19380\sklauncher-3.2.12_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
9 910
Read events
9 794
Write events
110
Delete events
6

Modification events

(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\malware.zip
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2076) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5008) SKlauncher-3.2.12_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A151427E-7A46-4D6D-8534-C4C04BADA77A}_is1
Operation:writeName:DisplayVersion
Value:
3.2.12.0
(PID) Process:(5008) SKlauncher-3.2.12_Setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A151427E-7A46-4D6D-8534-C4C04BADA77A}_is1
Operation:writeName:Publisher
Value:
skmedix.pl
Executable files
164
Suspicious files
31
Text files
233
Unknown types
14

Dropped files

PID
Process
Filename
Type
5008SKlauncher-3.2.12_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\is-U02VC.tmp —
MD5:—
SHA256:—
5008SKlauncher-3.2.12_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\jre.zip —
MD5:—
SHA256:—
2076WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2076.19380\DupeToolkit.jarcompressed
MD5:20EBD7C98CD84D5546C911AF1A765705
SHA256:B2CA7776D219E4386EBF6538E7FD30459ACB06E4FC9C8DA79D35D18A7E3C807E
5008SKlauncher-3.2.12_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\javafx-3.jarcompressed
MD5:6AD87D83A49A3B25FB5E137038B2C5DE
SHA256:6828F4FD83AC7CAEB7E25C21E4050606D384BAEBB18BC3B1F35CD866020757CC
5008SKlauncher-3.2.12_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\is-N5L8T.tmpcompressed
MD5:481E60FF6432B3816D78DD3A94D6C89B
SHA256:0AB89FA8531F5D6F1A15B6C76CF5A7D44E60E273932AD282B29B8DD324E725FF
2076WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2076.19380\SKlauncher-3.2.12_Setup.exeexecutable
MD5:79E973D7CF9069F758DD382BEE60EE43
SHA256:8B0DF603574C14809359A81518261055D491863A28F3C32A4832CE547874792C
5008SKlauncher-3.2.12_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\is-A20MA.tmptext
MD5:018677D1ACCC999F9ADCADF7E9D2ECA0
SHA256:A1F58B506C61EB64F9D38183FA7002A7FD5F7DBECB1F3BD16D1C5A7F181DF050
5496SKlauncher-3.2.12_Setup.exeC:\Users\admin\AppData\Local\Temp\is-A01KO.tmp\SKlauncher-3.2.12_Setup.tmpexecutable
MD5:A1140E85CA5E398094523B5D65DE46CB
SHA256:FA266F1B259C8BF7D2E3C2FAD19DA5390D90D01CAB3743EF1E18A9A8C89338E0
5008SKlauncher-3.2.12_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\is-Q4TFQ.tmpcompressed
MD5:239410D2A0EBE901C2BAED127E865453
SHA256:90E581C31638FBB041015C360D9EC6083AF7B666AC08EF03CD94CF274447F614
5008SKlauncher-3.2.12_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-1AS0O.tmp\javafx-0.jarcompressed
MD5:239410D2A0EBE901C2BAED127E865453
SHA256:90E581C31638FBB041015C360D9EC6083AF7B666AC08EF03CD94CF274447F614
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
59
DNS requests
33
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7020
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6292
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6292
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4156
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7020
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7020
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5008
SKlauncher-3.2.12_Setup.tmp
140.82.121.3:443
github.com
GITHUB
US
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.128
  • 20.190.159.0
  • 20.190.159.129
  • 40.126.31.129
  • 40.126.31.3
  • 20.190.159.2
  • 20.190.159.23
  • 40.126.31.1
whitelisted
github.com
  • 140.82.121.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
1652
javaw.exe
Misc activity
ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
malware.zip