File name:

Transferencia.exe

Full analysis: https://app.any.run/tasks/cad5830e-648d-4084-afc8-d11ffa051674
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:10:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
snake
keylogger
evasion
telegram
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

876AF059933551761EFCB8043B52C97B

SHA1:

3904C1419A0A0F7CC9700BAEFE385C46E28B695B

SHA256:

2AC34556A9AF7630686767E50828FA89313FEAB88D21B69228418A595E36619A

SSDEEP:

24576:P2UhLu3KAGSkDoybVUvB9oic7EcdNuYqKDM/FKbULk2oe/9VU62elBzde0R:P2qu3KAGSkDo4VUvHoic7EQNuYqKDM/n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • msiexec.exe (PID: 7624)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • msiexec.exe (PID: 7624)

    • Steals credentials from Web Browsers

      • msiexec.exe (PID: 7624)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • Transferencia.exe (PID: 4736)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 4620)

    • Checks for external IP

      • msiexec.exe (PID: 7624)
      • svchost.exe (PID: 2196)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • msiexec.exe (PID: 7624)

    • The process verifies whether the antivirus software is installed

      • msiexec.exe (PID: 7624)

  • INFO

    • Reads the computer name

      • Transferencia.exe (PID: 4736)

    • The sample compiled with english language support

      • Transferencia.exe (PID: 4736)

    • Checks supported languages

      • Transferencia.exe (PID: 4736)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4620)

    • Create files in a temporary directory

      • Transferencia.exe (PID: 4736)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7584)
      • BackgroundTransferHost.exe (PID: 7800)
      • BackgroundTransferHost.exe (PID: 6676)
      • BackgroundTransferHost.exe (PID: 5228)
      • msiexec.exe (PID: 7624)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4620)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 4620)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7800)
      • msiexec.exe (PID: 7624)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7800)
      • msiexec.exe (PID: 7624)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 4620)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 4620)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7800)
      • msiexec.exe (PID: 7624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:57:16+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 162816
UninitializedDataSize: 1024
EntryPoint: 0x33b3
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.2.0.0
ProductVersionNumber: 2.2.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: forlagsredaktrer
CompanyName: toy isamin si
FileVersion: 2.2.0.0
InternalName: overseverely svovlhatte.exe
LegalTrademarks: ranatra tiltmaking talismanen
OriginalFileName: overseverely svovlhatte.exe
ProductName: fjorteners
ProductVersion: 2.2.0.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start transferencia.exe no specs powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #SNAKEKEYLOGGER msiexec.exe svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2960\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4120C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4620"powershell.exe" -windowstyle minimized "$Epibolic=gc -Raw 'C:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\Dypkoger144.Non';$Svanesangene=$Epibolic.SubString(73603,3);.$Svanesangene($Epibolic)" "$Epibolic=gc -Raw 'C:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\Dypkoger144.Non';$Svanesangene=$Epibolic.SubString(73603,3);.$Svanesangene($Epibolic)" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—Transferencia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4736"C:\Users\admin\AppData\Local\Temp\Transferencia.exe" C:\Users\admin\AppData\Local\Temp\Transferencia.exe—explorer.exe
User:
admin
Company:
toy isamin si
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\transferencia.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5228"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6132C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6676"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7584"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
11 518
Read events
11 485
Write events
33
Delete events
0

Modification events

(PID) Process:(4736) Transferencia.exeKey:HKEY_CURRENT_USER\Paniconographic\Uninstall\Onlinebehandling141
Operation:writeName:Underdelens66
Value:
1
(PID) Process:(4736) Transferencia.exeKey:HKEY_CURRENT_USER\Krigertypen\Corelation
Operation:writeName:Mediant181
Value:
FF750B9D
(PID) Process:(7584) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7584) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7584) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7800) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7800) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7800) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8008) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8008) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
1
Suspicious files
19
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
4736Transferencia.exeC:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\Ethnomusicological.txttext
MD5:40294F9DFBD79EE348B8DC1BD73E4E59
SHA256:061B36F24F7F1B88F6A1D7ED1672A22B212301EAE5CD08F0C0CE167296F69D72
4736Transferencia.exeC:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\aandevsner.txttext
MD5:A279FDCC1301C1A11DA86C87E5C75CD6
SHA256:49CB7F15A9B7A5AFE0F69BCB06358E358E692F8D8703A8A3D24724845403EBF2
4736Transferencia.exeC:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\Unreversibly.Plubinary
MD5:E610584FBF73E741E48631FEB8B64577
SHA256:83DB2C24D0165B0989E2733C9B58D0DE9A1851F3DDD68B774782DB6BDEB5799C
4736Transferencia.exeC:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\Blodserummernes74.jpgimage
MD5:C5062A1643747982900E8FD8347B949C
SHA256:D2DF953270D93504AF894CC97490F242441538905534365DA44C0F4F7F90BE05
4736Transferencia.exeC:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\apologiens.txttext
MD5:D25FD4AFE03BE5E9A13F104EBE05E329
SHA256:1C97F91E66B47A44D26A882F2B6BD7189ED987490BC7EDA9957936E2AAE68AC3
7800BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e18a5da5-6aa0-4e24-bfc3-2a33cb9dba1b.down_data —
MD5:—
SHA256:—
4736Transferencia.exeC:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\Metope91.txttext
MD5:99D40E1D30A455564D5C687BEF371FFF
SHA256:5BF72017310DE1C9733D583C62C28B212C1AE0841D7F9CFE7DA12B7AB621C6FA
4736Transferencia.exeC:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\Peaselike105.gstbinary
MD5:379E18204702370E2B51F4580A006BE0
SHA256:15F2601BC50605A62959AEE5C5E9AD2B8AE21C0A3026FAC6F748D536A6A713C1
4736Transferencia.exeC:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\Indiane2.txttext
MD5:38F961381752C2B7D951686646C0AF32
SHA256:AB1A11829965D67389A94EC8952272B96D56DD68FFDFF4DDACAF4707EE2B3495
4736Transferencia.exeC:\Users\admin\AppData\Local\Temp\harskt\Tilkaldevagten\vendetangenternes\Eksekvering.jpgimage
MD5:E4B804F1BF17D84A9130240D0D25882D
SHA256:BA3BD8D9BB324B66FC09B51A38B11D3950DCC0943F0C2BE7F0C31A0027AC5520
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
35
DNS requests
26
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4300
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7800
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7492
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7624
msiexec.exe
GET
200
142.250.185.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEG%2BorlfPZWf5CeqNw%2Flf3jE%3D
unknown
—
—
whitelisted
7492
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7624
msiexec.exe
GET
200
172.217.16.131:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7624
msiexec.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7624
msiexec.exe
GET
200
142.250.185.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEEMozOhYl9J2Ctz332xAY9c%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4300
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.160.128
  • 40.126.32.134
  • 20.190.160.5
  • 40.126.32.133
  • 40.126.32.74
  • 20.190.160.64
  • 20.190.160.17
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
www.bing.com
  • 104.126.37.161
  • 104.126.37.123
  • 104.126.37.147
  • 104.126.37.137
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.186
  • 104.126.37.130
  • 104.126.37.160
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
7624
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7624
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
7624
msiexec.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
7624
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2196
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
7624
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7624
msiexec.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Transferencia.exe