File name:

123456.zip

Full analysis: https://app.any.run/tasks/b244ccb4-cef8-4c28-b085-40f36a58916c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: May 14, 2025, 16:06:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
sality
sainbox
rat
autohotkey
ahk
loader
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

0307559D7952B37E6E435BA272E8A5C3

SHA1:

FA2E455C95394488B3A7D143576E30D4AE116DA6

SHA256:

C536FB60FA45D0BA75C082253CFDDECA2AB2C82A389D2E71A60394A7D36F27D2

SSDEEP:

49152:wWKF8A43Qha5Bf4zgisJf1uhcmXgLDDnyKxQaMscGWJaMscGWKSLudD/rXSRJwtS:ECgha5Kkisl1IcmXgztGaMscGMaMscGi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • SALITY mutex has been found

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • SAINBOX has been detected

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Changes Security Center notification settings

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
    • UAC/LUA settings modification

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
    • AHK has been detected (YARA)

      • rundll32.exe (PID: 5892)
  • SUSPICIOUS

    • Drops a file with a rarely used extension (PIF)

      • WinRAR.exe (PID: 4628)
    • Mutex name with non-standard characters

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Executable content was dropped or overwritten

      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
      • rundll32.exe (PID: 5892)
    • AUTOHOTKEY mutex has been found

      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Process drops legitimate windows executable

      • rundll32.exe (PID: 5892)
    • There is functionality for taking screenshot (YARA)

      • rundll32.exe (PID: 5892)
    • Starts itself from another location

      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4628)
      • WinRAR.exe (PID: 4000)
    • The sample compiled with english language support

      • WinRAR.exe (PID: 4628)
      • rundll32.exe (PID: 5892)
      • WinRAR.exe (PID: 4000)
    • Checks supported languages

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Reads the computer name

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Manual execution by a user

      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 8004)
      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
      • Taskmgr.exe (PID: 7324)
      • Taskmgr.exe (PID: 7284)
      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 7696)
      • !ReForce¦--+-ó-----°¦¿¦ñ+¯.exe (PID: 4728)
      • Taskmgr.exe (PID: 4868)
      • Taskmgr.exe (PID: 8160)
      • WinRAR.exe (PID: 4000)
    • Create files in a temporary directory

      • 216++-++·+-+º¦-¦¦+¦¦¦-=.exe (PID: 6244)
    • Detects AutoHotkey samples (YARA)

      • rundll32.exe (PID: 5892)
    • UPX packer has been detected

      • rundll32.exe (PID: 5892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:10:28 15:22:42
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: 123456/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
19
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs #SALITY !reforce¦--+-ó-----°¦¿¦ñ+¯.exe no specs #SALITY 216++-++·+-+º¦-¦¦+¦¦¦-=.exe #AHK rundll32.exe taskmgr.exe no specs taskmgr.exe slui.exe !reforce¦--+-ó-----°¦¿¦ñ+¯.exe no specs !reforce¦--+-ó-----°¦¿¦ñ+¯.exe explorer.exe no specs COpenControlPanel no specs taskmgr.exe no specs taskmgr.exe winrar.exe !reforce¦--+-ó-----°¦¿¦ñ+¯.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
1116C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2924"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\wincorlib.dll
4000"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\123456.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4628"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\123456.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4728"C:\Users\admin\Desktop\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exe" C:\Users\admin\Desktop\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exe
explorer.exe
User:
admin
Company:
Gregory Maynard-Hoare
Integrity Level:
HIGH
Description:
RefreshForce - Universal W2K/XP Refresh Fix
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\desktop\123456\!reforce¦--+-ó-----°¦¿¦ñ+¯.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4868"C:\WINDOWS\system32\taskmgr.exe" /7C:\Windows\System32\Taskmgr.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
5892C:\Users\admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\admin\AppData\Roaming\Microsoft\Office\rundll32.exe
216++-++·+-+º¦-¦¦+¦¦¦-=.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\roaming\microsoft\office\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6244"C:\Users\admin\Desktop\123456\H\! 360U+¦¦ún++(+d¦-+-+¦\2019_9_20_10_25\216++-++·+-+º¦-¦¦+¦¦¦-=.exe" C:\Users\admin\Desktop\123456\H\! 360U+¦¦ún++(+d¦-+-+¦\2019_9_20_10_25\216++-++·+-+º¦-¦¦+¦¦¦-=.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\123456\h\! 360u+¦¦ún++(+d¦-+-+¦\2019_9_20_10_25\216++-++·+-+º¦-¦¦+¦¦¦-=.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6268"C:\Users\admin\AppData\Local\Temp\Rar$EXa4000.40643\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa4000.40643\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exeWinRAR.exe
User:
admin
Company:
Gregory Maynard-Hoare
Integrity Level:
MEDIUM
Description:
RefreshForce - Universal W2K/XP Refresh Fix
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa4000.40643\123456\!reforce¦--+-ó-----°¦¿¦ñ+¯.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7176C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
17 901
Read events
17 737
Write events
160
Delete events
4

Modification events

(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\123456.zip
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(4628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
29
Suspicious files
53
Text files
181
Unknown types
0

Dropped files

PID
Process
Filename
Type
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\!ReForce¦--+-ó-----°¦¿¦ñ+¯.exeexecutable
MD5:CA9C0BDC9E2501A1C796A2672E2D96FE
SHA256:213A6DFB1982CE4F6EED502607DE43D05994B4EB749CDAD39D4143A6CC3C9728
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\C\Documents and Settings\Administrator\+++µ\pdyy.pifexecutable
MD5:B6E5DDFBFCDBF81963BBFAF3B14C99FE
SHA256:778BC1F4AF9ED5A4E9F8D3A1BA23098E77458652B1CCA1BCDDB5EC5ABF7ECF9F
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\C\autorun.inftext
MD5:9AC84FEED8EA16E083B9AB94A2F13FEA
SHA256:563CB43418904824A292C660717DA2FDD7DBF073DA14F3B61203842532D22681
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\e\qptln.pifexecutable
MD5:43B540056374CC2602E1CCCFDCFE5EBB
SHA256:20D120E1368E2F31BB992F83E2D1F0C3887E5C4E19E07DCE995B8236960508D7
8004!ReForce¦--+-ó-----°¦¿¦ñ+¯.exeC:\Windows\system.inibinary
MD5:07435B927DBAA36E12A8D807182922B5
SHA256:8D92A27CEA26A4F8E8F0111065AA3DB93EE63B68CA2138D1E077431E98191093
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\H\nknuau.pifexecutable
MD5:B6E5DDFBFCDBF81963BBFAF3B14C99FE
SHA256:778BC1F4AF9ED5A4E9F8D3A1BA23098E77458652B1CCA1BCDDB5EC5ABF7ECF9F
4628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4628.12603\123456\H\autorun.inf2binary
MD5:F0F49837FF3B05AE0B263B9272B68ACE
SHA256:2EEF4DF74C1810615B33839556CCF8D712CA60967FC4EA019AAC03AEE1B091A0
6244216++-++·+-+º¦-¦¦+¦¦¦-=.exeC:\Users\admin\AppData\Local\Temp\00119E02_Rar\216++-++·+-+º¦-¦¦+¦¦¦-=.exeexecutable
MD5:A567519F29FC3836D7CFBBFD47AB60C5
SHA256:F014A1E1318DF67200B466CFD7641D0714FAE7280E3F54DDD4C515EC8A5C2F37
2924SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:F481E8DBBBCA0254A53EA1FABCC11D89
SHA256:6E33897F91A3B99B4A440B84CC7457E157749C016125323F62112B60764A677D
6244216++-++·+-+º¦-¦¦+¦¦¦-=.exeC:\Users\admin\AppData\Roaming\Microsoft\Office\rundll32.exeexecutable
MD5:A567519F29FC3836D7CFBBFD47AB60C5
SHA256:F014A1E1318DF67200B466CFD7641D0714FAE7280E3F54DDD4C515EC8A5C2F37
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
47
DNS requests
30
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
7844
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
7844
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
1568
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.183:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
whitelisted
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 172.217.18.110
whitelisted
crl.microsoft.com
  • 23.48.23.183
  • 23.48.23.191
  • 23.48.23.181
  • 23.48.23.177
  • 23.48.23.176
  • 23.48.23.178
  • 23.48.23.190
  • 23.48.23.180
  • 23.48.23.179
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.4
  • 40.126.32.74
  • 20.190.160.131
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.17
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
www.bing.com
  • 2.19.96.80
  • 2.19.96.91
  • 2.19.96.64
  • 2.19.96.81
  • 2.19.96.75
  • 2.19.96.107
  • 2.19.96.88
  • 2.19.96.59
  • 2.19.96.112
whitelisted

Threats

PID
Process
Class
Message
2924
SearchApp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net)
No debug info