File name:

Adobe ACrobat XI.zip

Full analysis: https://app.any.run/tasks/5d2057c3-cbc0-4626-8cb4-9f3f098fc258
Verdict: Malicious activity
Analysis date: July 15, 2024, 10:20:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

FB7E1E2F66D4A908CBB3A0F9EC68DC45

SHA1:

7BCA8A57EF680DD922B39E53691FAD3443976835

SHA256:

BA9312A48E72F7FB0BE57017419AEA118B8F861CBA4177ACA0FAAE6B3A69CF44

SSDEEP:

98304:N00mc2IdEWU1WckBgUEp0bSoBw93rdWtP0mShUUVWfX86WktLyKuTQjf0iHNeWu4:HbxAIWA7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3628)
      • AdobeDownloadAssistant.exe (PID: 6228)
      • AdobeDownloadAssistant.exe (PID: 2868)
      • adobe.acrobat.xi.pro.patch-MPT.exe (PID: 6556)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • AdobeDownloadAssistant.exe (PID: 6228)
      • AdobeDownloadAssistant.exe (PID: 2868)

    • Checks Windows Trust Settings

      • Install Adobe Download Assistant.exe (PID: 6784)
      • Install Adobe Download Assistant.exe (PID: 1120)

    • Reads security settings of Internet Explorer

      • AdobeDownloadAssistant.exe (PID: 6228)
      • Install Adobe Download Assistant.exe (PID: 6784)
      • AdobeDownloadAssistant.exe (PID: 2868)
      • Install Adobe Download Assistant.exe (PID: 1120)
      • adobe.acrobat.xi.pro.patch-MPT.exe (PID: 6556)

    • Executable content was dropped or overwritten

      • AdobeDownloadAssistant.exe (PID: 6228)
      • AdobeDownloadAssistant.exe (PID: 2868)
      • adobe.acrobat.xi.pro.patch-MPT.exe (PID: 6556)

    • Drops 7-zip archiver for unpacking

      • AdobeDownloadAssistant.exe (PID: 6228)
      • AdobeDownloadAssistant.exe (PID: 2868)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3628)
      • WinRAR.exe (PID: 6192)

    • Manual execution by a user

      • AdobeDownloadAssistant.exe (PID: 6228)
      • AdobeDownloadAssistant.exe (PID: 2868)
      • WinRAR.exe (PID: 6192)
      • adobe.acrobat.xi.pro.patch-MPT.exe (PID: 6252)
      • adobe.acrobat.xi.pro.patch-MPT.exe (PID: 6556)

    • Checks supported languages

      • AdobeDownloadAssistant.exe (PID: 6228)
      • Install Adobe Download Assistant.exe (PID: 6784)
      • Install Adobe Download Assistant.exe (PID: 1120)
      • AdobeDownloadAssistant.exe (PID: 2868)
      • adobe.acrobat.xi.pro.patch-MPT.exe (PID: 6556)

    • Create files in a temporary directory

      • AdobeDownloadAssistant.exe (PID: 6228)
      • AdobeDownloadAssistant.exe (PID: 2868)
      • adobe.acrobat.xi.pro.patch-MPT.exe (PID: 6556)

    • Checks proxy server information

      • Install Adobe Download Assistant.exe (PID: 6784)
      • Install Adobe Download Assistant.exe (PID: 1120)

    • Reads the computer name

      • AdobeDownloadAssistant.exe (PID: 6228)
      • Install Adobe Download Assistant.exe (PID: 6784)
      • AdobeDownloadAssistant.exe (PID: 2868)
      • Install Adobe Download Assistant.exe (PID: 1120)
      • adobe.acrobat.xi.pro.patch-MPT.exe (PID: 6556)

    • Creates files or folders in the user directory

      • Install Adobe Download Assistant.exe (PID: 6784)

    • Process checks computer location settings

      • AdobeDownloadAssistant.exe (PID: 6228)
      • AdobeDownloadAssistant.exe (PID: 2868)

    • Reads the machine GUID from the registry

      • Install Adobe Download Assistant.exe (PID: 6784)
      • Install Adobe Download Assistant.exe (PID: 1120)

    • Reads the software policy settings

      • Install Adobe Download Assistant.exe (PID: 6784)
      • Install Adobe Download Assistant.exe (PID: 1120)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2013:07:18 16:02:24
ZipCRC: 0xe32aaa68
ZipCompressedSize: 2410193
ZipUncompressedSize: 2469824
ZipFileName: AdobeDownloadAssistant.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs adobedownloadassistant.exe install adobe download assistant.exe conhost.exe no specs adobedownloadassistant.exe install adobe download assistant.exe conhost.exe no specs winrar.exe adobe.acrobat.xi.pro.patch-mpt.exe no specs adobe.acrobat.xi.pro.patch-mpt.exe

Process information

PID
CMD
Path
Indicators
Parent process
1120"C:\Users\admin\AppData\Local\Temp\AIRDE8B.tmp\Install Adobe Download Assistant.exe" C:\Users\admin\AppData\Local\Temp\AIRDE8B.tmp\Install Adobe Download Assistant.exe
AdobeDownloadAssistant.exe
User:
admin
Company:
Adobe Systems Inc.
Integrity Level:
MEDIUM
Description:
Adobe Bootstrapping Utility
Exit code:
13
Version:
2.5.0.16600
Modules
Images
c:\users\admin\appdata\local\temp\airde8b.tmp\install adobe download assistant.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2868"C:\Users\admin\Desktop\Adobe ACrobat XI\AdobeDownloadAssistant.exe" C:\Users\admin\Desktop\Adobe ACrobat XI\AdobeDownloadAssistant.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
13
Modules
Images
c:\users\admin\desktop\adobe acrobat xi\adobedownloadassistant.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
3628"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Adobe ACrobat XI.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5096C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Install Adobe Download Assistant.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6192"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Adobe ACrobat XI\Parche adobe.acrobat.xi.pro.patch-MPT.rar" "C:\Users\admin\Desktop\Adobe ACrobat XI\"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6228"C:\Users\admin\Desktop\Adobe ACrobat XI\AdobeDownloadAssistant.exe" C:\Users\admin\Desktop\Adobe ACrobat XI\AdobeDownloadAssistant.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
13
Modules
Images
c:\users\admin\desktop\adobe acrobat xi\adobedownloadassistant.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6252"C:\Users\admin\Desktop\Adobe ACrobat XI\adobe.acrobat.xi.pro.patch-MPT\adobe.acrobat.xi.pro.patch-MPT.exe" C:\Users\admin\Desktop\Adobe ACrobat XI\adobe.acrobat.xi.pro.patch-MPT\adobe.acrobat.xi.pro.patch-MPT.exe—explorer.exe
User:
admin
Company:
MPT34M
Integrity Level:
MEDIUM
Description:
cr4cking th3 cod3 4 fun!
Exit code:
3221226540
Version:
1.0
Modules
Images
c:\users\admin\desktop\adobe acrobat xi\adobe.acrobat.xi.pro.patch-mpt\adobe.acrobat.xi.pro.patch-mpt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6556"C:\Users\admin\Desktop\Adobe ACrobat XI\adobe.acrobat.xi.pro.patch-MPT\adobe.acrobat.xi.pro.patch-MPT.exe" C:\Users\admin\Desktop\Adobe ACrobat XI\adobe.acrobat.xi.pro.patch-MPT\adobe.acrobat.xi.pro.patch-MPT.exe
explorer.exe
User:
admin
Company:
MPT34M
Integrity Level:
HIGH
Description:
cr4cking th3 cod3 4 fun!
Version:
1.0
Modules
Images
c:\users\admin\desktop\adobe acrobat xi\adobe.acrobat.xi.pro.patch-mpt\adobe.acrobat.xi.pro.patch-mpt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Install Adobe Download Assistant.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
20 394
Read events
20 289
Write events
103
Delete events
2

Modification events

(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Adobe ACrobat XI.zip
(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Adobe ACrobat XI
(PID) Process:(3628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
13
Suspicious files
7
Text files
24
Unknown types
1

Dropped files

PID
Process
Filename
Type
3628WinRAR.exeC:\Users\admin\Desktop\Adobe ACrobat XI\Parche adobe.acrobat.xi.pro.patch-MPT.rarcompressed
MD5:AB59A79B2AB5167E7E9F56837803F499
SHA256:C71CDA4217C2E93EB5018FF721681B162200A77568C1C26C6A40F8D3FD2AE832
6228AdobeDownloadAssistant.exeC:\Users\admin\AppData\Local\Temp\AIR94E0.tmp\Adobe Download Assistant\7z.exeexecutable
MD5:A51D90F2F9394F5EA0A3ACAE3BD2B219
SHA256:AC9674FEB8F2FAD20C1E046DE67F899419276AE79A60E8CC021A4BF472AE044F
3628WinRAR.exeC:\Users\admin\Desktop\Adobe ACrobat XI\AdobeDownloadAssistant.exeexecutable
MD5:5B028722015240564755A49DDF48486C
SHA256:865E7B1AACD195ABA2B728AE9E37798D97A50974A621335E7B70882A30396FD5
6228AdobeDownloadAssistant.exeC:\Users\admin\AppData\Local\Temp\AIR94E0.tmp\Install Adobe Download Assistant.exeexecutable
MD5:C40BFD1E61EC7386006E4E0556E6BC7A
SHA256:10A8928C79FB0A1BC456D9CE548BF3FBA3CBD67351894A0FB0FFCD1686EAEC85
6228AdobeDownloadAssistant.exeC:\Users\admin\AppData\Local\Temp\AIR94E0.tmp\.launchtext
MD5:D8D9A65320B3EF0CF5EEEDB44C6B976C
SHA256:8ADD5744649F6250A473B7BDCC8125FA4565253AA29E9839CDF7DDDB3D2B8C4F
6228AdobeDownloadAssistant.exeC:\Users\admin\AppData\Local\Temp\AIR94E0.tmp\Adobe Download Assistant\7z.dllexecutable
MD5:04AD4B80880B32C94BE8D0886482C774
SHA256:A1E1D1F0FFF4FCCCFBDFA313F3BDFEA4D3DFE2C2D9174A615BBC39A0A6929338
6228AdobeDownloadAssistant.exeC:\Users\admin\AppData\Local\Temp\AIR94E0.tmp\Adobe Download Assistant\META-INF\signatures.xmltext
MD5:2577CBA575D888FC513F054A7DE7F691
SHA256:306F4158591C3B2BAF74EB3FEDB5CF0602188547B487C0EC389A624861C7EC8B
6228AdobeDownloadAssistant.exeC:\Users\admin\AppData\Local\Temp\AIR94E0.tmp\Adobe Download Assistant\DownloadAssistant.swfbinary
MD5:974CAB4F43B15FA4E2C264F21BA71473
SHA256:B3F5BFA888A580A10742EECC24C8B4B14D95BE59EDD2891E78A12F62F6CE9B2E
6228AdobeDownloadAssistant.exeC:\Users\admin\AppData\Local\Temp\AIR94E0.tmp\Adobe Download Assistant\setup.msiexecutable
MD5:75EB7EEB9CE124C256BFB05EF70FB5CB
SHA256:8E358892A1B321E0AEE750F9D0EF4D7780F968FCD6A220757AC2EF9F0DD4A650
6228AdobeDownloadAssistant.exeC:\Users\admin\AppData\Local\Temp\AIR94E0.tmp\Adobe Download Assistant\META-INF\AIR\application.xmlxml
MD5:DBCDC6A3A047E847F8EDBCDE22F744DF
SHA256:3941A4211973FAAB9EC6861D97441C1221E0B3E0AB217A775322F440707612D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
63
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2088
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2088
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3688
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6288
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5244
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
1120
Install Adobe Download Assistant.exe
GET
301
2.18.160.138:80
http://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer.p7
unknown
—
—
whitelisted
1120
Install Adobe Download Assistant.exe
GET
301
2.18.160.138:80
http://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer
unknown
—
—
whitelisted
6412
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2064
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3872
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4656
SearchApp.exe
92.123.104.58:443
www.bing.com
Akamai International B.V.
DE
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2088
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
2088
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
www.bing.com
  • 92.123.104.58
  • 92.123.104.53
  • 92.123.104.61
  • 92.123.104.63
  • 92.123.104.59
  • 92.123.104.56
  • 92.123.104.64
  • 92.123.104.57
  • 92.123.104.67
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
google.com
  • 172.217.18.110
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.134
  • 20.190.160.14
  • 40.126.32.72
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Adobe ACrobat XI.zip