File name:

HACKUS MAIL CHECKER 1.8.0 cracked by Maksim 2024.rar

Full analysis: https://app.any.run/tasks/cb6d2830-1d64-4e2e-bdfa-465f6c5f2f60
Verdict: Malicious activity
Analysis date: January 26, 2025, 20:28:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
themida
crypto-regex
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

3FF89BFFB435502900A36B74A33B5501

SHA1:

67EE1B7E7BB2DC7F2778733794F03A565572B820

SHA256:

C68997C328258A0B59F56610E8055D122B7E1A8EE0CD0EBF6EAF926CDE844474

SSDEEP:

98304:IILpOj4NnwJxbkELEOpCeZVfK+TBfSMiZJHolx/INSuTu/uKBfMVQCLcjKD8SUHa:NTOupvIsKvrJ3Ki6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • HMC.exe (PID: 556)
      • LZMYBCTLTD.exe (PID: 3912)
      • LZMYBCTLTD.exe (PID: 432)
      • HMC.exe (PID: 488)

    • Uses Task Scheduler to run other applications

      • LZMYBCTLTD.exe (PID: 3912)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6584)

    • Starts a Microsoft application from unusual location

      • HMC.exe (PID: 2600)
      • HMC.exe (PID: 556)
      • HMC.exe (PID: 3848)
      • HMC.exe (PID: 488)

    • Reads the BIOS version

      • HMC.exe (PID: 2600)
      • HMC.exe (PID: 556)
      • LZMYBCTLTD.exe (PID: 3912)
      • LZMYBCTLTD.exe (PID: 432)
      • HMC.exe (PID: 488)
      • HMC.exe (PID: 3848)

    • Reads security settings of Internet Explorer

      • HMC.exe (PID: 2600)
      • HMC.exe (PID: 556)
      • LZMYBCTLTD.exe (PID: 3912)
      • LZMYBCTLTD.exe (PID: 432)
      • HMC.exe (PID: 488)
      • HMC.exe (PID: 3848)

    • Application launched itself

      • HMC.exe (PID: 2600)
      • HMC.exe (PID: 3848)

    • Script adds exclusion path to Windows Defender

      • HMC.exe (PID: 556)
      • LZMYBCTLTD.exe (PID: 3912)
      • LZMYBCTLTD.exe (PID: 432)
      • HMC.exe (PID: 488)

    • Starts POWERSHELL.EXE for commands execution

      • HMC.exe (PID: 556)
      • LZMYBCTLTD.exe (PID: 3912)
      • LZMYBCTLTD.exe (PID: 432)
      • HMC.exe (PID: 488)

    • Found regular expressions for crypto-addresses (YARA)

      • HMC.exe (PID: 556)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3188)

    • Starts CMD.EXE for commands execution

      • HMC.exe (PID: 556)

    • The process executes via Task Scheduler

      • LZMYBCTLTD.exe (PID: 432)

    • Executing commands from a ".bat" file

      • HMC.exe (PID: 556)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6584)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6584)

    • Manual execution by a user

      • HMC.exe (PID: 2600)
      • HMC.exe (PID: 3848)

    • Checks supported languages

      • HMC.exe (PID: 2600)
      • HMC.exe (PID: 556)
      • LZMYBCTLTD.exe (PID: 3912)
      • LZMYBCTLTD.exe (PID: 432)
      • HMC.exe (PID: 488)
      • HMC.exe (PID: 3848)

    • Process checks computer location settings

      • HMC.exe (PID: 2600)
      • HMC.exe (PID: 556)
      • LZMYBCTLTD.exe (PID: 3912)
      • LZMYBCTLTD.exe (PID: 432)
      • HMC.exe (PID: 3848)
      • HMC.exe (PID: 488)

    • Reads the computer name

      • HMC.exe (PID: 2600)
      • HMC.exe (PID: 556)
      • LZMYBCTLTD.exe (PID: 432)
      • HMC.exe (PID: 3848)
      • HMC.exe (PID: 488)
      • LZMYBCTLTD.exe (PID: 3912)

    • Process checks whether UAC notifications are on

      • HMC.exe (PID: 556)
      • LZMYBCTLTD.exe (PID: 3912)
      • LZMYBCTLTD.exe (PID: 432)
      • HMC.exe (PID: 488)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4392)
      • powershell.exe (PID: 4388)
      • powershell.exe (PID: 4864)
      • powershell.exe (PID: 6324)
      • powershell.exe (PID: 1540)
      • powershell.exe (PID: 1228)
      • powershell.exe (PID: 3508)
      • powershell.exe (PID: 2260)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4392)
      • powershell.exe (PID: 4388)
      • powershell.exe (PID: 4864)
      • powershell.exe (PID: 6324)
      • powershell.exe (PID: 1228)
      • powershell.exe (PID: 1540)
      • powershell.exe (PID: 2260)
      • powershell.exe (PID: 3508)

    • Create files in a temporary directory

      • HMC.exe (PID: 556)

    • Creates files in the program directory

      • HMC.exe (PID: 556)

    • Themida protector has been detected

      • HMC.exe (PID: 556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
29
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs hmc.exe no specs hmc.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs lzmybctltd.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs lzmybctltd.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs hmc.exe no specs hmc.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432"C:\ProgramData\active\LZMYBCTLTD.exe"C:\ProgramData\active\LZMYBCTLTD.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
488"C:\Users\admin\Desktop\HACKUS MAIL CHECKER 1.8.0 cracked by Maksim\HMC.exe" C:\Users\admin\Desktop\HACKUS MAIL CHECKER 1.8.0 cracked by Maksim\HMC.exe
HMC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\hackus mail checker 1.8.0 cracked by maksim\hmc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
556"C:\Users\admin\Desktop\HACKUS MAIL CHECKER 1.8.0 cracked by Maksim\HMC.exe" C:\Users\admin\Desktop\HACKUS MAIL CHECKER 1.8.0 cracked by Maksim\HMC.exe
HMC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\hackus mail checker 1.8.0 cracked by maksim\hmc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
648"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "LZMYBCTLTD" /tr C:\ProgramData\active\LZMYBCTLTD.exe /fC:\Windows\SysWOW64\schtasks.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1228"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1296\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1540"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1576\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2260"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—HMC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
45 482
Read events
45 473
Write events
9
Delete events
0

Modification events

(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\HACKUS MAIL CHECKER 1.8.0 cracked by Maksim 2024.rar
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
3
Suspicious files
2
Text files
34
Unknown types
0

Dropped files

PID
Process
Filename
Type
6584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6584.20558\HACKUS MAIL CHECKER 1.8.0 cracked by Maksim\HMC.exe —
MD5:—
SHA256:—
556HMC.exeC:\ProgramData\active\LZMYBCTLTD.exe —
MD5:—
SHA256:—
6584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6584.20558\HACKUS MAIL CHECKER 1.8.0 cracked by Maksim\License.dlltext
MD5:B08A5C34CF0A06615DA2CA89010D8B4F
SHA256:04CC5B3B49A7E9E9B6C66C7BE59A20992BF2653746B5D43829C383FB233F88FA
6584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6584.20558\HACKUS MAIL CHECKER 1.8.0 cracked by Maksim\x86\SQLite.Interop.dllexecutable
MD5:8BE215ABF1F36AA3D23555A671E7E3BE
SHA256:83F332EA9535814F18BE4EE768682ECC7720794AEDC30659EB165E46257A7CAE
4388powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xqrhaw3d.jzu.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4392powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sjexerqs.2o2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4392powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x0cwtj0a.tim.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4392powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zqlvae3j.0i1.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4388powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_i2feful3.522.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6584.20558\HACKUS MAIL CHECKER 1.8.0 cracked by Maksim\updater.inibinary
MD5:BDB71E725923415AD118571A96A58F9C
SHA256:CDFD1E0DB31EF98BE246AC26C14CBD47B24A11F85DD255FE55F93F8FB9FCAB11
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
31
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2972
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6456
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2972
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
23.48.23.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4328
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.38:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.193
  • 23.48.23.183
  • 23.48.23.169
  • 23.48.23.164
  • 23.48.23.137
  • 23.48.23.194
  • 23.48.23.176
  • 23.48.23.162
  • 23.48.23.173
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 92.123.104.38
  • 92.123.104.33
  • 92.123.104.52
  • 92.123.104.34
  • 92.123.104.32
  • 92.123.104.59
  • 92.123.104.35
  • 92.123.104.51
  • 92.123.104.31
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.73
  • 20.190.159.4
  • 40.126.31.69
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.67
  • 40.126.31.71
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
arc.msn.com
  • 20.74.19.45
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HACKUS MAIL CHECKER 1.8.0 cracked by Maksim 2024.rar