File name:

Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.7z

Full analysis: https://app.any.run/tasks/0385c06b-aedc-48b0-8764-dc1d06336a82
Verdict: Malicious activity
Analysis date: April 10, 2025, 19:56:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

A802D41BF1A6FC9EF5B175158C00633F

SHA1:

4DB09F772283630B995A09B89171D7F90B082DA1

SHA256:

EE4804F434782EB190D7DD60C7CF84EDD7566776211336BA17E342FF4E08D374

SSDEEP:

24576:L/ZCvy8vdj1u/o4jlrZnuxu7MZl1jlYQa/iCddHROF/8iTiV1v9HyD/8gqk5E9q5:L/cvy8vp1Wo4jlrZnuxu7MZl1jlYQa/O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 3884)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 8076)
      • taskkill.exe (PID: 7632)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)

    • Reads security settings of Internet Explorer

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)

    • Creates file in the systems drive root

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)

    • Changes the desktop background image

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)

    • Uses TASKKILL.EXE to kill process

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)
      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7328)

    • Connects to FTP

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)
      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7328)

  • INFO

    • The sample compiled with chinese language support

      • WinRAR.exe (PID: 3884)

    • Checks supported languages

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)
      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7328)

    • The sample compiled with english language support

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)

    • Manual execution by a user

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)
      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7328)
      • mspaint.exe (PID: 7784)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3884)

    • Reads the computer name

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)
      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7328)

    • Checks proxy server information

      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7932)
      • Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe (PID: 7328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2018:10:07 16:29:38+00:00
ArchivedFileName: Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
30
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs trojan-ransom.win32.cryptexe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe taskkill.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs trojan-ransom.win32.cryptexe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs mspaint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3884"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4920taskkill /f /im kavsvc.exeC:\Windows\SysWOW64\taskkill.exe—Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7172taskkill /f /im VsTskMgr.exeC:\Windows\SysWOW64\taskkill.exe—Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7228C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7264"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7328"C:\Users\admin\Desktop\Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe" "C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe"C:\Users\admin\Desktop\Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Barack Obama's Everlasting Blue Blackmail Virus
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.cryptexe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7560taskkill /f /im Ravmon.exeC:\Windows\SysWOW64\taskkill.exe—Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 949
Read events
3 879
Write events
69
Delete events
1

Modification events

(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.7z
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3884) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
3
Suspicious files
113
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
7932Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exe —
MD5:—
SHA256:—
7932Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe —
MD5:—
SHA256:—
7932Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe —
MD5:—
SHA256:—
7932Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe —
MD5:—
SHA256:—
7932Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exeC:\Users\admin\Desktop\1.bmpbinary
MD5:11C9AA3D4595C6AF63594ABAA0C530D4
SHA256:AFDEACA6E9979C21AB3E5A69DBCBF889D07E58733CD993F275750B6DB05123BE
3884WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3884.31892\Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exeexecutable
MD5:16D202AAC28076F3C4C1BEC60F356F7B
SHA256:0CD7440CA94D31212E21867439F38F0828823B76C94D566E81F5DFAF71574EBC
7932Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exeC:\Windows\ME\ÃÎ÷ÊÄ£¿é.icoimage
MD5:C1F9552D7628142E9D0E5C9C3267A98F
SHA256:AA709A476A4A1549DDD5FF1088B57098B6428C16953AD156980CF097182CA230
7932Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exebinary
MD5:CC90CBE9BC87C769D7C538B93E3F86F8
SHA256:7D5CE0B2DEDC49646E362B96FB323854E866A8A59C1C24782D1C8E18ABE79DC6
7932Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exebinary
MD5:A1A0CA0E475E07DC2FC640D0B34EB1B5
SHA256:3DEFB5C9F8F181A738C9DDF6E35311847D8171A9528190254C088BA06EEDEFF8
7932Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.exeC:\Windows\ME\ÃÎ÷ÊÔ´Âë.icoimage
MD5:64DA46B04886AC5B67D66E70B7A9B3BD
SHA256:719F82BE101130B70F9DF2A891EEC19FEDFE177A79658E2A752DC1BE4A648332
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
21
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
104.124.11.17:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7356
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7356
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.124.11.17:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4628
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 104.124.11.17
  • 104.124.11.58
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.74
  • 20.190.160.131
  • 20.190.160.66
  • 20.190.160.65
  • 20.190.160.128
  • 20.190.160.14
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
ftp.free3v.net
  • 89.116.111.74
unknown
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.CryptExe.b-0cd7440ca94d31212e21867439f38f0828823b76c94d566e81f5dfaf71574ebc.7z