File name:

darkbitRansomware.7z

Full analysis: https://app.any.run/tasks/e8a4e8b4-b7a7-4c1e-8d1d-8eceec39c050
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 23, 2025, 17:46:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
golang
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

79789168113E0CD3A66B9F409246ECEA

SHA1:

2F619F464162E9370CAA3AAB97EE28E42A25BC71

SHA256:

F5BB2336D09E06FCE0F0CA9E4D8EC9B2DD40AE5B57BF74348F72175405222DDC

SSDEEP:

49152:Duzwtab1p+juiekRH2b1h7fRjI0XlFuHxFgpEvUnVFVP98NFaoPSJ1Rwe+mVs48E:DuzwtapEjjH8h1rXlgHkpksFVBRR364n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Deletes shadow copies

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 6808)
      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Steals credentials from Web Browsers

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Create files in the Startup directory

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Actions looks like stealing of personal data

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Modifies files in the Chrome extension folder

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6572)

    • Process drops legitimate windows executable

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Likely accesses (executes) a file from the Public directory

      • notepad.exe (PID: 780)
      • notepad.exe (PID: 732)

    • Executable content was dropped or overwritten

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6644)

    • Manual execution by a user

      • WinRAR.exe (PID: 6644)
      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 6808)
      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)
      • notepad.exe (PID: 732)
      • mspaint.exe (PID: 6640)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 6808)
      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Checks supported languages

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 6808)
      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Reads the software policy settings

      • slui.exe (PID: 5988)
      • slui.exe (PID: 6156)

    • Application based on Golang

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Creates files or folders in the user directory

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 732)

    • Checks proxy server information

      • slui.exe (PID: 6156)

    • The sample compiled with english language support

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • The sample compiled with chinese language support

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • Reads the computer name

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)

    • The sample compiled with portuguese language support

      • 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe (PID: 208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
18
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe winrar.exe 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe no specs conhost.exe no specs vssadmin.exe no specs 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs slui.exe notepad.exe no specs rundll32.exe no specs mspaint.exe no specs openwith.exe no specs notepad.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Users\admin\Desktop\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe" C:\Users\admin\Desktop\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
668vssadmin.exe delete shadows /all /QuietC:\Windows\System32\vssadmin.exe—9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
732"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\RECOVERY_DARKBIT.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
780"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\8aKQcziI1748022496.DarkbitC:\Windows\System32\notepad.exe—OpenWith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3884C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4788"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\combase.dll
5324C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5380"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\darkbitRansomware.7zC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
21 648
Read events
21 377
Write events
232
Delete events
39

Modification events

(PID) Process:(5380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000004403040000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(5380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F0000000000000000000000000000000000000000000480304000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(5380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F0000000000000000000000000000000000000000000EA0208000000000000000000180000006400000000000000000000000000000003000000
(PID) Process:(6644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6644) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
Executable files
286
Suspicious files
7 561
Text files
4 687
Unknown types
1

Dropped files

PID
Process
Filename
Type
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\Administrator\AppData\Local\Microsoft\Credentials\O1546Rxo1748022485.Darkbitbinary
MD5:18480308283719E668BA650536046AE3
SHA256:968371210EFF32EAF63CF88A2CF3D4F1878BA10B470B114A2997045C54DF11B9
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\Administrator\AppData\Local\ConnectedDevicesPlatform\RECOVERY_DARKBIT.txttext
MD5:96105B566C113B7A0248EEAD1E9E0344
SHA256:FCA050431BA94630D691A7D6CBDD491354C69F738B0D8E03B531173A741AD286
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\Administrator\AppData\Local\Microsoft\InstallAgent\RECOVERY_DARKBIT.txttext
MD5:96105B566C113B7A0248EEAD1E9E0344
SHA256:FCA050431BA94630D691A7D6CBDD491354C69F738B0D8E03B531173A741AD286
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\Administrator\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\RECOVERY_DARKBIT.txttext
MD5:96105B566C113B7A0248EEAD1E9E0344
SHA256:FCA050431BA94630D691A7D6CBDD491354C69F738B0D8E03B531173A741AD286
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\Administrator\AppData\Local\RECOVERY_DARKBIT.txttext
MD5:96105B566C113B7A0248EEAD1E9E0344
SHA256:FCA050431BA94630D691A7D6CBDD491354C69F738B0D8E03B531173A741AD286
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\RECOVERY_DARKBIT.txttext
MD5:96105B566C113B7A0248EEAD1E9E0344
SHA256:FCA050431BA94630D691A7D6CBDD491354C69F738B0D8E03B531173A741AD286
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\Administrator\RECOVERY_DARKBIT.txttext
MD5:96105B566C113B7A0248EEAD1E9E0344
SHA256:FCA050431BA94630D691A7D6CBDD491354C69F738B0D8E03B531173A741AD286
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\Administrator\AppData\Local\Microsoft\InputPersonalization\RECOVERY_DARKBIT.txttext
MD5:96105B566C113B7A0248EEAD1E9E0344
SHA256:FCA050431BA94630D691A7D6CBDD491354C69F738B0D8E03B531173A741AD286
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\Administrator\AppData\RECOVERY_DARKBIT.txttext
MD5:96105B566C113B7A0248EEAD1E9E0344
SHA256:FCA050431BA94630D691A7D6CBDD491354C69F738B0D8E03B531173A741AD286
2089107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exeC:\Users\Administrator\AppData\Local\Microsoft\RECOVERY_DARKBIT.txttext
MD5:96105B566C113B7A0248EEAD1E9E0344
SHA256:FCA050431BA94630D691A7D6CBDD491354C69F738B0D8E03B531173A741AD286
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
48
DNS requests
17
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5728
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5728
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5988
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.174
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.130
  • 20.190.159.2
  • 40.126.31.3
  • 40.126.31.129
  • 40.126.31.1
  • 40.126.31.2
  • 20.190.159.71
  • 20.190.160.17
  • 40.126.32.136
  • 20.190.160.64
  • 20.190.160.67
  • 20.190.160.132
  • 20.190.160.14
  • 20.190.160.2
  • 20.190.160.22
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2603:1030:c02:2::284
whitelisted
15.164.165.52.in-addr.arpa
  • —
unknown
4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
darkbitRansomware.7z