File name:

818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.zip

Full analysis: https://app.any.run/tasks/6058068a-f01c-4e8a-9489-c2243ee6cbcf
Verdict: Malicious activity
Threats:

TrickBot is an advanced banking trojan that attackers can use to steal payment credentials from the victims. It can redirect the victim to a fake banking cabinet and retrieve credentials typed in on the webpage.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 19:16:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
auto
generic
evasion
ip-check
golang
trickbot
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

9DDB2CBCA4BA65B04440DE93C5F840F8

SHA1:

6DB93CC06412D7B45C0A7735AF20BF140487DF60

SHA256:

DBA7FC22EA378256B03F4190DA4D67BB373EEADD71D153F9AD6D08389FAB9946

SSDEEP:

98304:hQ0r4ekBZp1e9yjLMepwgEfKMlPivSW2yDuhF7xlWVl+w95j3TV8rNQqnux5vl4I:WLB2IpaGMen

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • WinRAR.exe (PID: 6040)

  • SUSPICIOUS

    • Application launched itself

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4120)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1132)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 780)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 2340)

    • Adds/modifies Windows certificates

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 3768)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 5360)

    • Creates or modifies Windows services

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4120)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)

    • There is functionality for capture public ip (YARA)

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 3768)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6040)

    • Checks supported languages

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4120)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1132)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)

    • Manual execution by a user

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4120)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1132)
      • Taskmgr.exe (PID: 3364)
      • Taskmgr.exe (PID: 3760)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 2340)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 780)

    • Reads Environment values

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)

    • Reads the computer name

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4120)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1132)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)

    • Reads the machine GUID from the registry

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)

    • Application based on Golang

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 3768)

    • Reads the software policy settings

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • slui.exe (PID: 6744)
      • slui.exe (PID: 1300)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)

    • Reads product name

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)

    • Creates files or folders in the user directory

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)

    • Detects GO elliptic curve encryption (YARA)

      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 1184)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 4740)
      • 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe (PID: 3768)

    • Checks proxy server information

      • slui.exe (PID: 6744)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 3760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:15 19:15:56
ZipCRC: 0xcd5ec602
ZipCompressedSize: 3191899
ZipUncompressedSize: 7924224
ZipFileName: 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
16
Malicious processes
2
Suspicious processes
5

Behavior graph

Click at the process to see the details
start #GENERIC winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe svchost.exe slui.exe 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe no specs 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe taskmgr.exe no specs taskmgr.exe 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe 818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe

Process information

PID
CMD
Path
Indicators
Parent process
780C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
780"C:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe" C:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
1132"C:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe" C:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
c:\windows\system32\ws2_32.dll
1184C:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exeC:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
1300"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2340"C:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe" C:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
3364"C:\WINDOWS\system32\taskmgr.exe" /7C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
3760"C:\WINDOWS\system32\taskmgr.exe" /7C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3768C:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exeC:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
Total events
27 788
Read events
27 750
Write events
22
Delete events
16

Modification events

(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.zip
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3760Taskmgr.exeC:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
1184818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exeC:\Users\admin\AppData\Roaming\RemoteAdmin\client_idtext
MD5:78C72139DDF1A591C4DE0737EA95BB56
SHA256:BB4D43D7CAF8F9C32C13286DE693E52C2B4C920EF4A3B19946F028A6C744561B
6040WinRAR.exeC:\Users\admin\Downloads\818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exeexecutable
MD5:36F4AB4F787D9C43D3C6181BC18CA405
SHA256:818A48E399389A23FC73994DC4331314374A7097FE831B4EE617B9315487D804
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
80
DNS requests
26
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.146:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
208
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
208
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4740
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/45.128.199.83
unknown
—
—
whitelisted
1184
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/45.128.199.83
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.146:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.146
  • 23.48.23.157
  • 23.48.23.168
  • 23.48.23.166
  • 23.48.23.173
  • 23.48.23.156
  • 23.48.23.169
  • 23.48.23.161
  • 23.48.23.174
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.5
  • 20.190.160.3
  • 40.126.32.140
  • 20.190.160.130
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
api.ipify.org
  • 172.67.74.152
  • 104.26.12.205
  • 104.26.13.205
shared

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
1184
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
1184
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
1184
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
1184
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
4740
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
4740
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
818a48e399389a23fc73994dc4331314374a7097fe831b4ee617b9315487d804.zip