File name:

virus.zip

Full analysis: https://app.any.run/tasks/4bfe0753-c7f1-4f79-b9f7-3dce1b641b97
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 07, 2025, 20:18:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
aurotun
stealer
crypto-regex
api-base64
wmi-base64
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

7DCC6354594096309E327079246E6A77

SHA1:

2A2A650BBAB7768F76E59BA80D28B9E583C0B00A

SHA256:

CF21CDE639D93958BF1F6DB7DA22262FA7D9ED37809EB5A59A6C24BDB2CD7647

SSDEEP:

98304:MwwbbHfhemoDqFemgvfO4R5lFt41GUNoCNmysWy53wTcyTczDRc2Ixj3yF1q3zbI:nAJXp9P2WVe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)
      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 960)

    • AUROTUN mutex has been found

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • AUROTUN has been detected (YARA)

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Changes Windows Defender settings

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)
      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 960)

    • Adds path to the Windows Defender exclusion list

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)
      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 960)

  • SUSPICIOUS

    • Checks for external IP

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)
      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 2188)
      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 960)

    • Connects to unusual port

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)
      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 960)

    • Found regular expressions for crypto-addresses (YARA)

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Script adds exclusion path to Windows Defender

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)
      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 960)

    • Executable content was dropped or overwritten

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)
      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 960)

    • Starts POWERSHELL.EXE for commands execution

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)
      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 960)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 1188)

  • INFO

    • Potential library load (Base64 Encoded 'LoadLibrary')

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Manual execution by a user

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)
      • Taskmgr.exe (PID: 7684)
      • Taskmgr.exe (PID: 7636)
      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 7016)

    • Reads the computer name

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Process checks computer location settings

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1116)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1116)

    • Checks supported languages

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Reads the machine GUID from the registry

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Found Base64 encoded reference to WMI classes (YARA)

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Potential remote process memory writing (Base64 Encoded 'WriteProcessMemory')

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Checks proxy server information

      • slui.exe (PID: 4200)

    • Potential dynamic function import (Base64 Encoded 'GetProcAddress')

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Potential access to remote process (Base64 Encoded 'OpenProcess')

      • The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe (PID: 6620)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 7636)

    • Reads the software policy settings

      • slui.exe (PID: 4200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2025:06:03 14:14:08
ZipCRC: 0x01b667ac
ZipCompressedSize: 7074806
ZipUncompressedSize: 836899840
ZipFileName: The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
300
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #AUROTUN the accountant 2.2025.1080p.webrip.aac5.1.10bits.x265-rapta.exe powershell.exe no specs conhost.exe no specs svchost.exe slui.exe taskmgr.exe no specs taskmgr.exe plugscheduler.exe no specs the accountant 2.2025.1080p.webrip.aac5.1.10bits.x265-rapta.exe no specs svchost.exe the accountant 2.2025.1080p.webrip.aac5.1.10bits.x265-rapta.exe

Process information

PID
CMD
Path
Indicators
Parent process
960"C:\Users\admin\Desktop\The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe" C:\Users\admin\Desktop\The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\the accountant 2.2025.1080p.webrip.aac5.1.10bits.x265-rapta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1052"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\virus.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1116powershell.exe Add-MpPreference -ExclusionPath "C:\WINDOWS\system32\Health.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1188"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2188C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4200C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4560\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6620"C:\Users\admin\Desktop\The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe" C:\Users\admin\Desktop\The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\the accountant 2.2025.1080p.webrip.aac5.1.10bits.x265-rapta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7016"C:\Users\admin\Desktop\The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe" C:\Users\admin\Desktop\The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\the accountant 2.2025.1080p.webrip.aac5.1.10bits.x265-rapta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
Total events
13 970
Read events
13 942
Write events
27
Delete events
1

Modification events

(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\virus.zip
(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(1052) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
2
Suspicious files
45
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1052.31290\The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe —
MD5:—
SHA256:—
1188PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.049.etlbinary
MD5:5EA68411BF8E9EAF4621BAF73F61449E
SHA256:9D4CA5A1D871F819C139A498BB910A63576C2FE6367853544F8D172D8B6EBFF7
6620The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exeC:\Windows\System32\Health.exeexecutable
MD5:C1CBAB1D0B8E67A60BEFB2527F932E72
SHA256:79975405C867B86CE580E501DC3392DA329EDD4467E3DE87F3813DF0594BB08F
1188PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.045.etlbinary
MD5:89BD161BF7B46C9078937CF832786737
SHA256:2B83DF5532E9F54ED301C8F82E2CDD489799C8D5222A2D44C97DCB151A96FAA9
1188PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.050.etlbinary
MD5:C8834D365FAE073DEDE1F1620454CE71
SHA256:C6DD793EEE1D5551CA507A3C5BFFECA82DD3E29C63C2C6DD218A7D4BFB37046B
1188PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.044.etlbinary
MD5:B53B2070E686FFB1FBC8B06994E7C8D7
SHA256:A3ABD06F4E40CB700B1908AB6BCD2E27455E13EF076E0BF2345BB2FA369EF802
1188PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.048.etlbinary
MD5:A23907B6FDD47DCABFDFD7CF2FCD7671
SHA256:0C9C33FE9E984A2E5A70EBA51F36B9929A86199E424AF2F8080E1267B87DC970
7636Taskmgr.exeC:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
1116powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:4A06B54BD80526B4C8BEEC0F8158371D
SHA256:4B52575C4F3A8943203AA5BBDC1C217B82C4FE4252EBB79EF505439988DE8A4C
1116powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wzk2wweq.2xv.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
73
DNS requests
36
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5724
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
960
The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/45.86.203.67
unknown
—
—
whitelisted
7556
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7556
svchost.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4556
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6368
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
5228
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2088
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7556
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7556
svchost.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.159
  • 23.48.23.194
  • 23.48.23.158
  • 23.48.23.190
  • 23.48.23.143
  • 23.48.23.173
  • 23.48.23.183
  • 23.48.23.162
whitelisted
www.microsoft.com
  • 2.16.253.202
  • 2.23.246.101
whitelisted
google.com
  • 142.250.186.110
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.22
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.134
  • 20.190.160.132
  • 20.190.160.67
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
api.ipify.org
  • 172.67.74.152
  • 104.26.13.205
  • 104.26.12.205
shared

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6620
The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
6620
The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6620
The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
A Network Trojan was detected
ET MALWARE MonsterV2 Stealer CnC Checkin
2188
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
960
The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
960
The Accountant 2.2025.1080p.WEBRip.AAC5.1.10bits.x265-Rapta.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2188
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
virus.zip