File name:

VIRUS.zip

Full analysis: https://app.any.run/tasks/b52024b1-819d-4454-8e5a-ce85c4b77d22
Verdict: Malicious activity
Analysis date: May 27, 2025, 20:05:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
tofsee
xmrig
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E83FFB89CE3EF6682A0B97B5E6036A8F

SHA1:

4468C49570B7BCF3636407772ED346667468A4F4

SHA256:

F79CFB7975EA7DD18731F84A4940D20F743EA1A27DDA1ED9DC9126F694B5EF09

SSDEEP:

24576:U30raY1cGGMkQwVIAtkM8jLm4GVbDLtoHPXQK36oRozZ7HLnlZ4rlt4/8PK:U30raYaGGCwV3tkM8jLm4GVbDLtoHPXe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe (PID: 8000)
      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)

    • TOFSEE has been detected (YARA)

      • svchost.exe (PID: 8152)

    • XMRIG has been detected (YARA)

      • taskhost.exe (PID: 4428)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 8152)

    • Reads security settings of Internet Explorer

      • ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe (PID: 8000)

    • The process creates files with name similar to system file names

      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)

    • Executable content was dropped or overwritten

      • ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe (PID: 8000)
      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)

    • Connects to SMTP port

      • svchost.exe (PID: 8152)

    • Starts itself from another location

      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)

    • Executes application which crashes

      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 5200)
      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5200)

    • Manual execution by a user

      • ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe (PID: 8000)
      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)

    • Create files in a temporary directory

      • ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe (PID: 8000)

    • Checks supported languages

      • ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe (PID: 8000)
      • ehrxepiy.exe (PID: 8120)
      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)
      • taskhost.exe (PID: 4428)

    • Reads the computer name

      • ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe (PID: 8000)
      • ehrxepiy.exe (PID: 8120)
      • taskhost.exe (PID: 4428)

    • Process checks computer location settings

      • ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe (PID: 8000)

    • Launch of the file from Registry key

      • ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe (PID: 8000)
      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)

    • Creates files or folders in the user directory

      • cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe (PID: 4812)
      • WerFault.exe (PID: 6740)

    • Reads the software policy settings

      • slui.exe (PID: 7236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0003
ZipCompression: Deflated
ZipModifyDate: 2018:01:30 05:06:36
ZipCRC: 0x5311ae4a
ZipCompressedSize: 98285
ZipUncompressedSize: 145920
ZipFileName: ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe wusa.exe no specs wusa.exe ehrxepiy.exe no specs #TOFSEE svchost.exe cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe #XMRIG taskhost.exe no specs werfault.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1188C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4428"C:\Users\admin\AppData\Roaming\Microsoft\Windows\CPU\taskhost.exe"C:\Users\admin\AppData\Roaming\Microsoft\Windows\CPU\taskhost.exe
cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\cpu\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\setupapi.dll
4812"C:\Users\admin\Desktop\ext\cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe" C:\Users\admin\Desktop\ext\cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\ext\cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\setupapi.dll
5200"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\VIRUS.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6740C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4812 -s 464C:\Windows\SysWOW64\WerFault.exe—cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7204C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7236"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7724C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
8000"C:\Users\admin\Desktop\ext\ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe" C:\Users\admin\Desktop\ext\ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\ext\ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\cfgmgr32.dll
8048"C:\Windows\System32\wusa.exe" C:\Windows\SysWOW64\wusa.exe—ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
5 198
Read events
5 186
Write events
12
Delete events
0

Modification events

(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\VIRUS.zip
(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop\ext
(PID) Process:(5200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
5
Suspicious files
0
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
6740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cd525f51a1bcef4c_9c1c36b4a8d3afa83ded6675d61d0f45343c05d_fc956c9e_f367364c-3403-4562-8ae3-fd1638dce092\Report.wer —
MD5:—
SHA256:—
6740WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exe.4812.dmpdmp
MD5:2C4B812569E29F48ED3F86AD693097A8
SHA256:2E780C38508DFBA9B35C09586B40D0F46D7229C5A0ADBF6A7F7C2FFF9C39EEEC
8000ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exeC:\Users\admin\ehrxepiy.exeexecutable
MD5:7A6B00EDA1A9924D533AF1980903B3BF
SHA256:4B74FAA8D490389BF38340B27EA9A2FCB8DA6DAD3A1797AFD254D8294AE704A3
6740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7E65.tmp.WERInternalMetadata.xmlxml
MD5:EA1E42CC22D2DF08A7723F2D916469C1
SHA256:50142858AB2662F8E196C90CD4020B7AFD42A2E79BFDADB3ACF9DB46FB36D1DD
4812cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651cc.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\CPU\taskhost.exeexecutable
MD5:D7EE3402B3E0C614E2210C55B1CFDD96
SHA256:CD525F51A1BCEF4C9C8B60F42525008F83A3042A2E218C487EA8B0C6B7E651CC
6740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7DF7.tmp.dmpdmp
MD5:F054F4105F09DC90B803867964EDF22A
SHA256:18294C09FE76EA34D5734839C6EAE27A95916BF101FC72BDA4F24D7D861B7839
5200WinRAR.exeC:\Users\admin\Desktop\ext\cd525f51a1bcef4c9c8b60f42525008f83a3042a2e218c487ea8b0c6b7e651ccexecutable
MD5:D7EE3402B3E0C614E2210C55B1CFDD96
SHA256:CD525F51A1BCEF4C9C8B60F42525008F83A3042A2E218C487EA8B0C6B7E651CC
5200WinRAR.exeC:\Users\admin\Desktop\ext\ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152dexecutable
MD5:A118AEB7A4E96BB3E89F32CBB03A9A61
SHA256:CA97B6DE0314A5977D89A76C62561F7D9F77DDBA5DB6814E6F0EE1877AA6152D
8000ca97b6de0314a5977d89a76c62561f7d9f77ddba5db6814e6f0ee1877aa6152d.exeC:\Users\admin\AppData\Local\Temp\cblcwujv.exeexecutable
MD5:D38F984C0B46F069C2DCF9B7B3A77EA1
SHA256:6974B11257FCC6C6FC21F8CA4720187F2CC0770803A156BD6EAA8FBB7CD8B464
6740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7E95.tmp.xmlxml
MD5:FAD86C96CAE66DF5A9C43BE0AEA26523
SHA256:04697CEE11E477ADA0AE1C46BFBE0B2FBFFCBEBF35BF65E047CC437A43879395
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7848
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7848
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 2.16.253.202
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.2
  • 20.190.160.131
  • 20.190.160.130
  • 20.190.160.22
  • 40.126.32.72
  • 20.190.160.17
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
microsoft.com
  • 13.107.253.67
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VIRUS.zip