File name:

c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.zip

Full analysis: https://app.any.run/tasks/48218611-c3f7-42cb-8ea3-185860acfc02
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 29, 2025, 21:47:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
valleyrat
winos
rat
silverfox
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

1BB0AF811DBA4217A19D526DAC1A2800

SHA1:

40547156C579E7F95C8D4067AD5906C37480C0D2

SHA256:

B7F70FA24F0AA1CE4C7F59A3C1FEDA37F593AB774F2B3AE83885088074B76E8B

SSDEEP:

1536:U8KnlPKRqLscyEOJlcovZSVGgbjoyzZN3SxDNufWJO/:URn4+cnPZO5N3SxBuOJo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • VALLEYRAT has been detected

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Create files in the Startup directory

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Changes the autorun value in the registry

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • WINOS has been detected (YARA)

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • VALLEYRAT has been detected (YARA)

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

  • SUSPICIOUS

    • Connects to unusual port

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Contacting a server suspected of hosting an CnC

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Executable content was dropped or overwritten

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • There is functionality for taking screenshot (YARA)

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

  • INFO

    • Checks supported languages

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1452)

    • Manual execution by a user

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)
      • WINWORD.EXE (PID: 5984)
      • msedge.exe (PID: 2152)
      • WINWORD.EXE (PID: 1348)

    • Reads the computer name

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Reads Environment values

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Reads product name

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Launch of the file from Startup directory

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Creates files or folders in the user directory

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Launch of the file from Registry key

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Creates files in the program directory

      • c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe (PID: 4728)

    • Reads the software policy settings

      • slui.exe (PID: 5408)

    • Application launched itself

      • msedge.exe (PID: 2152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:29 21:47:04
ZipCRC: 0x2d723fa6
ZipCompressedSize: 66854
ZipUncompressedSize: 133632
ZipFileName: c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
28
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe #VALLEYRAT c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe winword.exe ai.exe no specs slui.exe no specs winword.exe ai.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6008 --field-trial-handle=2392,i,3466083111950880414,4027618639056473207,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
444"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6008 --field-trial-handle=2392,i,3466083111950880414,4027618639056473207,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
668"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4756 --field-trial-handle=2392,i,3466083111950880414,4027618639056473207,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
716C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1184C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1300"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3680 --field-trial-handle=2392,i,3466083111950880414,4027618639056473207,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\costslove.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
1452"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2152"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2244"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4032 --field-trial-handle=2392,i,3466083111950880414,4027618639056473207,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
22 125
Read events
20 851
Write events
1 154
Delete events
120

Modification events

(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
28
Suspicious files
426
Text files
67
Unknown types
0

Dropped files

PID
Process
Filename
Type
4728c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exeC:\ProgramData\MicrosoftEdgeUpdate64.exeexecutable
MD5:336415AE396CF236F96230A1B53BBD19
SHA256:C81D3CF48A1007A648499A3E8AB07F2463BC140F178C61097CED08EC85614AB9
5984WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:63EABFBD75B06AD095056489F020D855
SHA256:C34B7FE2EFB2CC684C5860E042FAD010B8CF3EE07A1CB86CEEDBB6313C38F6F6
1452WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1452.7393\c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exeexecutable
MD5:336415AE396CF236F96230A1B53BBD19
SHA256:C81D3CF48A1007A648499A3E8AB07F2463BC140F178C61097CED08EC85614AB9
5984WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\sellersallowed.rtf.LNKbinary
MD5:2005F189A49CF244F7E262DCF3B96B89
SHA256:92AE05E7A77FC8507A410072705384DB64833B427BD285E32AA8384EF5CBDBD2
5984WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C01A7836-3CAE-4E86-83C5-52FE992A15F5xml
MD5:6756676EA2F7EC7A3126EA130B7EFD9E
SHA256:636D8BCB08D67C1EB63F57BAD433DEA159B1B5BB1981145378C0D3320C701650
5984WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:271E8F1B9CBA6DA12151E6472244F712
SHA256:E97F267178E601814D8D9549B75432F4B7528C75345021DF121993F1A3A1C896
5984WINWORD.EXEC:\Users\admin\Desktop\~$llersallowed.rtfpgc
MD5:CA46692B2C0CC0A789E5584C41DC8090
SHA256:5BDE95AB3E486614C69F383728147C7DC46414227ACB5B0442F4741E5BD01366
5984WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
5984WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:4EB8016B86B0E159FAB684027D004975
SHA256:32DA11647864819A53A85A80A73E056FB1166705DEBF9A226A523E4A39972B9C
5984WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:A267F76AD892F7D6F601C599BA768887
SHA256:90803202155C10C3A61A699FC73C446A81734D7FBCA4D80D8BC44D286C76FEFB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
90
DNS requests
83
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.32.238.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5796
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5048
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5048
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5984
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1348
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4336
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.32.238.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5796
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5796
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5048
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.32.238.34
  • 2.19.198.194
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
roaming.officeapps.live.com
  • 52.109.68.129
whitelisted
omex.cdn.office.net
  • 2.16.168.203
  • 2.16.168.206
whitelisted

Threats

PID
Process
Class
Message
4728
c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe
Malware Command and Control Activity Detected
ET MALWARE Winos4.0 Framework CnC Login Message
4728
c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe
Malware Command and Control Activity Detected
ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response
4728
c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe
Malware Command and Control Activity Detected
ET MALWARE Winos4.0 Framework CnC Login Message
4728
c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.exe
Malware Command and Control Activity Detected
ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response
2652
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2652
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2652
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2652
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2652
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2652
msedge.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c81d3cf48a1007a648499a3e8ab07f2463bc140f178c61097ced08ec85614ab9.zip