File name:

Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.7z

Full analysis: https://app.any.run/tasks/b63d89b4-1f65-45ca-8721-c35a44d8e0e6
Verdict: Malicious activity
Threats:

Dharma is advanced ransomware that has been observed in the wild since 2016. It is considered to be the second most profitable RaaS operation by the FBI. The malware targets hospitals and state organizations, encrypts files, and demands a payment to restore access to lost information.

Malware Trends Tracker     >>>
Analysis date: March 23, 2025, 23:27:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
dharma
ransomware
stealer
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

5C5CCEC44B3C7EE0D959CFAF89A9C92D

SHA1:

810E13DAFAD213EE3D3C8D50B4B548887DBF24C5

SHA256:

C446BA81A9E8A1747440C6B3899B83371B8A900381D81C9C3E142230B6DE22DA

SSDEEP:

1536:bsNkn82SQxdCcHbpXUPZiviqa1b/7qNnLNIifXf37D/vFk:QNAwc1tviqaZ2nLNIc33/vFk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2516)

    • DHARMA mutex has been found

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Create files in the Startup directory

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Changes the autorun value in the registry

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Deletes shadow copies

      • cmd.exe (PID: 8184)

    • RANSOMWARE has been detected

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Actions looks like stealing of personal data

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Renames files like ransomware

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Starts CMD.EXE for commands execution

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4628)

    • Creates file in the systems drive root

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Process drops legitimate windows executable

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The process creates files with name similar to system file names

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 7444)

  • INFO

    • Creates files or folders in the user directory

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Reads the computer name

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Checks supported languages

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)
      • mode.com (PID: 1512)

    • Manual execution by a user

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)
      • control.exe (PID: 7444)
      • notepad.exe (PID: 7764)

    • Autorun file from Startup directory

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2516)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 1512)

    • Creates files in the program directory

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The sample compiled with english language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • Reads the software policy settings

      • slui.exe (PID: 7288)
      • slui.exe (PID: 6436)

    • Reads security settings of Internet Explorer

      • control.exe (PID: 7444)
      • rundll32.exe (PID: 7372)

    • Checks proxy server information

      • slui.exe (PID: 6436)

    • The sample compiled with french language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The sample compiled with german language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The sample compiled with turkish language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The sample compiled with Italian language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The sample compiled with japanese language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The sample compiled with korean language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The sample compiled with portuguese language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The sample compiled with russian language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)

    • The sample compiled with spanish language support

      • Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe (PID: 8164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:06:28 12:10:20+00:00
ArchivedFileName: Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
16
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe #DHARMA trojan-ransom.win32.crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exe cmd.exe no specs conhost.exe no specs mode.com no specs vssadmin.exe no specs vssvc.exe no specs control.exe no specs rundll32.exe no specs systempropertiescomputername.exe no specs systempropertiescomputername.exe slui.exe rundll32.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1512mode con cp select=1251C:\Windows\System32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS Device MODE Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2192vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2516"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4628C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4736"C:\Windows\System32\SystemPropertiesComputerName.exe" C:\Windows\System32\SystemPropertiesComputerName.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change Computer Settings
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systempropertiescomputername.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sysdm.cpl
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
4944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6436C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7256C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7288"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7372"C:\WINDOWS\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\WINDOWS\system32\sysdm.cpl",C:\Windows\System32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
4 048
Read events
4 025
Write events
23
Delete events
0

Modification events

(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.7z
(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
411
Suspicious files
17 129
Text files
11
Unknown types
2

Dropped files

PID
Process
Filename
Type
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\$Recycle.Bin\S-1-5-18\desktop.ini —
MD5:—
SHA256:—
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini —
MD5:—
SHA256:—
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-500\desktop.ini —
MD5:—
SHA256:—
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1000\desktop.ini —
MD5:—
SHA256:—
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\$WinREAgent\Rollback.xml —
MD5:—
SHA256:—
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\BOOTNXT —
MD5:—
SHA256:—
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\$WinREAgent\RollbackInfo.ini —
MD5:—
SHA256:—
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\found.000\dir0000.chk\UpdateSessionOrchestration.016.etl —
MD5:—
SHA256:—
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\$WinREAgent\Backup\location.txt —
MD5:—
SHA256:—
8164Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.exeC:\$WinREAgent\Backup\Winre.wim.id-26B799FA.[xcsset@criptext.com].xcss —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1096
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7744
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1096
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
2100
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2100
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.128
  • 20.190.159.64
  • 20.190.159.131
  • 40.126.31.3
  • 40.126.31.2
  • 20.190.159.68
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Crusis.to-1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb.7z