File name:

123456.zip

Full analysis: https://app.any.run/tasks/b244ccb4-cef8-4c28-b085-40f36a58916c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: May 14, 2025, 16:06:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
sality
sainbox
rat
autohotkey
ahk
loader
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

0307559D7952B37E6E435BA272E8A5C3

SHA1:

FA2E455C95394488B3A7D143576E30D4AE116DA6

SHA256:

C536FB60FA45D0BA75C082253CFDDECA2AB2C82A389D2E71A60394A7D36F27D2

SSDEEP:

49152:wWKF8A43Qha5Bf4zgisJf1uhcmXgLDDnyKxQaMscGWJaMscGWKSLudD/rXSRJwtS:ECgha5Kkisl1IcmXgztGaMscGMaMscGi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • SALITY mutex has been found

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • UAC/LUA settings modification

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
    • SAINBOX has been detected

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Changes Security Center notification settings

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
    • AHK has been detected (YARA)

      • rundll32.exe (PID: 5892)
  • SUSPICIOUS

    • Drops a file with a rarely used extension (PIF)

      • WinRAR.exe (PID: 4628)
    • Mutex name with non-standard characters

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Starts itself from another location

      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 5892)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • AUTOHOTKEY mutex has been found

      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • There is functionality for taking screenshot (YARA)

      • rundll32.exe (PID: 5892)
    • Process drops legitimate windows executable

      • rundll32.exe (PID: 5892)
  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4628)
      • WinRAR.exe (PID: 4000)
      • rundll32.exe (PID: 5892)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4628)
      • WinRAR.exe (PID: 4000)
    • Manual execution by a user

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
      • Taskmgr.exe (PID: 7284)
      • Taskmgr.exe (PID: 7324)
      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 4728)
      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 7696)
      • WinRAR.exe (PID: 4000)
      • Taskmgr.exe (PID: 4868)
      • Taskmgr.exe (PID: 8160)
    • Checks supported languages

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Reads the computer name

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Create files in a temporary directory

      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Detects AutoHotkey samples (YARA)

      • rundll32.exe (PID: 5892)
    • UPX packer has been detected

      • rundll32.exe (PID: 5892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:10:28 15:22:42
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: 123456/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
19
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs #SALITY !reforce¦--+-ó-----°¦¿¦ñ+¯.exe no specs #SALITY 216++-++·+-+º¦-¦¦+¦¦¦-=.exe #AHK rundll32.exe taskmgr.exe no specs taskmgr.exe slui.exe !reforce¦--+-ó-----°¦¿¦ñ+¯.exe no specs !reforce¦--+-ó-----°¦¿¦ñ+¯.exe explorer.exe no specs COpenControlPanel no specs taskmgr.exe no specs taskmgr.exe winrar.exe !reforce¦--+-ó-----°¦¿¦ñ+¯.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
1116C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2924"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\wincorlib.dll
4000"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\123456.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4628"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\123456.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4728"C:\Users\admin\Desktop\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exe" C:\Users\admin\Desktop\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exe
explorer.exe
User:
admin
Company:
Gregory Maynard-Hoare
Integrity Level:
HIGH
Description:
RefreshForce - Universal W2K/XP Refresh Fix
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\desktop\123456\!reforce¦--+-ó-----°¦¿¦ñ+¯.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4868"C:\WINDOWS\system32\taskmgr.exe" /7C:\Windows\System32\Taskmgr.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
5892C:\Users\admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\admin\AppData\Roaming\Microsoft\Office\rundll32.exe
216++-++·+-+º¦-¦¦+¦¦¦-=.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\roaming\microsoft\office\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6244"C:\Users\admin\Desktop\123456\H\! 360U+¦¦ún++(+d¦-+-+¦\2019_9_20_10_25\216++-++·+-+º¦-¦¦+¦¦¦-=.exe" C:\Users\admin\Desktop\123456\H\! 360U+¦¦ún++(+d¦-+-+¦\2019_9_20_10_25\216++-++·+-+º¦-¦¦+¦¦¦-=.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\123456\h\! 360u+¦¦ún++(+d¦-+-+¦\2019_9_20_10_25\216++-++·+-+º¦-¦¦+¦¦¦-=.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6268"C:\Users\admin\AppData\Local\Temp\Rar$EXa4000.40643\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa4000.40643\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exeWinRAR.exe
User:
admin
Company:
Gregory Maynard-Hoare
Integrity Level:
MEDIUM
Description:
RefreshForce - Universal W2K/XP Refresh Fix
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa4000.40643\123456\!reforce¦--+-ó-----°¦¿¦ñ+¯.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7176C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
17 901
Read events
17 737
Write events
160
Delete events
4

Modification events

(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\123456.zip
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
29
Suspicious files
53
Text files
181
Unknown types
0

Dropped files

PID
Process
Filename
Type
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exeexecutable
MD5:CA9C0BDC9E2501A1C796A2672E2D96FE
SHA256:213A6DFB1982CE4F6EED502607DE43D05994B4EB749CDAD39D4143A6CC3C9728
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\D\Autorun.infbinary
MD5:93EF55D63CC0DE7EB2113C9B1D432221
SHA256:8DE37C6669FB3B2BA3884B51F36D288BD27E2A21F8CFFFA7906EF562C3EBED39
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\e\qptln.pifexecutable
MD5:43B540056374CC2602E1CCCFDCFE5EBB
SHA256:20D120E1368E2F31BB992F83E2D1F0C3887E5C4E19E07DCE995B8236960508D7
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\e\Autorun.inftext
MD5:F5F63AD43DF52660D4984C367952BB81
SHA256:2905771B422B405F85A7B24ECC7ED0E2FB14E1680CE54FF278CA5C1229F11378
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\D\Game\CS1_6\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exeexecutable
MD5:6AB96F7856800A1A8ED4B024078BFEE9
SHA256:C139A218C04DA72106A9E0F9AC2CFE0F44239FB5DE499AFE5527EE0A9E612572
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\C\Documents and Settings\Administrator\+++µ\pdyy.pifexecutable
MD5:B6E5DDFBFCDBF81963BBFAF3B14C99FE
SHA256:778BC1F4AF9ED5A4E9F8D3A1BA23098E77458652B1CCA1BCDDB5EC5ABF7ECF9F
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\H\autorun.inftext
MD5:119F77FA003735626DCC697364052680
SHA256:80D13A1363C5E44F6803C3A3C9A57C096063C615D744A8224E6A9CB6DB0DF300
2924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:6E91FE0FFB4A21EBF28824A8A5B7D815
SHA256:889490B0B89947DF97E88E5EA3E12A4193ABB23E411D22DA159CFC64F875D7DF
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\H\! 360U+¦¦ún++(+d¦-+-+¦\2019_9_20_10_25\216++-++·+-+º¦-¦¦+¦¦¦-=.exeexecutable
MD5:A567519F29FC3836D7CFBBFD47AB60C5
SHA256:F014A1E1318DF67200B466CFD7641D0714FAE7280E3F54DDD4C515EC8A5C2F37
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\f\mfbr.pifexecutable
MD5:43B540056374CC2602E1CCCFDCFE5EBB
SHA256:20D120E1368E2F31BB992F83E2D1F0C3887E5C4E19E07DCE995B8236960508D7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
47
DNS requests
30
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
7844
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
7844
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
1568
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.183:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
whitelisted
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 172.217.18.110
whitelisted
crl.microsoft.com
  • 23.48.23.183
  • 23.48.23.191
  • 23.48.23.181
  • 23.48.23.177
  • 23.48.23.176
  • 23.48.23.178
  • 23.48.23.190
  • 23.48.23.180
  • 23.48.23.179
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.4
  • 40.126.32.74
  • 20.190.160.131
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.17
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
www.bing.com
  • 2.19.96.80
  • 2.19.96.91
  • 2.19.96.64
  • 2.19.96.81
  • 2.19.96.75
  • 2.19.96.107
  • 2.19.96.88
  • 2.19.96.59
  • 2.19.96.112
whitelisted

Threats

PID
Process
Class
Message
2924
SearchApp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net)
No debug info