File name:

43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.zip

Full analysis: https://app.any.run/tasks/363f8f1f-0415-4324-bed7-6cd59ae8ea59
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 25, 2025, 07:24:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
expiro
arch-exec
m0yv
sinkhole
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

1C4430CC241E588F267DC2CF0770305A

SHA1:

6E2C24A0BA382B8711A6B5CA6A04ECE6B105F9CE

SHA256:

F34835BC26FF180201A52E622E7A514DB3708FE9A5C2ABEC470714A52B94FF7E

SSDEEP:

24576:qPClxvcZNBt93Jplqz+h4IK3W+LMfdQk1WiZCDm5Cp3I4Tvdp8VFQe2wCx1Nsv:qPClxvcZNBt93Jplo+h4IK3W+LMFQk1t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1452)

    • EXPIRO has been found (auto)

      • WinRAR.exe (PID: 1452)
      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • M0YV mutex has been found

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • RANSOMWARE has been detected

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Request for a sinkholed resource

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • M0YV has been detected (YARA)

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Renames files like ransomware

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Drops known malicious image

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Executable content was dropped or overwritten

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Detected use of alternative data streams (AltDS)

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Creates file in the systems drive root

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

  • INFO

    • Manual execution by a user

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)
      • notepad.exe (PID: 4300)

    • Checks supported languages

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1452)

    • Reads the computer name

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Creates files or folders in the user directory

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • The sample compiled with english language support

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Creates files in the program directory

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Checks proxy server information

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • Create files in a temporary directory

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)

    • The sample compiled with portuguese language support

      • 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe (PID: 5024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (99.9)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:04:01 18:47:36
ZipCRC: 0x87f238db
ZipCompressedSize: 620048
ZipUncompressedSize: 631808
ZipFileName: 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #EXPIRO winrar.exe sppextcomobj.exe no specs slui.exe #M0YV 43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe svchost.exe rundll32.exe no specs slui.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1452"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2140C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4300"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Restore-My-Files.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5024"C:\Users\admin\Desktop\43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe" C:\Users\admin\Desktop\43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5344"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5548C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6656C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 577
Read events
2 559
Write events
18
Delete events
0

Modification events

(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.zip
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(1452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
123
Suspicious files
1 190
Text files
1 334
Unknown types
0

Dropped files

PID
Process
Filename
Type
502443b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeexecutable
MD5:A591FE1854510379DDB7A89F8AD99C02
SHA256:5A17B8DBCB017A292474D2E86A179D2E2C912E38ADDA2DA121F3CD3591D69D1E
502443b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exeexecutable
MD5:B059573F646769CDC0BE0AFD02AB7DBB
SHA256:D3B267F8E5B44B30A57722709290BF931ACB9B71E10555E36E0D8A8CF22C4793
502443b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeexecutable
MD5:D099F03362BFC062C4C4E13438240CF2
SHA256:2D6DAF0B7DC3A0DFC5902D598A6A4832F8A635D48BC847189993797935122E04
1452WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1452.17553\43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeexecutable
MD5:F828044C91AC00AFFFCD77B4CE680857
SHA256:43B7927B9F8669BCEE4717A6902F404EB6F6EC05A4BE2D59349400EAABF01AD5
502443b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeC:\Users\admin\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:9E9C3AA3871798D82CF50C4FDF1E856F
SHA256:ECEE2ECFFFEC082AC9E28E926C1B71C38073954C77650BC166A3D4ADE70FFCBC
502443b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeC:\ProgramData\Restore-My-Files.txttext
MD5:74A77BD81FA83B32B595EAFA20C978EC
SHA256:49CC31E84E5F3CF75DE5D5F58F62AC6C43D9DCA726DFC750593129B730A56616
502443b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeC:\ProgramData\Oracle\Restore-My-Files.txttext
MD5:74A77BD81FA83B32B595EAFA20C978EC
SHA256:49CC31E84E5F3CF75DE5D5F58F62AC6C43D9DCA726DFC750593129B730A56616
502443b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeC:\ProgramData\Microsoft OneDrive\Restore-My-Files.txttext
MD5:74A77BD81FA83B32B595EAFA20C978EC
SHA256:49CC31E84E5F3CF75DE5D5F58F62AC6C43D9DCA726DFC750593129B730A56616
502443b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeC:\ProgramData\PLUG\Restore-My-Files.txttext
MD5:74A77BD81FA83B32B595EAFA20C978EC
SHA256:49CC31E84E5F3CF75DE5D5F58F62AC6C43D9DCA726DFC750593129B730A56616
502443b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exeC:\ProgramData\Adobe\Restore-My-Files.txttext
MD5:74A77BD81FA83B32B595EAFA20C978EC
SHA256:49CC31E84E5F3CF75DE5D5F58F62AC6C43D9DCA726DFC750593129B730A56616
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
39
DNS requests
29
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
POST
200
52.11.240.239:80
http://pywolwnvd.biz/rbccp
unknown
—
—
malicious
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
POST
200
52.11.240.239:80
http://cvgrf.biz/utehkbg
unknown
—
—
malicious
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
POST
200
18.234.103.197:80
http://ssbzmoy.biz/iylgc
unknown
—
—
malicious
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
GET
439
91.195.240.19:80
http://www.anpmnmxo.biz/mo
unknown
—
—
unknown
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
POST
200
18.234.103.197:80
http://knjghuig.biz/vjdhng
unknown
—
—
malicious
6044
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6044
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
52.11.240.239:80
pywolwnvd.biz
AMAZON-02
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.48.23.176
  • 23.48.23.140
  • 23.48.23.185
  • 23.48.23.141
  • 23.48.23.193
  • 23.48.23.191
  • 23.48.23.180
  • 23.48.23.177
  • 23.48.23.190
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.128
  • 20.190.159.71
  • 20.190.159.131
  • 20.190.159.128
  • 20.190.159.64
  • 40.126.31.131
  • 20.190.159.75
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
pywolwnvd.biz
  • 52.11.240.239
malicious
ssbzmoy.biz
  • 18.234.103.197
malicious
cvgrf.biz
  • 52.11.240.239
malicious

Threats

PID
Process
Class
Message
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
2196
svchost.exe
A Network Trojan was detected
ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)
5024
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.exe
Misc activity
ET INFO Namecheap URL Forward
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
43b7927b9f8669bcee4717a6902f404eb6f6ec05a4be2d59349400eaabf01ad5.zip