File name:

21832394308.zip

Full analysis: https://app.any.run/tasks/198fc08f-c75f-4f25-854c-a0914889ad2b
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 04:23:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
generic
arch-exec
evasion
snake
keylogger
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

6C10CBB4F281EB96463CC8AA772D9782

SHA1:

A3F3B4A812396842BE73AB5A33A89468638719DC

SHA256:

2BFC738B69E8D715D8A2258C933534E6FBDD05350102016CD26360CCEF9613D0

SSDEEP:

98304:BrCIoxvJx50Ld5UlVyozeH03VUR5D2jmnYkBRuyUMhe1GFCbOgwk/iHIKcq3t1cM:BoWwydKs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6488)

    • GENERIC has been found (auto)

      • WinRAR.exe (PID: 6488)
      • WinRAR.exe (PID: 6752)
      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 4208)

    • Adds path to the Windows Defender exclusion list

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 4208)

    • Changes Windows Defender settings

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 4208)

    • Changes the autorun value in the registry

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 4208)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • AddInProcess32.exe (PID: 3304)

    • Steals credentials from Web Browsers

      • AddInProcess32.exe (PID: 3304)

    • Actions looks like stealing of personal data

      • AddInProcess32.exe (PID: 3304)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6752)
      • ShellExperienceHost.exe (PID: 6564)

    • Script adds exclusion path to Windows Defender

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 4208)

    • Starts POWERSHELL.EXE for commands execution

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 4208)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • AddInProcess32.exe (PID: 3304)

    • The process verifies whether the antivirus software is installed

      • AddInProcess32.exe (PID: 3304)

    • Executable content was dropped or overwritten

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 4208)

  • INFO

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 5984)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 5984)
      • AddInProcess32.exe (PID: 3304)
      • slui.exe (PID: 4220)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 1324)
      • BackgroundTransferHost.exe (PID: 5720)
      • BackgroundTransferHost.exe (PID: 6108)
      • BackgroundTransferHost.exe (PID: 5984)
      • BackgroundTransferHost.exe (PID: 6068)

    • Manual execution by a user

      • WinRAR.exe (PID: 6752)
      • msedge.exe (PID: 6272)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 5984)
      • AddInProcess32.exe (PID: 3304)
      • slui.exe (PID: 2316)
      • slui.exe (PID: 4220)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6752)

    • Checks supported languages

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 4208)
      • AddInProcess32.exe (PID: 3304)
      • ShellExperienceHost.exe (PID: 6564)
      • identity_helper.exe (PID: 8024)
      • identity_helper.exe (PID: 8016)

    • Reads the computer name

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 4208)
      • AddInProcess32.exe (PID: 3304)
      • ShellExperienceHost.exe (PID: 6564)
      • identity_helper.exe (PID: 8024)
      • identity_helper.exe (PID: 8016)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6132)

    • Reads the machine GUID from the registry

      • AddInProcess32.exe (PID: 3304)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6132)

    • Disables trace logs

      • AddInProcess32.exe (PID: 3304)

    • Application launched itself

      • msedge.exe (PID: 7592)
      • msedge.exe (PID: 6272)

    • Reads Environment values

      • identity_helper.exe (PID: 8024)
      • identity_helper.exe (PID: 8016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xfaa31c77
ZipCompressedSize: 3842573
ZipUncompressedSize: 3948500
ZipFileName: f9c7484cea6250d2102a245df47d71092ecc5d8652fb4189c1b147c19348c30b
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
230
Monitored processes
85
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GENERIC winrar.exe no specs sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #GENERIC winrar.exe #GENERIC po-zpec-nayzek-20250315 pdf.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs #SNAKEKEYLOGGER addinprocess32.exe svchost.exe shellexperiencehost.exe no specs slui.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x290,0x294,0x298,0x288,0x2a0,0x7ffc88025fd8,0x7ffc88025fe4,0x7ffc88025ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1852"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5356 --field-trial-handle=2360,i,8709985777065416458,3703556646652203236,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2108\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—PO-ZPEC-NAYZEK-20250315 pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2316"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3508 --field-trial-handle=2336,i,2406900703451943022,2006402226420539681,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2692"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x300,0x304,0x308,0x2f8,0x310,0x7ffc88025fd8,0x7ffc88025fe4,0x7ffc88025ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3012"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4040 --field-trial-handle=2336,i,2406900703451943022,2006402226420539681,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3020C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
23 549
Read events
23 470
Write events
79
Delete events
0

Modification events

(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\21832394308.zip
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5720) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
40
Suspicious files
592
Text files
126
Unknown types
0

Dropped files

PID
Process
Filename
Type
5984BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\181b031c-f84b-4b69-8993-f7843b777904.down_data —
MD5:—
SHA256:—
5984BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\181b031c-f84b-4b69-8993-f7843b777904.ab847bdd-89be-4f11-ae02-ad6cee081719.down_metabinary
MD5:1A9C5AEB03759B7AF0C97859B1FBFF07
SHA256:8E6667E32CC4BBDE61B23213953B0CC5AC8DE05BC7128A3EA899AAAD3824E110
5984BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\29b1c652-2642-4348-acd2-68d9ea52b10c.ab847bdd-89be-4f11-ae02-ad6cee081719.down_metabinary
MD5:1A9C5AEB03759B7AF0C97859B1FBFF07
SHA256:8E6667E32CC4BBDE61B23213953B0CC5AC8DE05BC7128A3EA899AAAD3824E110
5984BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:65FDF4EA6FC3EE86DE117178185E4B6B
SHA256:BA05BD57C4085EADF57C41C040A478BC189AB5A057F44AAF59AA5BC851FFB0BD
4208PO-ZPEC-NAYZEK-20250315 pdf.exeC:\Users\admin\SystemRootDoc\PO-ZPEC-NAYZEK-20250315 pdf.exeexecutable
MD5:FD3C8166E7FBBB64D12C1170B8F4BACF
SHA256:A52E245DD7937094711B10C479274A2CCCEA2DFB89F7D4C9F22879214718F92B
4208PO-ZPEC-NAYZEK-20250315 pdf.exeC:\Users\admin\SystemRootDoc\vcruntime210.dllbinary
MD5:8DE8A4C8674230296FBEE9A11635F9B4
SHA256:3F15A6C253FADC5C01804DC33879687E46AF3ADF8DB46CC8CDC8CF1E6F9B6D4C
4208PO-ZPEC-NAYZEK-20250315 pdf.exeC:\Users\admin\SystemRootDoc\libcares-2.dllexecutable
MD5:EAF7469E4D057CA1862C07A947237397
SHA256:82E9342C53B47C40CDFE9934F61B3841F533F9AF21323830CA9F394854141C49
6752WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6752.42556\vcruntime210.dllbinary
MD5:8DE8A4C8674230296FBEE9A11635F9B4
SHA256:3F15A6C253FADC5C01804DC33879687E46AF3ADF8DB46CC8CDC8CF1E6F9B6D4C
6132powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vej2tcud.d5r.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6752WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6752.42556\PO-ZPEC-NAYZEK-20250315 pdf.exeexecutable
MD5:FD3C8166E7FBBB64D12C1170B8F4BACF
SHA256:A52E245DD7937094711B10C479274A2CCCEA2DFB89F7D4C9F22879214718F92B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
118
DNS requests
149
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.20.245.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5176
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5984
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3304
AddInProcess32.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
3304
AddInProcess32.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
2984
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8188
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/e9f25f54-9a54-4e31-91fd-7fd2ad4f4a2f?P1=1742999461&P2=404&P3=2&P4=bIG4SwCfPQ7ewkLFlwK2w8mIyFxDrtxRcRL2vLg1knR8auIfVUy9MGe4km%2b5xQns6yr2aEPvWMxhEwHeAilcfg%3d%3d
unknown
—
—
whitelisted
2984
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8188
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/e9f25f54-9a54-4e31-91fd-7fd2ad4f4a2f?P1=1742999461&P2=404&P3=2&P4=bIG4SwCfPQ7ewkLFlwK2w8mIyFxDrtxRcRL2vLg1knR8auIfVUy9MGe4km%2b5xQns6yr2aEPvWMxhEwHeAilcfg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
2.20.245.141:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
20.198.162.76:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5176
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5176
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.20.245.141
  • 2.20.245.135
  • 2.20.245.134
  • 2.20.245.133
  • 2.20.245.137
whitelisted
google.com
  • 172.217.16.206
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.23
  • 20.190.159.130
  • 40.126.31.131
  • 40.126.31.129
  • 20.190.159.131
  • 20.190.159.2
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 20.198.162.76
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.19.122.26
  • 2.19.122.30
  • 104.126.37.139
  • 104.126.37.131
  • 2.19.96.128
  • 2.19.96.120
whitelisted
checkip.dyndns.org
  • 132.226.8.169
  • 132.226.247.73
  • 193.122.6.168
  • 158.101.44.242
  • 193.122.130.0
whitelisted
reallyfreegeoip.org
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.96.1
  • 104.21.80.1
  • 104.21.48.1
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
3304
AddInProcess32.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
3304
AddInProcess32.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
3304
AddInProcess32.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
3304
AddInProcess32.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
21832394308.zip