File name:

PC0098_2023-11-29_18_41_06.614.zip

Full analysis: https://app.any.run/tasks/d589ea11-55f3-4472-8d5d-5c79b1d48747
Verdict: Malicious activity
Analysis date: November 29, 2023, 18:44:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract
MD5:

DF5260F2958F1C644244CBE8F3C332CC

SHA1:

7DEFD7DA103199EC077892013B76FC759A04CA03

SHA256:

D15A219608ED0FFAA28928A78CDBE1D05AEE693C33D8FE2A855075647D8CE0A9

SSDEEP:

98304:36qy2V6mZEnPdET6Z9nDCHvkPihoZC7U3eKhw8F89J8l3Z/n8YrI9kwM3Cy9r+BC:ElXF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe (PID: 924)
      • LTSVC.exe (PID: 2760)

    • Creates a writable file in the system directory

      • LTSVC.exe (PID: 2760)

    • Registers / Runs the DLL via REGSVR32.EXE

      • LTSVC.exe (PID: 2760)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 3972)
      • LTSVC.exe (PID: 2760)
      • net.exe (PID: 3400)
      • net.exe (PID: 2456)
      • cmd.exe (PID: 3272)
      • cmd.exe (PID: 3540)
      • net.exe (PID: 2052)
      • net.exe (PID: 1864)
      • net.exe (PID: 2944)
      • net.exe (PID: 128)
      • net.exe (PID: 2480)

    • Create files in the Startup directory

      • LTSVC.exe (PID: 2760)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe (PID: 924)

    • Reads security settings of Internet Explorer

      • installutil.exe (PID: 2432)

    • Checks Windows Trust Settings

      • installutil.exe (PID: 2432)
      • LTSVC.exe (PID: 2760)
      • LTSVC.exe (PID: 1644)

    • Reads the Internet Settings

      • F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe (PID: 924)

    • Reads settings of System Certificates

      • installutil.exe (PID: 2432)

    • Creates or modifies Windows services

      • installutil.exe (PID: 2432)

    • Executes as Windows Service

      • LTSVC.exe (PID: 2760)
      • LTSVC.exe (PID: 1644)

    • Drops a system driver (possible attempt to evade defenses)

      • LTSVC.exe (PID: 2760)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 284)
      • cmd.exe (PID: 1752)
      • cmd.exe (PID: 3764)

    • Uses ICACLS.EXE to modify access control lists

      • LTSVC.exe (PID: 2760)

    • Starts CMD.EXE for commands execution

      • LTSVC.exe (PID: 2760)

    • Executing commands from a ".bat" file

      • LTSVC.exe (PID: 2760)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 2848)
      • F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe (PID: 924)
      • installutil.exe (PID: 2432)
      • LTSVC.exe (PID: 2760)
      • LTSVC.exe (PID: 1644)

    • Checks supported languages

      • F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe (PID: 924)
      • wmpnscfg.exe (PID: 2848)
      • installutil.exe (PID: 2432)
      • LTSVC.exe (PID: 2760)
      • LTSVC.exe (PID: 1644)

    • Create files in a temporary directory

      • F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe (PID: 924)
      • installutil.exe (PID: 2432)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2848)
      • F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe (PID: 924)
      • installutil.exe (PID: 2432)
      • LTSVC.exe (PID: 2760)
      • LTSVC.exe (PID: 1644)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2848)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 888)

    • Reads Environment values

      • F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe (PID: 924)
      • LTSVC.exe (PID: 2760)
      • LTSVC.exe (PID: 1644)

    • Creates files in the program directory

      • LTSVC.exe (PID: 2760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0801
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xca455e8b
ZipCompressedSize: 3620787
ZipUncompressedSize: 10135040
ZipFileName: Device/HarddiskVolume3/ProgramData/Dell/SARemediation/SystemRepair/Snapshots/Backup/F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
94
Monitored processes
41
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs wmpnscfg.exe no specs f4a081096ee5fd5bb751fff65ab3f827d85aa0c0.exe no specs f4a081096ee5fd5bb751fff65ab3f827d85aa0c0.exe installutil.exe no specs ltsvc.exe net1.exe no specs cacls.exe no specs regsvr32.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs bcdedit.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs ping.exe no specs ping.exe no specs net.exe no specs net1.exe no specs ltsvc.exe no specs ping.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128net start LTServiceC:\Windows\System32\net.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
148ping localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
284"CMD.exe" /c netsh advfirewall firewall Delete rule name="Allow Local Redir"C:\Windows\System32\cmd.exe—LTSVC.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
536ping localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
888"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PC0098_2023-11-29_18_41_06.614.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
924"C:\Users\admin\AppData\Local\Temp\Rar$EXb888.47767\Device\HarddiskVolume3\ProgramData\Dell\SARemediation\SystemRepair\Snapshots\Backup\F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb888.47767\Device\HarddiskVolume3\ProgramData\Dell\SARemediation\SystemRepair\Snapshots\Backup\F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exe
WinRAR.exe
User:
admin
Company:
LabTech Software
Integrity Level:
HIGH
Description:
LTSilent
Exit code:
0
Version:
100.332.5505.17848
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb888.47767\device\harddiskvolume3\programdata\dell\saremediation\systemrepair\snapshots\backup\f4a081096ee5fd5bb751fff65ab3f827d85aa0c0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1248netsh advfirewall firewall Delete rule name="Allow Local Redir"C:\Windows\System32\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1644"C:\Windows\LTSvc\LTSVC.exe" -sLTServiceC:\Windows\LTSvc\LTSVC.exe—services.exe
User:
SYSTEM
Company:
LabTech Software
Integrity Level:
SYSTEM
Description:
LabTech Service
Exit code:
0
Version:
100.332.5505.17847
Modules
Images
c:\windows\ltsvc\ltsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1752"CMD.exe" /c netsh advfirewall firewall Delete rule name="Allow Tunnel StunRelay"C:\Windows\System32\cmd.exe—LTSVC.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1856C:\Windows\system32\net1 start LTServiceC:\Windows\System32\net1.exe—net.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
Total events
19 473
Read events
19 150
Write events
320
Delete events
3

Modification events

(PID) Process:(888) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(888) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(888) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(888) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(888) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(888) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(888) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(888) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2848) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{2BEAD2BD-3336-4650-9DF0-7539C2C034CC}\{222FC10C-194C-43E0-9DBE-87C7FEE93C3B}
Operation:delete keyName:(default)
Value:
(PID) Process:(2848) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{2BEAD2BD-3336-4650-9DF0-7539C2C034CC}
Operation:delete keyName:(default)
Value:
Executable files
16
Suspicious files
12
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
888WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb888.47767\Device\HarddiskVolume3\ProgramData\Dell\SARemediation\SystemRepair\Snapshots\Backup\F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exeexecutable
MD5:4E668643C2152718259E27EA1C1E9BEC
SHA256:3B189EC6B9EBE1228DE113C0FA40B7D69220F13AB8F98480E40C23751776C780
888WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb888.47767\manifest.jsontext
MD5:BB66E33C8D794DCFA68ED500AD2EB2AB
SHA256:765324C001AD3A3E4A7B9DFC2DF8812448CC114D42A7D5AA474728FE95D470F1
924F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exeC:\Windows\LTSvc\LTTray.exeexecutable
MD5:BF87FA5FFEB414D73BA6E7A5C8BF0D2D
SHA256:15BC843A229AECBA32E526186FE3741DF18C210A887ED7E3ADE1B0D3D5E6FB34
924F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exeC:\Windows\LTSvc\ICSharpCode.SharpZipLib.dllexecutable
MD5:555A3998407435703F9C14350A929846
SHA256:BC02A4FE45FC5E83AD07220120DF2F841FE6D17391D3FFEBBE8CB21393CADBAE
924F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb888.47767\Device\HarddiskVolume3\ProgramData\Dell\SARemediation\SystemRepair\Snapshots\Backup\InstallLog.txttext
MD5:17BC8112B931A6877491BD90753620C1
SHA256:C3246E9DA4E99D45227010956D1260C876C14999741C99158FAA11D420C03783
924F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exeC:\Windows\LTSvc\Interfaces.dllexecutable
MD5:2304C5AE2CC8D48A8BC4505A7DF43A9C
SHA256:83CF4768671168D558A2B616847A4AFCD6260B54413FF24D764451A45F748F53
924F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exeC:\Windows\LTSvc\LabTech.icoimage
MD5:DEBC45A95686B916A3FDF45D16CFB1F5
SHA256:E5CB0095898C3D411ADA87D92CD8E0EF497AB535ABF1E03DE62870EDD5B90F30
2760LTSVC.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A207E8A54F3F7E181AD76B6FC1B4335B
SHA256:7F7F407CE71A13710B98237CB68FFCC5FE7BB8D5FC358DE4D67DEBFFD44BF7EC
2432installutil.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb888.47767\Device\HarddiskVolume3\ProgramData\Dell\SARemediation\SystemRepair\Snapshots\Backup\InstallUtil.InstallLogtext
MD5:6EA29A8D191CAAF87EA74B57A9597DDA
SHA256:B0083D0E5A5D62568F2982F2C3BDB3B22BD59CCA636B9FD641F2F9440E4EA029
924F4A081096EE5FD5BB751FFF65AB3F827D85AA0C0.exeC:\Windows\LTSvc\nsoftware.IPWorksSSH.dllexecutable
MD5:3EEE3A5FE8BCC66D2CF519BF9D540F68
SHA256:9C3DE4F8DBEDAD6D6FC528E3EDB27FE91FFCAED3A6F7F665D899E9316BC23B33
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
10
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1080
svchost.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8c278ce706dba7cc
unknown
compressed
4.66 Kb
unknown
2760
LTSVC.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e066062f7f0bb17c
unknown
compressed
4.66 Kb
unknown
2760
LTSVC.exe
GET
200
192.229.221.95:80
http://crl.verisign.com/pca3-g5.crl
unknown
binary
834 b
unknown
2760
LTSVC.exe
GET
200
152.199.19.74:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c%3D
unknown
binary
5 b
unknown
2760
LTSVC.exe
GET
200
152.199.19.74:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c%3D
unknown
binary
5 b
unknown
2760
LTSVC.exe
GET
200
152.199.19.74:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo%2FX8AUm7%2BPSp50CECjIFSgOcuwQMusYMOo9RJ0%3D
unknown
binary
1.51 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
868
svchost.exe
95.101.148.135:80
—
Akamai International B.V.
NL
unknown
868
svchost.exe
104.122.25.135:80
armmf.adobe.com
AKAMAI-AS
DE
unknown
2760
LTSVC.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2760
LTSVC.exe
152.199.19.74:80
ocsp.verisign.com
EDGECAST
US
unknown
2760
LTSVC.exe
192.229.221.95:80
crl.verisign.com
EDGECAST
US
whitelisted
1080
svchost.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 104.122.25.135
whitelisted
labtech.wpc.net
  • —
unknown
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.209
  • 184.24.77.173
  • 184.24.77.194
whitelisted
ocsp.verisign.com
  • 152.199.19.74
whitelisted
crl.verisign.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PC0098_2023-11-29_18_41_06.614.zip