File name:

f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.zip

Full analysis: https://app.any.run/tasks/a4c0b4df-f3c0-47c9-a252-23bac4500dd1
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: June 28, 2025, 20:40:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

E507AE3D73FA630464DBFA6F6B3DDCBC

SHA1:

031387C201ADAA6B9351EDFAE8D49440D045A200

SHA256:

D772A2E6720AD598ACE43D3844709E3A1424CF5319DB5612D5C97A5A7E622396

SSDEEP:

24576:7qe0Rv+s3/uzYQgL1pBqmnR3JDNC8iRZqUgh/wr+IoRGWFzHm2/osbVCFX5lzFzV:7qe0Rv+s3/uzYQgL1pBqmnRZDNC8iRZZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5960)

    • RANSOMWARE has been detected

      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 4060)

    • Renames files like ransomware

      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 4060)

  • SUSPICIOUS

    • Application launched itself

      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 1232)

    • Executed via WMI

      • vssadmin.exe (PID: 4100)
      • WMIC.exe (PID: 1564)
      • vssadmin.exe (PID: 1512)
      • calc.exe (PID: 2512)
      • cmd.exe (PID: 2292)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5436)

    • Uses WEVTUTIL.EXE to cleanup log

      • cmd.exe (PID: 2292)

  • INFO

    • Manual execution by a user

      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 2132)
      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 1232)
      • notepad.exe (PID: 2880)

    • Checks supported languages

      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 1232)
      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 4060)

    • Reads the computer name

      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 1232)
      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 4060)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5960)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1564)
      • calc.exe (PID: 2512)
      • notepad.exe (PID: 2880)
      • OpenWith.exe (PID: 3632)

    • Reads the machine GUID from the registry

      • f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe (PID: 4060)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 2760)

    • Checks proxy server information

      • slui.exe (PID: 1132)

    • Reads the software policy settings

      • slui.exe (PID: 1132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:06:28 20:40:02
ZipCRC: 0x8ce92a99
ZipCompressedSize: 793352
ZipUncompressedSize: 1699328
ZipFileName: f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
24
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe no specs f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe conhost.exe no specs THREAT f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe no specs conhost.exe no specs vssadmin.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs vssvc.exe no specs calc.exe no specs vssadmin.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs wevtutil.exe no specs wevtutil.exe no specs openwith.exe no specs slui.exe notepad.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1132C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1156C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1232"C:\Users\admin\Desktop\Preferences\f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe" C:\Users\admin\Desktop\Preferences\f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\preferences\f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1512vssadmin.exe delete shadows /all /quietC:\Windows\System32\vssadmin.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
1564wmic shadowcopy delete /nointeractiveC:\Windows\System32\wbem\WMIC.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
2147749890
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2132"C:\Users\admin\Desktop\Preferences\f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe" C:\Users\admin\Desktop\Preferences\f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\preferences\f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe
c:\windows\system32\ntdll.dll
2292cmd.exe /c wevtutil cl security | wevtutil cl system | wevtutil cl applicationC:\Windows\System32\cmd.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2512calcC:\Windows\System32\calc.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Calculator
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\calc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2632wevtutil cl system C:\Windows\System32\wevtutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Eventing Command Line Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
c:\windows\system32\sechost.dll
2760C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
5 139
Read events
5 090
Write events
36
Delete events
13

Modification events

(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.zip
(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(5960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
2
Suspicious files
108
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
4060f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeC:\Users\admin\.ms-ad\!!Restore-My-file-Kavva.txtbinary
MD5:287C788CD3588F55662738CCB0DC9693
SHA256:FA438B79E93012CB31948993A0F7EFFB569FB7464CEA4E35CE4C9EB94B3147E3
4060f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeC:\Users\admin\Contacts\!!Restore-My-file-Kavva.txtbinary
MD5:287C788CD3588F55662738CCB0DC9693
SHA256:FA438B79E93012CB31948993A0F7EFFB569FB7464CEA4E35CE4C9EB94B3147E3
4060f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeC:\Users\!!Restore-My-file-Kavva.txtbinary
MD5:287C788CD3588F55662738CCB0DC9693
SHA256:FA438B79E93012CB31948993A0F7EFFB569FB7464CEA4E35CE4C9EB94B3147E3
4060f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeC:\Users\admin\3D Objects\!!Restore-My-file-Kavva.txtbinary
MD5:287C788CD3588F55662738CCB0DC9693
SHA256:FA438B79E93012CB31948993A0F7EFFB569FB7464CEA4E35CE4C9EB94B3147E3
4060f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeC:\Users\admin\Desktop\!!Restore-My-file-Kavva.txtbinary
MD5:287C788CD3588F55662738CCB0DC9693
SHA256:FA438B79E93012CB31948993A0F7EFFB569FB7464CEA4E35CE4C9EB94B3147E3
5960WinRAR.exeC:\Users\admin\Desktop\Preferences\f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeexecutable
MD5:C3CE46D40B2893E30BF00FCE72C2E1FA
SHA256:F3A6D4CCDD0F663269C3909E74D6847608B8632FB2814B0436A4532B8281E617
4060f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeC:\Users\admin\Documents\OneNote Notebooks\!!Restore-My-file-Kavva.txtbinary
MD5:287C788CD3588F55662738CCB0DC9693
SHA256:FA438B79E93012CB31948993A0F7EFFB569FB7464CEA4E35CE4C9EB94B3147E3
4060f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeC:\Users\admin\Desktop\Preferences\!!Restore-My-file-Kavva.txtbinary
MD5:287C788CD3588F55662738CCB0DC9693
SHA256:FA438B79E93012CB31948993A0F7EFFB569FB7464CEA4E35CE4C9EB94B3147E3
4060f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeC:\Users\admin\Documents\OneNote Notebooks\My Notebook\!!Restore-My-file-Kavva.txtbinary
MD5:287C788CD3588F55662738CCB0DC9693
SHA256:FA438B79E93012CB31948993A0F7EFFB569FB7464CEA4E35CE4C9EB94B3147E3
4060f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exeC:\Users\admin\Documents\PowerShell\!!Restore-My-file-Kavva.txtbinary
MD5:287C788CD3588F55662738CCB0DC9693
SHA256:FA438B79E93012CB31948993A0F7EFFB569FB7464CEA4E35CE4C9EB94B3147E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
31
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4168
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
4820
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4820
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2668
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2512
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4156
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4168
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4168
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.75
  • 40.126.31.67
  • 40.126.31.73
  • 40.126.31.130
  • 20.190.159.4
  • 20.190.159.73
  • 20.190.159.0
  • 40.126.31.3
  • 20.190.159.131
  • 40.126.31.71
  • 40.126.31.2
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.zip