File name:

virus.zip

Full analysis: https://app.any.run/tasks/59d0bfb5-2b39-46c4-8a80-a2b3dbb77b55
Verdict: Malicious activity
Analysis date: June 17, 2025, 14:41:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lua
arch-scr
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

1CC3DE5D0CF0AF0EC8EC159AD0FEDD2D

SHA1:

79E41BF5BCED415804D5FFA853DBC8D232537B59

SHA256:

8E39B32C4FD875B9401ED04927F58861D83EF16F15068C7007693AAC0FD9BCEC

SSDEEP:

98304:l8a1JsAVEYp4syoqVh/bKuG/+BGgPo8cVaQfR1vEQUChxwZt6yqJ3BsXrz:7g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4676)
    • There is functionality for taking screenshot (YARA)

      • vlc.exe (PID: 2368)
    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 4676)
  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 4676)
      • firefox.exe (PID: 1028)
    • Reads the computer name

      • vlc.exe (PID: 2368)
    • Checks supported languages

      • vlc.exe (PID: 2368)
    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 640)
      • notepad.exe (PID: 6304)
      • notepad.exe (PID: 7284)
      • notepad.exe (PID: 7796)
    • The process uses Lua

      • vlc.exe (PID: 2368)
    • Manual execution by a user

      • firefox.exe (PID: 5184)
    • Application launched itself

      • firefox.exe (PID: 5184)
      • firefox.exe (PID: 1028)
    • Checks proxy server information

      • slui.exe (PID: 6892)
    • Reads the software policy settings

      • slui.exe (PID: 6892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: 0x0800
ZipCompression: None
ZipModifyDate: 2025:06:16 15:51:36
ZipCRC: 0x083f5b02
ZipCompressedSize: 1007750
ZipUncompressedSize: 1007750
ZipFileName: TXT......................𖣠......................TXT
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
38
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs vlc.exe notepad.exe no specs notepad.exe no specs slui.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs notepad.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs notepad.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs svchost.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs notepad.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa4676.15539\TXTNNN~1.TXTC:\Windows\System32\notepad.exeWinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1028"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1488"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 39068 -prefMapHandle 5328 -prefMapSize 272997 -jsInitHandle 5332 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5340 -initialChannelId {7515c78d-002d-4381-8298-bde61a1a66de} -parentPid 1028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tabC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1564"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 1976 -prefsLen 36520 -prefMapHandle 1980 -prefMapSize 272997 -ipcHandle 2040 -initialChannelId {e1e19580-ccab-48ca-8f63-fa696b0a6e34} -parentPid 1028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpuC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\bcrypt.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2272"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4320 -prefsLen 39438 -prefMapHandle 6784 -prefMapSize 272997 -jsInitHandle 6828 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 6412 -initialChannelId {a4b32cc0-b04c-4a95-85f3-d72ab9841cd8} -parentPid 1028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tabC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2368"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\admin\AppData\Local\Temp\Rar$DIa4676.13133\MEE78~1.MP3"C:\Program Files\VideoLAN\VLC\vlc.exe
WinRAR.exe
User:
admin
Company:
VideoLAN
Integrity Level:
MEDIUM
Description:
VLC media player
Version:
3.0.11
Modules
Images
c:\program files\videolan\vlc\vlc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\videolan\vlc\libvlc.dll
3584"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 2212 -prefsLen 36520 -prefMapHandle 2216 -prefMapSize 272997 -ipcHandle 2224 -initialChannelId {d73bb9cb-0963-4af0-a8f0-8ddd94dfe286} -parentPid 1028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socketC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\vcruntime140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
3864"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4820 -prefsLen 39149 -prefMapHandle 4816 -prefMapSize 272997 -jsInitHandle 4928 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5396 -initialChannelId {b2505077-d912-4664-9a0e-67489767ea8f} -parentPid 1028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tabC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
3876"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 39438 -prefMapHandle 5788 -prefMapSize 272997 -jsInitHandle 4328 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 6376 -initialChannelId {2c0eb4ed-19a5-4601-afa3-d71b026fa2ac} -parentPid 1028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tabC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
Total events
31 746
Read events
31 728
Write events
18
Delete events
0

Modification events

(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\virus.zip
(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithProgids
Operation:writeName:VLC.mp3
Value:
(PID) Process:(4676) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
Value:
0100000000000000887DC9FC95DFDB01
Executable files
0
Suspicious files
177
Text files
55
Unknown types
151

Dropped files

PID
Process
Filename
Type
2368vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.iniini
MD5:5A1B856C97E5589DBECD4A55775FFF74
SHA256:5FE1D2474BCF41679651013020FA80BC2A7C8D8D26FF6D536AA46B19E74DFBFA
4676WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa4676.15539\TXT.𖣠ᔓᔕᕤᕦИNⵙↀИNⵙꗳ𖣠᳀𖣠𖢌𐧼𐧾ⵔ∶⸭❋ⵔⵔ𐧾❋❋ⵔ❋·𐧾❋❋ⵈ𐧾❋ⵔ𐧾❋∶ⵔⵔⵔ·𐧾ⵔ∶𐧾ⵔ𐧼··𐧾𐧾❋❋⠿𐧼ⵔⵈⵔ⁘⸭𐧾𐧾❋⸭∶∶ⵔ⠿ⵔ⁘◌⁘❋𖣠◦୦◦ⵔ◦୦◦◯◦୦◦ⵔ◦୦◦⠀⠀⠀⠀⠀⠀⠀⚪⠀⠀⠀⠀⠀⠀⠀◦୦◦ⵔ◦୦◦◯◦୦◦ⵔ◦୦◦𖣠❋⁘◌⁘ⵔ⠿ⵔ∶∶⸭❋𐧾𐧾⸭⁘ⵔⵈⵔ𐧼⠿❋❋𐧾𐧾··𐧼ⵔ𐧾∶ⵔ𐧾·ⵔⵔⵔ∶❋𐧾ⵔ❋𐧾ⵈ❋❋𐧾·❋ⵔ❋❋𐧾ⵔⵔ❋⸭∶ⵔ𐧾𐧼𖢌𖣠᳀𖣠ꗳⵙИNↀⵙИNᕤᕦᔓᔕ𖣠.TXTtext
MD5:E3BDCDA2BE77C4033B18F04B8E69206A
SHA256:CA9F62E8CAD76E676D5153D9F53276570C4AADA2D5F091EBD240387C2504C4FF
1028firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4676WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa4676.13133\ԐꟼM.𖣠ᗱᗴᕤᕦᗩᴥᗱᗴᗯᗩ𖣠᳀𖣠𖢌𐧼𐧾ⵔ∶⸭❋ⵔⵔ𐧾❋❋ⵔ❋·𐧾❋❋ⵈ𐧾❋ⵔ𐧾❋∶ⵔⵔⵔ·𐧾ⵔ∶𐧾ⵔ𐧼··𐧾𐧾❋❋⠿𐧼ⵔⵈⵔ⁘⸭𐧾𐧾❋⸭∶∶ⵔ⠿ⵔ⁘◌⁘❋𖣠◦୦◦ⵔ◦୦◦◯◦୦◦ⵔ◦୦◦⠀⠀⠀⠀⠀⠀⠀⚪⠀⠀⠀⠀⠀⠀⠀◦୦◦ⵔ◦୦◦◯◦୦◦ⵔ◦୦◦𖣠❋⁘◌⁘ⵔ⠿ⵔ∶∶⸭❋𐧾𐧾⸭⁘ⵔⵈⵔ𐧼⠿❋❋𐧾𐧾··𐧼ⵔ𐧾∶ⵔ𐧾·ⵔⵔⵔ∶❋𐧾ⵔ❋𐧾ⵈ❋❋𐧾·❋ⵔ❋❋𐧾ⵔⵔ❋⸭∶ⵔ𐧾𐧼𖢌𖣠᳀𖣠ᗩᗯᗱᗴᴥᗩᕤᕦᗱᗴ𖣠.MP3mp3
MD5:5FA0657D2454A823A49F4938EC9E98B1
SHA256:516BED1A8DE8F9F1492F39D114182A9FFF392F972F4D19BB3670E4388AB0A033
2368vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.locktext
MD5:9325214658BFDE150F3BC5F09028B442
SHA256:0EF7C217EEA5838AE4CD54423257704CE7FA194A72D2431E8EDDB21EE6220F29
1028firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:2FD670934FEF0C60E2119BD874AAF470
SHA256:771A7C83CA015BDBC6AB86A7BD9B1D54E40062E28942D311A9178A0FE6433CF2
4676WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa4676.16930\TXT......................𖣠......................TXTtext
MD5:A362B970963B175F0537B08E3CB2F671
SHA256:B2EB8BAC12BBE57D3EF95BEE7A5C115DBCB2E970231FEBB5578A5998BF4CDC21
1028firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
MD5:
SHA256:
1028firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:3134ED3F12E4F4F8643DB90043B0FD7B
SHA256:801A44C013AF2B7976AD8C53CD4C954C5C3EB56DB97BA0705BD3E54B40D525DE
1028firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
62
TCP/UDP connections
199
DNS requests
259
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
2464
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
1760
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
1760
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
1028
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
whitelisted
1028
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
whitelisted
1028
firefox.exe
POST
200
142.250.186.131:80
http://o.pki.goog/s/wr3/FIY
unknown
whitelisted
1028
firefox.exe
POST
200
142.250.186.131:80
http://o.pki.goog/s/wr3/3H4
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:137
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
2464
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2464
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2336
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.181.156
whitelisted
google.com
  • 142.250.185.238
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.3
  • 20.190.160.4
  • 40.126.32.72
  • 20.190.160.65
  • 40.126.32.140
  • 20.190.160.14
  • 20.190.160.2
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.68
  • 20.190.160.130
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
Misc activity
ET INFO Observed DNS Query to vk .com API (api .vk .com)
Misc activity
ET INFO Observed vk .com API Domain (api .vk .com in TLS SNI)
Not Suspicious Traffic
INFO [ANY.RUN] VK Redirect (away .vk .com)
Not Suspicious Traffic
INFO [ANY.RUN] VK Redirect (away .vk .com)
Not Suspicious Traffic
INFO [ANY.RUN] VK Redirect (away .vk .com)
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
Process
Message
vlc.exe
main libvlc debug: Copyright © 1996-2020 the VideoLAN team
vlc.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
vlc.exe
main libvlc debug: revision 3.0.11-0-gdc0c5ced72
vlc.exe
main libvlc debug: using multimedia timers as clock source
vlc.exe
main libvlc debug: VLC media player - 3.0.11 Vetinari
vlc.exe
main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=x86_64-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' 'host_alias=x86_64-w64-mingw32' 'PKG_CONFIG_LIBDIR=/home/jenkins/workspace/vlc-release/windows/vlc-release-win32-x64/contrib/x86_64-w64-mingw32/lib/pkgconfig'
vlc.exe
main libvlc debug: searching plug-in modules
vlc.exe
main libvlc debug: loading plugins cache file C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
vlc.exe
main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
vlc.exe
main libvlc debug: opening config file (C:\Users\admin\AppData\Roaming\vlc\vlcrc)