File name:

MT103 form.lzh

Full analysis: https://app.any.run/tasks/bee344e6-7af2-4c4c-bfc7-fef1e7016dde
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 04:41:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
github
snake
keylogger
evasion
telegram
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

394628C07B82ADA38C0337D556CD0D50

SHA1:

A379559443C1D60EF9D9F03A6BFC108348870DD2

SHA256:

23EF7D67480B2A9D59258DC5B1D26399AE3D1B2A3B51078DFF19BB8359DB49FF

SSDEEP:

24576:nfLs6gMX/oBmcHk2a5KvY7P5l1rbRKOVLJeyYHcIrmhUO0S6Py10yPvmnehulosz:nfLs6gMQBmqk2a5KvQxl1rbRKOVNeyYR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 660)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)

    • Steals credentials from Web Browsers

      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)

    • Actions looks like stealing of personal data

      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 660)
      • MT103 form.exe (PID: 4188)
      • ShellExperienceHost.exe (PID: 4920)
      • MT103 form.exe (PID: 3176)

    • The process creates files with name similar to system file names

      • MT103 form.exe (PID: 4920)
      • MT103 form.exe (PID: 4408)
      • MT103 form.exe (PID: 4572)

    • Executable content was dropped or overwritten

      • MT103 form.exe (PID: 4920)
      • MT103 form.exe (PID: 4408)
      • MT103 form.exe (PID: 4572)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • MT103 form.exe (PID: 4920)
      • MT103 form.exe (PID: 4408)
      • MT103 form.exe (PID: 4572)

    • Application launched itself

      • MT103 form.exe (PID: 4920)
      • MT103 form.exe (PID: 4408)

    • There is functionality for taking screenshot (YARA)

      • MT103 form.exe (PID: 1164)
      • MT103 form.exe (PID: 4920)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)

    • The process verifies whether the antivirus software is installed

      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)

    • Connects to SMTP port

      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)

  • INFO

    • Checks supported languages

      • MT103 form.exe (PID: 4920)
      • MT103 form.exe (PID: 1164)
      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 4408)
      • ShellExperienceHost.exe (PID: 4920)
      • MT103 form.exe (PID: 3176)
      • MT103 form.exe (PID: 4572)

    • Reads the computer name

      • MT103 form.exe (PID: 4920)
      • MT103 form.exe (PID: 1164)
      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 4408)
      • ShellExperienceHost.exe (PID: 4920)
      • MT103 form.exe (PID: 3176)
      • MT103 form.exe (PID: 4572)

    • Create files in a temporary directory

      • MT103 form.exe (PID: 4920)
      • MT103 form.exe (PID: 1164)
      • MT103 form.exe (PID: 4408)
      • MT103 form.exe (PID: 4572)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 660)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 2100)
      • BackgroundTransferHost.exe (PID: 2040)
      • BackgroundTransferHost.exe (PID: 1096)
      • BackgroundTransferHost.exe (PID: 5304)
      • BackgroundTransferHost.exe (PID: 2236)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 2040)
      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 2040)
      • MT103 form.exe (PID: 4188)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 2040)
      • MT103 form.exe (PID: 4188)
      • slui.exe (PID: 5164)
      • MT103 form.exe (PID: 3176)

    • Disables trace logs

      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)

    • Reads the machine GUID from the registry

      • MT103 form.exe (PID: 4188)
      • MT103 form.exe (PID: 3176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 826221
UncompressedSize: 1116899
OperatingSystem: Win32
ArchivedFileName: MT103 form.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
17
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe mt103 form.exe mt103 form.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #SNAKEKEYLOGGER mt103 form.exe svchost.exe slui.exe no specs mt103 form.exe shellexperiencehost.exe no specs #SNAKEKEYLOGGER mt103 form.exe mt103 form.exe

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\MT103 form.lzh.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1096"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1164"C:\Users\admin\AppData\Local\Temp\Rar$EXa660.49251\MT103 form.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa660.49251\MT103 form.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa660.49251\mt103 form.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2040"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2100"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2236"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3176"C:\Users\admin\AppData\Local\Temp\Rar$EXa660.4631\MT103 form.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa660.4631\MT103 form.exe
MT103 form.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\rar$exa660.4631\mt103 form.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
3784C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4188"C:\Users\admin\AppData\Local\Temp\Rar$EXa660.48699\MT103 form.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa660.48699\MT103 form.exe
MT103 form.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\rar$exa660.48699\mt103 form.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
9 430
Read events
9 391
Write events
39
Delete events
0

Modification events

(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MT103 form.lzh.rar
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(660) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2100) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2100) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
7
Suspicious files
38
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
4920MT103 form.exeC:\Users\admin\Deputqqr173\Holomyaria\rveriske.undbinary
MD5:C44AB83C4A2842A135311D7FEA23E9FE
SHA256:DBB5B6C2985D89289AC49C01D4622A0F9B5B8561E2B811F3A32131DB876C9B31
2040BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fbfd54dd-2d40-48dc-8ec2-c6163cda6f77.down_data —
MD5:—
SHA256:—
4920MT103 form.exeC:\Users\admin\Deputqqr173\corvorant.txttext
MD5:7F2E42E7C5212C3FCCAC5B4B94385844
SHA256:05FDF254FB3039E89012888832FDE2DEC639F0670B564FBE5F4B043CE3B65205
4920MT103 form.exeC:\Users\admin\Deputqqr173\Linpin.Retbinary
MD5:2A8C2343AC18136663B09A4164826842
SHA256:43B8FD5A520B4B12547E1619EF8E701B60C0B07809C50D83F895BCCBAC68ED02
4920MT103 form.exeC:\Users\admin\Deputqqr173\Vgtafgifternes170.jpgimage
MD5:00F93B315A8BF6BF720CE6DE369F5251
SHA256:485656DFF165DA8B5F3E0D45B68F85E5AB6684B1C8E31216EBF8547421598FCA
4920MT103 form.exeC:\Users\admin\Deputqqr173\Holomyaria\fodboldregler.initext
MD5:B1B502DDFAB32A2DE5F73990D6C20340
SHA256:FC7E179875C7F88768736638CEF614C02E4B9E48065798A39B4F33327849C881
4920MT103 form.exeC:\Users\admin\Deputqqr173\Holomyaria\micropaleontologist.endbinary
MD5:DA92E93D0B4AF172FE5716CE81771903
SHA256:EA93488F8E454B1CF0886332887B895BD49895E78850A6E702D89B595D0CB493
4920MT103 form.exeC:\Users\admin\AppData\Local\Temp\nsvEA37.tmpbinary
MD5:8CE4B16B22B58894AA86C421E8759DF3
SHA256:8254C329A92850F6D539DD376F4816EE2764517DA5E0235514AF433164480D7A
4920MT103 form.exeC:\Users\admin\AppData\Local\Temp\nspE9C8.tmp\System.dllexecutable
MD5:6E55A6E7C3FDBD244042EB15CB1EC739
SHA256:ACF90AB6F4EDC687E94AAF604D05E16E6CFB5E35873783B50C66F307A35C6506
4920MT103 form.exeC:\Users\admin\Deputqqr173\Holomyaria\slangemennesker.endbinary
MD5:1BA6227854571A51CA448FB7471BBF91
SHA256:F5D514720F8B78DAED8E3BB74A9844DB027A5DDEF640C7B7EFF5538222B347FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
40
DNS requests
26
Threats
34

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
104.124.11.58:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4188
MT103 form.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
4188
MT103 form.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
4188
MT103 form.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
4188
MT103 form.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
4188
MT103 form.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
5544
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4188
MT103 form.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
4188
MT103 form.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.124.11.58:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5544
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5544
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2040
BackgroundTransferHost.exe
2.19.96.128:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 104.124.11.58
  • 104.124.11.17
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.3
  • 20.190.159.75
  • 20.190.159.68
  • 40.126.31.1
  • 40.126.31.131
  • 20.190.159.131
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.19.96.128
  • 2.19.96.120
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
4188
MT103 form.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
4188
MT103 form.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
4188
MT103 form.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
4188
MT103 form.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
4188
MT103 form.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
4188
MT103 form.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MT103 form.lzh