download:

/attachments/1378827527958564884/1378827528197898361/RC7_Remake.zip

Full analysis: https://app.any.run/tasks/a981140a-2e2d-4341-a215-89dd2bb5ed37
Verdict: Malicious activity
Analysis date: June 13, 2025, 13:01:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
arch-doc
arch-html
confuser
discord
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

34EDEDECB4BBD17446D8EE64BBA979E4

SHA1:

DF7B8CB75A0EA6DD8BE29D7DBBF78DD1142D59ED

SHA256:

F6F193EC2FBCFD4E6DD443592AAF1F9FE240C248AD57303FA54928F08FF02F45

SSDEEP:

98304:2I114ZkDjUqVJhoOisF5QBc8lcqo7DuWjiE6vJMkOk9GFD7RabcD+cH46V5xl7UJ:bEtVjMpr1KPt1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6268)

  • SUSPICIOUS

    • Reads the BIOS version

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 2972)
      • RC7.exe (PID: 4920)

    • Read disk information to detect sandboxing environments

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 2972)
      • RC7.exe (PID: 4920)

    • The process checks if it is being run in the virtual environment

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 2972)
      • RC7.exe (PID: 4920)

    • There is functionality for taking screenshot (YARA)

      • RC7.exe (PID: 5184)

    • Reads security settings of Internet Explorer

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 4920)

    • Executable content was dropped or overwritten

      • RC7.exe (PID: 5184)

    • Executes application which crashes

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 2972)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4116)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4116)
      • RC7.exe (PID: 5184)

    • Manual execution by a user

      • RC7.exe (PID: 5184)
      • WinRAR.exe (PID: 4116)
      • RC7.exe (PID: 2972)
      • RC7.exe (PID: 4920)

    • Checks supported languages

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 2972)
      • RC7.exe (PID: 4920)

    • Reads the machine GUID from the registry

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 2972)
      • RC7.exe (PID: 4920)

    • Reads the computer name

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 2972)
      • RC7.exe (PID: 4920)

    • Reads Environment values

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 2972)
      • RC7.exe (PID: 4920)

    • Disables trace logs

      • RC7.exe (PID: 5184)

    • Confuser has been detected (YARA)

      • RC7.exe (PID: 5184)
      • RC7.exe (PID: 2972)

    • Checks proxy server information

      • RC7.exe (PID: 5184)
      • WerFault.exe (PID: 2536)
      • WerFault.exe (PID: 7040)
      • slui.exe (PID: 4120)

    • Reads the software policy settings

      • RC7.exe (PID: 5184)
      • WerFault.exe (PID: 2536)
      • WerFault.exe (PID: 7040)
      • slui.exe (PID: 4120)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 2536)
      • WerFault.exe (PID: 7040)

    • Attempting to use instant messaging service

      • msedge.exe (PID: 5952)

    • Application launched itself

      • msedge.exe (PID: 3884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (36.3)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:12:19 22:33:20
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: autoexec/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
22
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe rundll32.exe no specs rc7.exe svchost.exe slui.exe werfault.exe rc7.exe werfault.exe rc7.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4272,i,6281404578922323868,12606856483420455506,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
620"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3636,i,6281404578922323868,12606856483420455506,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1212"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5276,i,6281404578922323868,12606856483420455506,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2044"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x304,0x308,0x30c,0x2fc,0x314,0x7ffc4076f208,0x7ffc4076f214,0x7ffc4076f220C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2536C:\WINDOWS\system32\WerFault.exe -u -p 5184 -s 4776C:\Windows\System32\WerFault.exe
RC7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
2972"C:\Users\admin\Desktop\RC7_Remake\RC7.exe" C:\Users\admin\Desktop\RC7_Remake\RC7.exe
explorer.exe
User:
admin
Company:
Krystal Team Revival
Integrity Level:
MEDIUM
Description:
RC7 Remake
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\rc7_remake\rc7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3196"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5268,i,6281404578922323868,12606856483420455506,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3488"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2800,i,6281404578922323868,12606856483420455506,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3884"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/qCKx9f8ya7C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—RC7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
33 131
Read events
33 035
Write events
94
Delete events
2

Modification events

(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\RC7_Remake.zip
(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6268) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
14
Suspicious files
174
Text files
62
Unknown types
43

Dropped files

PID
Process
Filename
Type
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\bin\sounds\startup\Startup.wavwav
MD5:1DA14882ABFD603A16A7A677362E808D
SHA256:2CDFF48C829932FD03794528CA68CDC29B5B7FEC7C2E7A0CD91A5225EBEA2F35
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\Monaco\vs\base\worker\workerMain.jss
MD5:27EAD90C7702154755785E0E53398755
SHA256:BDF9433692A08851E13DD58504EEF19F51BD2EC7241923A68EDF5772E0E53AF5
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\Monaco\vs\basic-languages\fsharp\fsharp.jsbinary
MD5:DE122B3BC44A8714F386DC80282DCB12
SHA256:1390079BABC117D3F376735780D98F409F317EB4628D17106642C6933EA1DA7F
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\Monaco\vs\basic-languages\css\css.jsbinary
MD5:49AD30F1151CFD7A74677FDC6DD13DA9
SHA256:BD331FD3BD2C37B0C3150035325F163AC9266BF6D942310764815E676D856D91
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\Monaco\vs\basic-languages\coffee\coffee.jsbinary
MD5:9D0C4AC1691EED0A480C3E9246490D29
SHA256:E706C9F8E5C5A0CB01B2F4E4879EC34A050D6EB2A8840284EB7BADD9D78099F9
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\Monaco\vs\basic-languages\csharp\csharp.jsbinary
MD5:F8F841D13C9220E15DCD6BC386B37BA2
SHA256:6B3BE9A86EE8E3202F51745D94D24CC1EEFBCF7D9E6D94FBAF70146B084E835F
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\Monaco\vs\basic-languages\csp\csp.jss
MD5:22ADA25D590811DCFF4E5F5D698E583B
SHA256:4B5A5D7D50986B86B00833447E097C0F01A4388CE1765B48E7E371D06E3A4789
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\Monaco\vs\basic-languages\cpp\cpp.jsbinary
MD5:0A16509E6CD0155FB622E785CFE976C7
SHA256:A7C2BEA7CA3D9E203A3A286735945FE010C8F4F8D46620386EE8BEFC6A78B32B
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\Monaco\index.htmlhtml
MD5:B867A373E2082F0D800D1561EEA8DB21
SHA256:10B8551148FEF60A1FA1C65F9EF38E4E8275ECF592B0EC6C873A41BBF37544CE
4116WinRAR.exeC:\Users\admin\Desktop\RC7_Remake\bin\AntiSkidDLL.dllexecutable
MD5:87294AA0912182EC94F9341FBFA73A6C
SHA256:69E962D9EA9A55F629D1D2F050D5C70889ECB86C79988AAFBE976903F4E96ED7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
80
TCP/UDP connections
59
DNS requests
28
Threats
63

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
302
140.82.121.3:443
https://github.com/CloudyExecugor/frontend/releases/download/reareaaaa/Cloudy.dll
unknown
—
—
—
—
—
GET
302
140.82.121.3:443
https://github.com/CloudyExecugor/frontend/releases/download/reareaaaa/libcrypto-3-x64.dll
unknown
—
—
—
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
GET
302
140.82.121.3:443
https://github.com/CloudyExecugor/frontend/releases/download/reareaaaa/libssl-3-x64.dll
unknown
—
—
—
—
—
GET
302
140.82.121.3:443
https://github.com/CloudyExecugor/frontend/releases/download/reareaaaa/xxhash.dll
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
keyauth.win
  • 104.26.0.5
  • 104.26.1.5
  • 172.67.72.57
malicious
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
github.com
  • 140.82.121.3
whitelisted
objects.githubusercontent.com
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.108.133
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.21
  • 104.208.16.94
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain in DNS Lookup (keyauth .win)
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/attachments/1378827527958564884/1378827528197898361/RC7_Remake.zip