File name:

rkill.com

Full analysis: https://app.any.run/tasks/f75080c7-87fd-4a9b-91a3-9f5b32c1751c
Verdict: Malicious activity
Analysis date: February 28, 2025, 14:17:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, RAR self-extracting archive, 3 sections
MD5:

C7D040F4C3C0214B460AABDE52BE9189

SHA1:

E6EE5410FAAFE71DFE5D4D2B3AD9EF74C96F4B41

SHA256:

D19842CA443AA540BA0A96F0F5EADF559C19061F682BB9B44CBE0AA499FF48EB

SSDEEP:

49152:0rYgzgxsD3EiOFafuN07tHY7q11LRt6fiiycZnhnu41lSCauZkEHHwDp1OhABgdz:8TgxsDUPFaWNgtJ1bkfBi43SoZkEnwD4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts application with an unusual extension

      • rkill.com.exe (PID: 6044)

    • Reads security settings of Internet Explorer

      • rkill.com.exe (PID: 6044)

    • There is functionality for taking screenshot (YARA)

      • rkill.com.exe (PID: 6044)

    • Starts CMD.EXE for commands execution

      • iexplore.exe (PID: 7980)
      • rkill.com.exe (PID: 6044)

    • Executing commands from a ".bat" file

      • rkill.com.exe (PID: 6044)
      • iexplore.exe (PID: 7980)

    • The executable file from the user directory is run by the CMD process

      • nircmd.exe (PID: 1348)
      • swreg.exe (PID: 2088)
      • sed.exe (PID: 1660)

    • Executable content was dropped or overwritten

      • rkill.com.exe (PID: 6044)

  • INFO

    • The sample compiled with english language support

      • rkill.com.exe (PID: 6044)

    • Process checks computer location settings

      • rkill.com.exe (PID: 6044)

    • Checks supported languages

      • iexplore.exe (PID: 7228)
      • iexplore.exe (PID: 7252)
      • explorer.exe (PID: 7184)
      • rkill.com.exe (PID: 6044)
      • iexplore.com (PID: 7296)

    • Reads the computer name

      • rkill.com.exe (PID: 6044)

    • NirSoft software is detected

      • userinit.exe (PID: 6048)
      • iexplore.exe (PID: 4652)
      • winlogon.exe (PID: 7084)
      • iexplore.exe (PID: 5728)
      • iexplore.exe (PID: 7752)
      • iexplore.exe (PID: 7616)
      • iexplore.exe (PID: 5116)
      • iexplore.exe (PID: 6964)
      • iexplore.exe (PID: 7756)
      • iexplore.exe (PID: 7648)
      • iexplore.exe (PID: 7796)
      • nircmd.exe (PID: 1348)
      • iexplore.exe (PID: 7736)
      • iexplore.exe (PID: 7624)

    • UPX packer has been detected

      • rkill.com.exe (PID: 6044)

    • Create files in a temporary directory

      • explorer.exe (PID: 6156)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:03:15 06:27:50+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 49152
InitializedDataSize: 143360
UninitializedDataSize: 241664
EntryPoint: 0x471c0
OSVersion: 5
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
270
Monitored processes
136
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rkill.com.exe explorer.exe no specs explorer.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.com no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs userinit.exe no specs infdefaultinstall.exe no specs explorer.exe no specs explorer.exe no specs conhost.exe no specs iexplore.exe no specs runonce.exe no specs iexplore.exe no specs conhost.exe no specs explorer.exe no specs explorer.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.com no specs conhost.exe no specs grpconv.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs iexplore.exe no specs iexplore.exe no specs explorer.exe no specs explorer.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs winlogon.exe no specs infdefaultinstall.exe no specs iexplore.exe no specs runonce.exe no specs infdefaultinstall.exe no specs iexplore.exe no specs runonce.exe no specs iexplore.exe no specs grpconv.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs grpconv.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs explorer.exe no specs explorer.exe no specs conhost.exe no specs explorer.exe no specs explorer.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs iexplore.exe no specs cmd.exe no specs iexplore.exe no specs iexplore.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs nircmd.exe no specs swreg.exe no specs sed.exe no specs rkill.com.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Users\admin\AppData\Local\Temp\RarSFX0\h\iexplore.exe" procs\iexplore.exe -k "C:\Users\admin\AppData\Local\Temp\*" and not "C:\Users\admin\AppData\Local\Temp\rkill.com.exe"C:\Users\admin\AppData\Local\Temp\RarSFX0\h\iexplore.exe—rkill.com.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\h\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
904"C:\Users\admin\AppData\Local\Temp\RarSFX0\h\iexplore.exe" procs\iexplore.exe -k restore.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\h\iexplore.exe—rkill.com.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\h\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\WINDOWS\System32\InfDefaultInstall.exe" "C:\Users\admin\AppData\Local\Temp\RarSFX0\s.inf"C:\Windows\SysWOW64\InfDefaultInstall.exe—winlogon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
INF Default Install
Exit code:
0
Version:
5.2.3668.0
Modules
Images
c:\windows\syswow64\infdefaultinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1052procs\iexplore.exe -k *onin.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\procs\iexplore.exe—iexplore.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\procs\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1056"C:\Users\admin\AppData\Local\Temp\RarSFX0\h\explorer.exe" procs\explorer.exe plist C:\Users\admin\AppData\Local\Temp\rks1.logC:\Users\admin\AppData\Local\Temp\RarSFX0\h\explorer.exe—rkill.com.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\h\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1188procs\iexplore.exe -k restore.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\procs\iexplore.exe—iexplore.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\procs\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1228procs\iexplore.exe -k "C:\ProgramData\*"C:\Users\admin\AppData\Local\Temp\RarSFX0\procs\iexplore.exe—iexplore.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\procs\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
9 067
Read events
8 947
Write events
27
Delete events
93

Modification events

(PID) Process:(7184) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command
Operation:delete valueName:IsolatedCommand
Value:
"%1" %*
(PID) Process:(7184) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\runas\command
Operation:delete valueName:IsolatedCommand
Value:
"%1" %*
(PID) Process:(7184) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:delete valueName:DisableRegistryTools
Value:
(PID) Process:(7184) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:delete valueName:DisableTaskMgr
Value:
(PID) Process:(7184) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:delete valueName:NoRun
Value:
(PID) Process:(7184) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:delete valueName:NoDesktop
Value:
(PID) Process:(7184) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:delete valueName:NoActiveDesktopChanges
Value:
(PID) Process:(7184) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:delete valueName:NoSetActiveDesktop
Value:
(PID) Process:(7184) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:delete valueName:NoRun
Value:
(PID) Process:(7184) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:delete valueName:NoDesktop
Value:
Executable files
15
Suspicious files
7
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
6044rkill.com.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\s.inftext
MD5:914650C80D2024F74AA53B7B936A548A
SHA256:5CF46D38155CDCC79898804811EB6CC4988E28912EA0BD911DF044C4758F2DE9
6044rkill.com.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\procs\iexplore.comexecutable
MD5:3C33B26F2F7FA61D882515F2D6078691
SHA256:908FDB876715F0A77014A37396D9E964FA6359D98099929BAB4086E66D72BB9F
6044rkill.com.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\h\explorer.exeexecutable
MD5:ABC6379205DE2618851C4FCBF72112EB
SHA256:22E7528E56DFFAA26CFE722994655686C90824B13EB51184ABFE44D4E95D473F
6044rkill.com.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\h\iexplore.exeexecutable
MD5:ABC6379205DE2618851C4FCBF72112EB
SHA256:22E7528E56DFFAA26CFE722994655686C90824B13EB51184ABFE44D4E95D473F
6044rkill.com.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\procs\explorer.exeexecutable
MD5:3C33B26F2F7FA61D882515F2D6078691
SHA256:908FDB876715F0A77014A37396D9E964FA6359D98099929BAB4086E66D72BB9F
6044rkill.com.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\nird\iexplore.exeexecutable
MD5:AC6094297CD882B8626466CDEB64F19F
SHA256:27C7FFD8367AAA73155FBB287A7DF1F157F2D0C3323DBB176D02B36FF616FCA5
6044rkill.com.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\procs\iexplore.exeexecutable
MD5:3C33B26F2F7FA61D882515F2D6078691
SHA256:908FDB876715F0A77014A37396D9E964FA6359D98099929BAB4086E66D72BB9F
7324BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fa575707-7f43-4d5c-8007-7c4ec82bb80d.down_data —
MD5:—
SHA256:—
6044rkill.com.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\nircmdc.exeexecutable
MD5:9CB3A38088807F54E7F89AC30E09C030
SHA256:71579B7BB651004F9C2E3F8D62511F610443C7E8225001865415A4620BD04219
6044rkill.com.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\pev.exeexecutable
MD5:3C33B26F2F7FA61D882515F2D6078691
SHA256:908FDB876715F0A77014A37396D9E964FA6359D98099929BAB4086E66D72BB9F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
25
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7324
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6480
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6480
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3008
backgroundTaskHost.exe
104.126.37.185:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2040
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5072
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.206
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.130
  • 20.190.160.131
  • 20.190.160.132
  • 20.190.160.20
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.68
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.163
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.170
  • 104.126.37.162
  • 104.126.37.178
  • 104.126.37.179
  • 104.126.37.171
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
rkill.com