File name:

Outstanding swift APRIL 2025.exe

Full analysis: https://app.any.run/tasks/57d19c37-e240-4604-be35-f002903d9573
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 14:10:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
stealer
auto-reg
exfiltration
agenttesla
smtp
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

3F571326790F2629B745DEA60F2F8041

SHA1:

9CA4D1CE833D026C78BA0289FD0BEBCD0926B0CD

SHA256:

1D2329FA77EAA5B902B3A729363FD39D584088189BFE24DB7651CE778575CB3D

SSDEEP:

24576:l93v5IKLnsqFQzWkx5056okJSkzuy7PdPUujVH7EebJSp7kcvuBFELLMsQ1gQ:l93v5IKLnsqFsWkx5056okJSouy7PdPB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Outstanding swift APRIL 2025.exe (PID: 6032)

    • Uses Task Scheduler to run other applications

      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • NcnBt.exe (PID: 5304)

    • Actions looks like stealing of personal data

      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • NcnBt.exe (PID: 6068)

    • AGENTTESLA has been detected (YARA)

      • Outstanding swift APRIL 2025.exe (PID: 6032)

    • Steals credentials from Web Browsers

      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • NcnBt.exe (PID: 6068)

    • AGENTTESLA has been detected (SURICATA)

      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • NcnBt.exe (PID: 6068)

  • SUSPICIOUS

    • Application launched itself

      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • NcnBt.exe (PID: 5304)

    • Executable content was dropped or overwritten

      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • Outstanding swift APRIL 2025.exe (PID: 6032)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • NcnBt.exe (PID: 6068)

    • Reads security settings of Internet Explorer

      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • NcnBt.exe (PID: 5304)

    • Connects to SMTP port

      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • NcnBt.exe (PID: 6068)

  • INFO

    • Reads the machine GUID from the registry

      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • NcnBt.exe (PID: 5304)
      • NcnBt.exe (PID: 6068)

    • Reads the computer name

      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • NcnBt.exe (PID: 5304)
      • NcnBt.exe (PID: 6068)

    • Checks proxy server information

      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • NcnBt.exe (PID: 6068)

    • Create files in a temporary directory

      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • NcnBt.exe (PID: 5304)

    • Reads the software policy settings

      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • NcnBt.exe (PID: 6068)
      • slui.exe (PID: 4844)

    • Creates files or folders in the user directory

      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • Outstanding swift APRIL 2025.exe (PID: 6032)

    • Checks supported languages

      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • NcnBt.exe (PID: 5304)
      • NcnBt.exe (PID: 6068)

    • Process checks computer location settings

      • Outstanding swift APRIL 2025.exe (PID: 5756)
      • NcnBt.exe (PID: 5304)

    • Disables trace logs

      • Outstanding swift APRIL 2025.exe (PID: 6032)
      • NcnBt.exe (PID: 6068)

    • Manual execution by a user

      • NcnBt.exe (PID: 5304)

    • Auto-launch of the file from Registry key

      • Outstanding swift APRIL 2025.exe (PID: 6032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AgentTesla

(PID) Process(6032) Outstanding swift APRIL 2025.exe
Protocolsmtp
Hostmail.jollytour.ro
Port587
Usernamerezervari@jollytour.ro
PasswordCANON4555
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr | Windows screen saver (12.9)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)
.exe | Generic Win/DOS Executable (1.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2077:04:26 21:17:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 808448
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xc73d6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: HP Inc.
FileDescription: Sgm_Student_Information
FileVersion: 1.0.0.0
InternalName: fvlA.exe
LegalCopyright: Copyright © HP Inc. 2023
LegalTrademarks: -
OriginalFileName: fvlA.exe
ProductName: Sgm_Student_Information
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
12
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outstanding swift april 2025.exe sppextcomobj.exe no specs slui.exe schtasks.exe no specs conhost.exe no specs #AGENTTESLA outstanding swift april 2025.exe svchost.exe ncnbt.exe no specs schtasks.exe no specs conhost.exe no specs #AGENTTESLA ncnbt.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4844"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5304C:\Users\admin\AppData\Roaming\NcnBt\NcnBt.exeC:\Users\admin\AppData\Roaming\NcnBt\NcnBt.exe—explorer.exe
User:
admin
Company:
HP Inc.
Integrity Level:
MEDIUM
Description:
Sgm_Student_Information
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\ncnbt\ncnbt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5680"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xWnrZxhm" /XML "C:\Users\admin\AppData\Local\Temp\tmp87F9.tmp"C:\Windows\SysWOW64\schtasks.exe—NcnBt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5756"C:\Users\admin\AppData\Local\Temp\Outstanding swift APRIL 2025.exe" C:\Users\admin\AppData\Local\Temp\Outstanding swift APRIL 2025.exe
explorer.exe
User:
admin
Company:
HP Inc.
Integrity Level:
MEDIUM
Description:
Sgm_Student_Information
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\outstanding swift april 2025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6032"C:\Users\admin\AppData\Local\Temp\Outstanding swift APRIL 2025.exe"C:\Users\admin\AppData\Local\Temp\Outstanding swift APRIL 2025.exe
Outstanding swift APRIL 2025.exe
User:
admin
Company:
HP Inc.
Integrity Level:
MEDIUM
Description:
Sgm_Student_Information
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\outstanding swift april 2025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AgentTesla
(PID) Process(6032) Outstanding swift APRIL 2025.exe
Protocolsmtp
Hostmail.jollytour.ro
Port587
Usernamerezervari@jollytour.ro
PasswordCANON4555
6068"C:\Users\admin\AppData\Roaming\NcnBt\NcnBt.exe"C:\Users\admin\AppData\Roaming\NcnBt\NcnBt.exe
NcnBt.exe
User:
admin
Company:
HP Inc.
Integrity Level:
MEDIUM
Description:
Sgm_Student_Information
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\ncnbt\ncnbt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
3 713
Read events
3 683
Write events
30
Delete events
0

Modification events

(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6032) Outstanding swift APRIL 2025.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Outstanding swift APRIL 2025_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
5756Outstanding swift APRIL 2025.exeC:\Users\admin\AppData\Local\Temp\tmp37C6.tmpxml
MD5:82D12FD9CDDD52BC4930A1CFB16217D0
SHA256:04C8F4C2F2C769A37C0E2FB4D94021D8E0125862FD2B22463D811DC65AAF88A6
5756Outstanding swift APRIL 2025.exeC:\Users\admin\AppData\Roaming\xWnrZxhm.exeexecutable
MD5:3F571326790F2629B745DEA60F2F8041
SHA256:1D2329FA77EAA5B902B3A729363FD39D584088189BFE24DB7651CE778575CB3D
5304NcnBt.exeC:\Users\admin\AppData\Local\Temp\tmp87F9.tmpxml
MD5:82D12FD9CDDD52BC4930A1CFB16217D0
SHA256:04C8F4C2F2C769A37C0E2FB4D94021D8E0125862FD2B22463D811DC65AAF88A6
6032Outstanding swift APRIL 2025.exeC:\Users\admin\AppData\Roaming\NcnBt\NcnBt.exeexecutable
MD5:3F571326790F2629B745DEA60F2F8041
SHA256:1D2329FA77EAA5B902B3A729363FD39D584088189BFE24DB7651CE778575CB3D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
28
DNS requests
17
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.197.137:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.197.137:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5556
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6032
Outstanding swift APRIL 2025.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
6068
NcnBt.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
52.183.220.149:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.197.137:80
www.microsoft.com
CW Vodafone Group PLC
GB
whitelisted
—
—
2.23.197.137:80
www.microsoft.com
CW Vodafone Group PLC
GB
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 52.183.220.149
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.36
  • 23.216.77.6
  • 23.216.77.29
  • 23.216.77.19
whitelisted
www.microsoft.com
  • 2.23.197.137
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.71
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.131
  • 40.126.31.128
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
api.ipify.org
  • 104.26.12.205
  • 172.67.74.152
  • 104.26.13.205
shared
ip-api.com
  • 208.95.112.1
whitelisted
mail.jollytour.ro
  • 89.42.218.12
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6032
Outstanding swift APRIL 2025.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
6032
Outstanding swift APRIL 2025.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6032
Outstanding swift APRIL 2025.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6032
Outstanding swift APRIL 2025.exe
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
6068
NcnBt.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
6068
NcnBt.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6068
NcnBt.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Outstanding swift APRIL 2025.exe