File name:

2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94.zip

Full analysis: https://app.any.run/tasks/3b4ca33a-35c5-4c59-a14b-ada85b9c765d
Verdict: Malicious activity
Analysis date: December 21, 2023, 00:56:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9B67F139088CBD4FA78DE3B74E687386

SHA1:

8FD8405BB7E4EDF38194514FE3A522DD0B37CDD7

SHA256:

CE6823A303FFC4737C833DD0B07367F14C704543A753F1BF78BB7932EFAD46D9

SSDEEP:

98304:L1MFBJPP4DlmBjw0NvnKgmB+2kkOIh0wmt5g+i8si6PbDva9qrVEeZ1QXVEEw/e6:X4wn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Windows Loader.exe (PID: 1536)
      • Windows Loader.exe (PID: 2840)

    • Opens a text file (SCRIPT)

      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 2544)
      • cscript.exe (PID: 3252)
      • cscript.exe (PID: 3336)

    • Accesses environment variables (SCRIPT)

      • cscript.exe (PID: 1000)

    • Checks whether a specified folder exists (SCRIPT)

      • cscript.exe (PID: 1000)

  • SUSPICIOUS

    • Reads the BIOS version

      • Windows Loader.exe (PID: 1536)
      • Windows Loader.exe (PID: 2840)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 1388)
      • cmd.exe (PID: 3008)
      • cmd.exe (PID: 3116)

    • Application launched itself

      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 2968)
      • cmd.exe (PID: 3092)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1600)
      • cmd.exe (PID: 3044)
      • cmd.exe (PID: 3152)

    • Process drops legitimate windows executable

      • Windows Loader.exe (PID: 1536)
      • Windows Loader.exe (PID: 2840)

    • Starts CMD.EXE for commands execution

      • Windows Loader.exe (PID: 1536)
      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 2968)
      • cmd.exe (PID: 3092)
      • Windows Loader.exe (PID: 2840)

    • The process executes VB scripts

      • cmd.exe (PID: 2324)
      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 2548)
      • cmd.exe (PID: 3228)
      • cmd.exe (PID: 3312)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 2544)
      • cscript.exe (PID: 3252)
      • cscript.exe (PID: 3336)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 2544)
      • cscript.exe (PID: 3252)
      • cscript.exe (PID: 3336)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 2544)
      • cscript.exe (PID: 3252)
      • cscript.exe (PID: 3336)

    • Executes WMI query (SCRIPT)

      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 2544)
      • cscript.exe (PID: 3252)
      • cscript.exe (PID: 3336)

    • Checks whether a specific file exists (SCRIPT)

      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 2544)
      • cscript.exe (PID: 3252)
      • cscript.exe (PID: 3336)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 2544)
      • cscript.exe (PID: 3252)
      • cscript.exe (PID: 3336)

    • Reads data from a file (SCRIPT)

      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 3252)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 3252)

    • Changes charset (SCRIPT)

      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 3252)

    • Accesses system date via WMI (SCRIPT)

      • cscript.exe (PID: 1000)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1788)
      • ctfmon.exe (PID: 1684)
      • ctfmon.exe (PID: 1604)
      • sipnotify.exe (PID: 1656)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 1788)
      • sipnotify.exe (PID: 1656)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1788)
      • sipnotify.exe (PID: 1656)

    • The system shut down or reboot

      • cmd.exe (PID: 1484)
      • cmd.exe (PID: 3596)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2044)

    • Checks supported languages

      • Windows Loader.exe (PID: 1536)
      • bootsect.exe (PID: 2260)
      • wmpnscfg.exe (PID: 2836)
      • IMEKLMG.EXE (PID: 2272)
      • IMEKLMG.EXE (PID: 2288)
      • wmpnscfg.exe (PID: 2512)
      • wmpnscfg.exe (PID: 2532)
      • Windows Loader.exe (PID: 2840)
      • bootsect.exe (PID: 3544)
      • IMEKLMG.EXE (PID: 460)
      • IMEKLMG.EXE (PID: 2072)
      • wmpnscfg.exe (PID: 2368)
      • MSASCui.exe (PID: 2740)
      • wmpnscfg.exe (PID: 2416)
      • wmpnscfg.exe (PID: 2512)

    • Reads the computer name

      • Windows Loader.exe (PID: 1536)
      • wmpnscfg.exe (PID: 2836)
      • IMEKLMG.EXE (PID: 2272)
      • IMEKLMG.EXE (PID: 2288)
      • wmpnscfg.exe (PID: 2512)
      • wmpnscfg.exe (PID: 2532)
      • Windows Loader.exe (PID: 2840)
      • IMEKLMG.EXE (PID: 460)
      • IMEKLMG.EXE (PID: 2072)
      • wmpnscfg.exe (PID: 2368)
      • MSASCui.exe (PID: 2740)
      • wmpnscfg.exe (PID: 2416)
      • wmpnscfg.exe (PID: 2512)

    • Reads product name

      • Windows Loader.exe (PID: 1536)
      • Windows Loader.exe (PID: 2840)

    • Reads Environment values

      • Windows Loader.exe (PID: 1536)
      • Windows Loader.exe (PID: 2840)

    • Reads the machine GUID from the registry

      • Windows Loader.exe (PID: 1536)
      • Windows Loader.exe (PID: 2840)

    • Manual execution by a user

      • Windows Loader.exe (PID: 1536)
      • wmpnscfg.exe (PID: 2836)
      • IMEKLMG.EXE (PID: 2272)
      • wmpnscfg.exe (PID: 2512)
      • IMEKLMG.EXE (PID: 2288)
      • wmpnscfg.exe (PID: 2532)
      • Windows Loader.exe (PID: 2840)
      • IMEKLMG.EXE (PID: 460)
      • IMEKLMG.EXE (PID: 2072)
      • wmpnscfg.exe (PID: 2368)
      • wmpnscfg.exe (PID: 2512)
      • wmpnscfg.exe (PID: 2416)
      • MSASCui.exe (PID: 2740)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 1000)
      • cscript.exe (PID: 2544)
      • sipnotify.exe (PID: 1788)
      • cscript.exe (PID: 3252)
      • cscript.exe (PID: 3336)
      • sipnotify.exe (PID: 1656)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 2272)
      • IMEKLMG.EXE (PID: 2288)
      • IMEKLMG.EXE (PID: 460)
      • IMEKLMG.EXE (PID: 2072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2023:12:21 00:49:38
ZipCRC: 0xb4417bb9
ZipCompressedSize: 1777522
ZipUncompressedSize: 4021049
ZipFileName: Windows Loader.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
53
Malicious processes
14
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs windows loader.exe cmd.exe no specs cmd.exe no specs takeown.exe no specs cmd.exe no specs icacls.exe no specs cmd.exe no specs bootsect.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs wmpnscfg.exe no specs cmd.exe no specs shutdown.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs windows loader.exe cmd.exe no specs cmd.exe no specs takeown.exe no specs cmd.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs takeown.exe no specs cmd.exe no specs icacls.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs compact.exe no specs cmd.exe no specs bootsect.exe no specs cmd.exe no specs shutdown.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs msascui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376takeown /f C:\ldrscan\bootwin C:\Windows\System32\takeown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
460"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1000C:\Windows\System32\cscript.exe //nologo C:\Windows\System32\slmgr.vbs -rilc C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1388cmd.exe /c takeown /f C:\ldrscan\bootwin C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1424cmd.exe /A /C "C:\bootsect.exe /nt60 SYS /force" C:\Windows\System32\cmd.exe—Windows Loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1484cmd.exe /A /C "shutdown -r -t 0" C:\Windows\System32\cmd.exe—Windows Loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1536"C:\Users\admin\Desktop\Windows Loader.exe" C:\Users\admin\Desktop\Windows Loader.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\windows loader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1600cmd.exe /A /C "icacls C:\ldrscan\bootwin /grant *S-1-1-0:(F)" C:\Windows\System32\cmd.exe—Windows Loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1604C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1656C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
8 675
Read events
8 617
Write events
58
Delete events
0

Modification events

(PID) Process:(2044) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
5
Suspicious files
3
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
2260bootsect.exe\Device\HarddiskVolume1 —
MD5:—
SHA256:—
3544bootsect.exe\Device\HarddiskVolume1 —
MD5:—
SHA256:—
1788sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\script.jstext
MD5:A2682382967C351F7ED21762F9E5DE9E
SHA256:36B1D26F1EC69685648C0528C2FCE95A3C2DBECF828CDFA4A8B4239A15B644A2
1536Windows Loader.exeC:\bootsect.exeexecutable
MD5:17B18A2FEB3DCFE8A165AF86EBC29FE7
SHA256:99C4970F1F4B9DC50A5DB9FF6F3A581754A1631F0751BDEC2B5E3A261F35D85A
1656sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\en-us.htmlhtml
MD5:9752942B57692148B9F614CF4C119A36
SHA256:E31B834DD53FA6815F396FC09C726636ABF98F3367F0CF1590EF5EB3801C75D1
1788sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\main.jpgimage
MD5:B342ACE63F77961249A084C61EABC884
SHA256:E5067BBA2095B5DA7C3171EC116E9A92337E24E471339B0860A160076EFE49B9
1788sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\microsoft-logo.pngimage
MD5:B7C73A0CFBA68CC70C35EF9C63703CE4
SHA256:1D8B27A0266FF526CF95447F3701592A908848467D37C09A00A2516C1F29A013
1788sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\metadata.jsonbinary
MD5:E8A970BA6CE386EED9A5E724F26212A6
SHA256:7E06107D585D8FC7870998F3856DCC3E35800AA97E4406AAB83BC8444B6CBDE3
1788sipnotify.exeC:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\styles.csstext
MD5:3383EEF350240253D7C2C2564381B3CB
SHA256:85443493D86D6D7FB0E07BC9705DFC9C858086FBA1B0E508092AB328D5F145E8
2840Windows Loader.exeC:\Dell.XRM-MSxml
MD5:18B1E45BF56F40C3C4BBE65831178216
SHA256:D072A059D3ED3E75C98B85B41E4319E8D5CFAE0E0C239B62436A3AD34003AB4A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
12
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1788
sipnotify.exe
HEAD
200
23.212.215.38:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133475938843430000
unknown
—
—
unknown
1788
sipnotify.exe
HEAD
200
23.212.215.38:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133475939774530000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1100
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1788
sipnotify.exe
23.212.215.38:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
AU
unknown
1132
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 23.212.215.38
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94.zip