File name:

Win7Recovery.zip

Full analysis: https://app.any.run/tasks/a24bf81f-9f61-438d-a97d-1c601f58b6c0
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: June 03, 2025, 00:36:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

2877BB68FE0971FD721E426BD7650C4F

SHA1:

D1CC4E0BB506D43F8F94E655AB66468FEAAA7836

SHA256:

DFBBC4D8E684CCBB14739AB8E6DDC8DDE751DC8CE55FD50717D4C0E7353402C4

SSDEEP:

12288:vWb4QK9jkSNu1Rq7/SYcWLx391U068pGxaaYDs3zYGvtzwYKN:v65K9jkSNuS7/SY/3911NGMaYDsjZvNm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Win7Recovery.exe (PID: 4228)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 5556)
      • Win7Recovery.exe (PID: 4228)

    • Starts a Microsoft application from unusual location

      • Win7Recovery.exe (PID: 4228)

    • Executes application which crashes

      • Win7Recovery.exe (PID: 4228)
      • WbVhxCIDDK.exe (PID: 5656)

    • Executable content was dropped or overwritten

      • Win7Recovery.exe (PID: 4228)

    • Reads security settings of Internet Explorer

      • Win7Recovery.exe (PID: 4228)

    • Starts itself from another location

      • Win7Recovery.exe (PID: 4228)

    • Access to an unwanted program domain was detected

      • Win7Recovery.exe (PID: 4228)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5556)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 5556)
      • Win7Recovery.exe (PID: 4228)

    • Manual execution by a user

      • Win7Recovery.exe (PID: 4228)
      • pwsh.exe (PID: 6068)

    • Checks supported languages

      • Win7Recovery.exe (PID: 4228)
      • WbVhxCIDDK.exe (PID: 5656)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 1812)
      • WerFault.exe (PID: 2320)
      • WerFault.exe (PID: 7348)
      • WerFault.exe (PID: 7212)
      • WerFault.exe (PID: 7916)
      • WerFault.exe (PID: 4620)
      • WerFault.exe (PID: 5812)
      • Win7Recovery.exe (PID: 4228)
      • WerFault.exe (PID: 7948)
      • WerFault.exe (PID: 2692)
      • WerFault.exe (PID: 6060)

    • Creates files in the program directory

      • Win7Recovery.exe (PID: 4228)

    • Reads the computer name

      • Win7Recovery.exe (PID: 4228)

    • Process checks computer location settings

      • Win7Recovery.exe (PID: 4228)

    • Create files in a temporary directory

      • Win7Recovery.exe (PID: 4228)

    • Checks proxy server information

      • Win7Recovery.exe (PID: 4228)

    • UPX packer has been detected

      • WbVhxCIDDK.exe (PID: 5656)
      • Win7Recovery.exe (PID: 4228)

    • Launch of the file from Registry key

      • Win7Recovery.exe (PID: 4228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0001
ZipCompression: Unknown (99)
ZipModifyDate: 2011:05:27 22:38:58
ZipCRC: 0x00000000
ZipCompressedSize: 410676
ZipUncompressedSize: 478720
ZipFileName: Endermanch@Win7Recovery.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
33
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe win7recovery.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs wbvhxciddk.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs rundll32.exe no specs pwsh.exe conhost.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs slui.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs wininit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4228 -s 2088C:\Windows\SysWOW64\WerFault.exe—Win7Recovery.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
716C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4228 -s 2028C:\Windows\SysWOW64\WerFault.exe—Win7Recovery.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
864C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4228 -s 2012C:\Windows\SysWOW64\WerFault.exe—Win7Recovery.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1812C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4228 -s 556C:\Windows\SysWOW64\WerFault.exe—Win7Recovery.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2320C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4228 -s 832C:\Windows\SysWOW64\WerFault.exe—Win7Recovery.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2416C:\WINDOWS\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2692C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4228 -s 1272C:\Windows\SysWOW64\WerFault.exe—Win7Recovery.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4228"C:\Users\admin\Desktop\Win7Recovery.exe" C:\Users\admin\Desktop\Win7Recovery.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
GDI Client DLL
Version:
5.1.2600.5698 (xpsp_sp3_gdr.081022-1932)
Modules
Images
c:\users\admin\desktop\win7recovery.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4620C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4228 -s 1016C:\Windows\SysWOW64\WerFault.exe—Win7Recovery.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4648C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
45 983
Read events
45 957
Write events
26
Delete events
0

Modification events

(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Win7Recovery.zip
(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
(PID) Process:(5556) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
2
Suspicious files
54
Text files
51
Unknown types
0

Dropped files

PID
Process
Filename
Type
1812WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Win7Recovery.exe_9dd45c4f139e719c1a23a561e155bb969b627f_0681e3c8_859c8c8d-cb50-47fa-b864-5a8e5703c335\Report.wer —
MD5:—
SHA256:—
2320WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Win7Recovery.exe_9dd45c4f139e719c1a23a561e155bb969b627f_0681e3c8_9a3238e5-b564-40de-aca5-5d7087ca47cd\Report.wer —
MD5:—
SHA256:—
7348WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Win7Recovery.exe_9dd45c4f139e719c1a23a561e155bb969b627f_0681e3c8_1d7d72f8-6019-438f-9fb7-f29f6a3c7451\Report.wer —
MD5:—
SHA256:—
7212WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Win7Recovery.exe_9dd45c4f139e719c1a23a561e155bb969b627f_0681e3c8_b30bfd82-ecdb-4666-90d1-b51f038d70cb\Report.wer —
MD5:—
SHA256:—
5556WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb5556.34064\Endermanch@Win7Recovery.exeexecutable
MD5:AB65E866ABC51F841465D19ABA35FB14
SHA256:2AC0CA4FFDA10B1861DD4AE0C2F0131A6400214CB4F5FA33951F3062B784A755
7212WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Win7Recovery.exe(3).4228.dmpbinary
MD5:D6128BC2E79233A7E9B3FB40ABD43BD9
SHA256:4085A9F1EAFA969D74E3A7D21BF444E0B35F36CA55B5A538DF0B647F43C7FDC5
7916WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Win7Recovery.exe_9dd45c4f139e719c1a23a561e155bb969b627f_0681e3c8_17d5e5e8-1135-4eb5-8cec-790db648dbab\Report.wer —
MD5:—
SHA256:—
1812WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Win7Recovery.exe.4228.dmpbinary
MD5:9901966ED90D53DF4A7F61154762EDE1
SHA256:1F60EB0AFAC14A34009041B7845DF8B6B472B1B51F1D65830B11C9A5E1A62916
1812WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6F7B.tmp.dmpbinary
MD5:E8E3C67C0065DBAF71541EAA9C9C77EF
SHA256:348E9CB22744E20195D62563306DF1AA08F58B95FFD2CF0B3E885FE83BCF9E0C
4228Win7Recovery.exeC:\ProgramData\WbVhxCIDDK.exeexecutable
MD5:AB65E866ABC51F841465D19ABA35FB14
SHA256:2AC0CA4FFDA10B1861DD4AE0C2F0131A6400214CB4F5FA33951F3062B784A755
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
30
DNS requests
32
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7576
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7576
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4228
Win7Recovery.exe
GET
200
3.33.130.190:80
http://clickfer.org/pica1/531-direct
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6068
pwsh.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6068
pwsh.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
8032
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4616
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.42
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.140
  • 20.190.160.66
  • 20.190.160.131
  • 40.126.32.76
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.132
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
searchalice.org
  • —
unknown

Threats

PID
Process
Class
Message
4228
Win7Recovery.exe
A Network Trojan was detected
ET USER_AGENTS Long Fake wget 3.0 User-Agent Detected
4228
Win7Recovery.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Fake Wget User-Agent (wget 3.0) - Likely Hostile
6068
pwsh.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Win7Recovery.zip