File name:

2025-05-12-unidentified-malware-and-artifacts (1).zip

Full analysis: https://app.any.run/tasks/5ea83af5-c075-4c5d-a5dd-4b806f563646
Verdict: Malicious activity
Threats:

First identified in March 2021, PureCrypter is a .NET-based loader that employs obfuscation techniques, such as SmartAssembly, to evade detection. It has been used to distribute malware families including AgentTesla, RedLine Stealer, and SnakeKeylogger. The malware is typically delivered through phishing campaigns and malicious downloads, often masquerading as legitimate files with extensions like .mp4 or .pdf. PureCrypter utilizes encryption and compression to conceal its payloads and can inject malicious code into legitimate processes to maintain persistence on the infected system.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 20:21:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-scr
arch-doc
netreactor
purecrypter
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

992C027C5351DFB774AB6B967D0D6855

SHA1:

4D98DB8C93E2D221C010E52B9315D02EFE5DA084

SHA256:

AAF5D6501B4D90E5551D8484E9EFA47B5F69060B153247C22C18F3B17324F0D9

SSDEEP:

98304:0oLJbAtTr6tMyG/LRUX3vklKpKPZIjaR97Kj4f6EV7CyAmfNjNQE1i8iZZScCJtr:tQK3Q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7488)

    • Create files in the Startup directory

      • KTMBE25040170.exe (PID: 7484)

    • PURECRYPTER has been detected (YARA)

      • InstallUtil.exe (PID: 2268)
      • InstallUtil.exe (PID: 736)
      • InstallUtil.exe (PID: 4180)
      • InstallUtil.exe (PID: 7900)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • KTMBE25040170.exe (PID: 7484)

    • Connects to unusual port

      • InstallUtil.exe (PID: 2268)
      • InstallUtil.exe (PID: 6492)

    • Image mount has been detect

      • explorer.exe (PID: 5492)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7652)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 2876)

    • The process executes VB scripts

      • explorer.exe (PID: 5492)

  • INFO

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7488)

    • Manual execution by a user

      • KTMBE25040170.exe (PID: 7484)
      • InstallUtil.exe (PID: 2268)
      • KTMBE25040170.exe (PID: 6592)
      • KTMBE25040170.exe (PID: 5868)
      • InstallUtil.exe (PID: 4180)
      • wscript.exe (PID: 7652)
      • InstallUtil.exe (PID: 7900)
      • wscript.exe (PID: 6392)
      • InstallUtil.exe (PID: 6492)
      • mspaint.exe (PID: 6744)

    • Reads the computer name

      • KTMBE25040170.exe (PID: 7484)
      • InstallUtil.exe (PID: 2268)
      • KTMBE25040170.exe (PID: 6592)
      • InstallUtil.exe (PID: 736)
      • KTMBE25040170.exe (PID: 5868)
      • InstallUtil.exe (PID: 4180)
      • Count.exe (PID: 7472)
      • InstallUtil.exe (PID: 7900)

    • Reads the machine GUID from the registry

      • KTMBE25040170.exe (PID: 7484)
      • InstallUtil.exe (PID: 2268)
      • KTMBE25040170.exe (PID: 6592)
      • InstallUtil.exe (PID: 736)
      • KTMBE25040170.exe (PID: 5868)
      • InstallUtil.exe (PID: 4180)
      • Count.exe (PID: 7472)
      • InstallUtil.exe (PID: 7900)

    • Checks supported languages

      • KTMBE25040170.exe (PID: 7484)
      • InstallUtil.exe (PID: 2268)
      • KTMBE25040170.exe (PID: 6592)
      • InstallUtil.exe (PID: 736)
      • KTMBE25040170.exe (PID: 5868)
      • InstallUtil.exe (PID: 4180)
      • Count.exe (PID: 7472)
      • InstallUtil.exe (PID: 7900)

    • Creates files or folders in the user directory

      • KTMBE25040170.exe (PID: 7484)

    • .NET Reactor protector has been detected

      • InstallUtil.exe (PID: 736)
      • InstallUtil.exe (PID: 2268)
      • InstallUtil.exe (PID: 4180)
      • InstallUtil.exe (PID: 7900)

    • Reads the software policy settings

      • slui.exe (PID: 7692)
      • slui.exe (PID: 2092)

    • Checks proxy server information

      • slui.exe (PID: 2092)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 5492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 45
ZipBitFlag: 0x0800
ZipCompression: Deflated
ZipModifyDate: 2025:05:12 23:33:04
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: 2025-05-12-unidentified-malware-and-artifacts/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
269
Monitored processes
20
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs ktmbe25040170.exe #PURECRYPTER installutil.exe ktmbe25040170.exe #PURECRYPTER installutil.exe no specs slui.exe ktmbe25040170.exe no specs #PURECRYPTER installutil.exe no specs wscript.exe no specs count.exe no specs #PURECRYPTER installutil.exe no specs plugscheduler.exe no specs wscript.exe no specs count.exe no specs installutil.exe mspaint.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
KTMBE25040170.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2092C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2268"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Exit code:
1073807364
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2876"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4180"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5492C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
5868"D:\KTMBE25040170.exe" D:\KTMBE25040170.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
KTMBE25040170
Exit code:
4294967295
Version:
1.0.6585.21446
Modules
Images
d:\ktmbe25040170.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6392"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Count.vbs" C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6452"C:\Users\admin\AppData\Roaming\Count.exe" C:\Users\admin\AppData\Roaming\Count.exe—wscript.exe
User:
admin
Integrity Level:
MEDIUM
Description:
KTMBE25040170
Exit code:
4294967295
Version:
1.0.6585.21446
Modules
Images
c:\users\admin\appdata\roaming\count.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6492"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
24 825
Read events
24 694
Write events
126
Delete events
5

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F0062000000000000000000000001000000FFFFFFFFFFFF0000
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000040288
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\2025-05-12-unidentified-malware-and-artifacts (1).zip
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
48
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5492explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
7488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7488.35825\2025-05-12-unidentified-malware-and-artifacts\invoice_10988.xzcompressed
MD5:0B7B89B983B00767C0C60CCEB5032110
SHA256:341F58943626DEC0CABC58FBEC4F7263125EC1ED75E0C97418CEFE0CA23C6A25
7488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7488.35825\2025-05-12-unidentified-malware-and-artifacts\invoice_10988.imgbinary
MD5:2D5E799501ED61B7C03CA303CDE3726F
SHA256:F757FC452DBB8EB564081D3DECFDB31EC24FC4B91E22EE8088CB5884729CC99A
7488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7488.35825\2025-05-12-unidentified-malware-and-artifacts\Count.vbstext
MD5:3101CC711C4BCB3BD586CD9B95D67EAE
SHA256:50B6133499D1CFD459E76FC878A8139B6B0A9DE1F3D83DDF534F0FDB2D120AD4
7488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7488.35825\2025-05-12-unidentified-malware-and-artifacts\KTMBE25040170.exeexecutable
MD5:4F475CE89DE8C65BEC36C9D9A01FE0F0
SHA256:116C096A488F53B298D3BAC99942770AFD3D791AE376534F050E6E4642C2FBB4
7488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7488.35825\2025-05-12-unidentified-malware-and-artifacts\2025-05-12-IOCs-for-unidentified-malware-infection.txttext
MD5:C27F58F61CF3EBC35BF9B84033B67E99
SHA256:94B5C59BD9B8A87DC084D58CC109488212B0C526509DF5609095D6E25A5A553F
7484KTMBE25040170.exeC:\Users\admin\AppData\Roaming\Count.exeexecutable
MD5:4F475CE89DE8C65BEC36C9D9A01FE0F0
SHA256:116C096A488F53B298D3BAC99942770AFD3D791AE376534F050E6E4642C2FBB4
7484KTMBE25040170.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Count.vbstext
MD5:3101CC711C4BCB3BD586CD9B95D67EAE
SHA256:50B6133499D1CFD459E76FC878A8139B6B0A9DE1F3D83DDF534F0FDB2D120AD4
2876PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.045.etlbinary
MD5:89BD161BF7B46C9078937CF832786737
SHA256:2B83DF5532E9F54ED301C8F82E2CDD489799C8D5222A2D44C97DCB151A96FAA9
2876PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.046.etlbinary
MD5:A7A21FBC9D00F33F186B34A50E170C13
SHA256:64CAC91E46D4FC832958232A658431CBF9D8D9F265653ACA2BEB32428D4688EC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
179
DNS requests
34
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8084
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8084
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.74.206
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.219.150.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.129
  • 20.190.159.71
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.73
  • 20.190.159.68
  • 20.190.159.2
  • 20.190.160.131
  • 20.190.160.130
  • 40.126.32.76
  • 40.126.32.136
  • 20.190.160.132
  • 40.126.32.140
  • 20.190.160.67
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
mxcnss.dns04.com
  • 176.65.144.169
unknown

Threats

PID
Process
Class
Message
2268
InstallUtil.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-12-unidentified-malware-and-artifacts (1).zip