File name:

21832394308.zip

Full analysis: https://app.any.run/tasks/f261406d-7656-4c0a-a567-463c04ee06f6
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 04:21:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
generic
arch-exec
snake
keylogger
evasion
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

6C10CBB4F281EB96463CC8AA772D9782

SHA1:

A3F3B4A812396842BE73AB5A33A89468638719DC

SHA256:

2BFC738B69E8D715D8A2258C933534E6FBDD05350102016CD26360CCEF9613D0

SSDEEP:

98304:BrCIoxvJx50Ld5UlVyozeH03VUR5D2jmnYkBRuyUMhe1GFCbOgwk/iHIKcq3t1cM:BoWwydKs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • WinRAR.exe (PID: 1616)
      • WinRAR.exe (PID: 6752)
      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 1132)

    • Generic archive extractor

      • WinRAR.exe (PID: 1616)

    • Adds path to the Windows Defender exclusion list

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 1132)

    • Changes Windows Defender settings

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 1132)

    • Changes the autorun value in the registry

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 1132)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • AddInProcess32.exe (PID: 4944)

    • Steals credentials from Web Browsers

      • AddInProcess32.exe (PID: 4944)

    • Actions looks like stealing of personal data

      • AddInProcess32.exe (PID: 4944)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 1132)

    • Script adds exclusion path to Windows Defender

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 1132)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6752)

    • Executable content was dropped or overwritten

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 1132)

    • Checks for external IP

      • AddInProcess32.exe (PID: 4944)
      • svchost.exe (PID: 2196)

  • INFO

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 1012)
      • AddInProcess32.exe (PID: 4944)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 5124)
      • BackgroundTransferHost.exe (PID: 1012)
      • BackgroundTransferHost.exe (PID: 5960)
      • BackgroundTransferHost.exe (PID: 3240)
      • BackgroundTransferHost.exe (PID: 5112)

    • Checks supported languages

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 1132)
      • AddInProcess32.exe (PID: 4944)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 1012)

    • Manual execution by a user

      • WinRAR.exe (PID: 6752)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 1012)
      • AddInProcess32.exe (PID: 4944)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6752)

    • Reads the computer name

      • PO-ZPEC-NAYZEK-20250315 pdf.exe (PID: 1132)
      • AddInProcess32.exe (PID: 4944)

    • Disables trace logs

      • AddInProcess32.exe (PID: 4944)

    • Reads the machine GUID from the registry

      • AddInProcess32.exe (PID: 4944)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5352)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xfaa31c77
ZipCompressedSize: 3842573
ZipUncompressedSize: 3948500
ZipFileName: f9c7484cea6250d2102a245df47d71092ecc5d8652fb4189c1b147c19348c30b
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
15
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GENERIC winrar.exe no specs sppextcomobj.exe no specs slui.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #GENERIC winrar.exe #GENERIC po-zpec-nayzek-20250315 pdf.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs #SNAKEKEYLOGGER addinprocess32.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
896C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1012"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1132"C:\Users\admin\AppData\Local\Temp\Rar$EXa6752.38223\PO-ZPEC-NAYZEK-20250315 pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6752.38223\PO-ZPEC-NAYZEK-20250315 pdf.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6752.38223\po-zpec-nayzek-20250315 pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\appdata\local\temp\rar$exa6752.38223\libcares-2.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1616"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\21832394308.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3240"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4008"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4336\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—PO-ZPEC-NAYZEK-20250315 pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4944"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PO-ZPEC-NAYZEK-20250315 pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
12 610
Read events
12 563
Write events
47
Delete events
0

Modification events

(PID) Process:(1616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\21832394308.zip
(PID) Process:(1616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5124) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
6
Suspicious files
11
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1012BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e3c58a6f-4988-497b-a689-8136d524716d.down_data —
MD5:—
SHA256:—
6752WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6752.38223\msvcp290.dllexecutable
MD5:A4212A7A7D7295EBBBFDA999DDC04566
SHA256:A239AA8CE43E328ACFB73B72CF2DA03F4C4082614C0486895806F14A6094D6F2
6752WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6752.38223\libcares-2.dllexecutable
MD5:EAF7469E4D057CA1862C07A947237397
SHA256:82E9342C53B47C40CDFE9934F61B3841F533F9AF21323830CA9F394854141C49
1012BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e3c58a6f-4988-497b-a689-8136d524716d.be6c9ae1-47cd-4d4a-8346-b334d0ea9851.down_metabinary
MD5:844783A4CF1111173907A9C8ED8FFF65
SHA256:78A1576252CEF41DC88AF6023E8441715FD724CD6E6D44E8BF68801C5C1D566F
1012BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f0c6fec0-81c3-4aa6-bcfd-965126837641.up_meta_securebinary
MD5:6F2053619E286E7E2BA3A157C6EC6DF4
SHA256:0FAB21FD12728DD63236137F68B372B062AD77E6CA2DB95D0B05A50C8032171F
1012BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
1616WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1616.33711\f9c7484cea6250d2102a245df47d71092ecc5d8652fb4189c1b147c19348c30bcompressed
MD5:BF810322228B7AA578CF39F1FD77BA19
SHA256:F9C7484CEA6250D2102A245DF47D71092ECC5D8652FB4189C1B147C19348C30B
1012BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:CF41C83EE4DCA6E0A39F01718F6508D8
SHA256:A94BEC44D118E4A1DBA34B7DCE69F802711C775C969228F71291FCEE741E124F
1012BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f0c6fec0-81c3-4aa6-bcfd-965126837641.be6c9ae1-47cd-4d4a-8346-b334d0ea9851.down_metabinary
MD5:844783A4CF1111173907A9C8ED8FFF65
SHA256:78A1576252CEF41DC88AF6023E8441715FD724CD6E6D44E8BF68801C5C1D566F
6752WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6752.38223\vcruntime210.dllbinary
MD5:8DE8A4C8674230296FBEE9A11635F9B4
SHA256:3F15A6C253FADC5C01804DC33879687E46AF3ADF8DB46CC8CDC8CF1E6F9B6D4C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
26
DNS requests
17
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1012
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1180
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5436
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5436
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4944
AddInProcess32.exe
GET
502
193.122.6.168:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
4944
AddInProcess32.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1180
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
whitelisted
google.com
  • 172.217.16.206
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.4
  • 40.126.32.138
  • 20.190.160.128
  • 40.126.32.72
  • 20.190.160.132
  • 20.190.160.2
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
4944
AddInProcess32.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
4944
AddInProcess32.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
4944
AddInProcess32.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
4944
AddInProcess32.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
21832394308.zip