File name:

2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb

Full analysis: https://app.any.run/tasks/3841d596-ccca-45a9-8c62-a45522c933fa
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 02:54:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
telegram
exfiltration
stealer
evasion
ultravnc
rmm-tool
agenttesla
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

1463C051217002CED80840E653C57353

SHA1:

096F6D8EEED9EE4E2984BDAA8062B6212EEC9E99

SHA256:

2F275CB26E70027332FB1A62F86CA222924062B48866F5D9D5936471CE88F0CB

SSDEEP:

49152:DcwghQBh0Dc3ajfImFPj+1dAI2ingTaaxfPHKYHA1VWjJhkJpBryUl6A08fXfp/n:wwuQ/IfImpybt2igTacKWuATkBr3YA0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)

    • Steals credentials from Web Browsers

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • AGENTTESLA has been detected (YARA)

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • Actions looks like stealing of personal data

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)

    • Reads security settings of Internet Explorer

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)

    • Application launched itself

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)

    • Checks for external IP

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • The process connected to a server suspected of theft

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

  • INFO

    • Reads the machine GUID from the registry

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)
      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • Reads the computer name

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)
      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • Creates files or folders in the user directory

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)

    • Checks supported languages

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)
      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • Create files in a temporary directory

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)

    • Process checks computer location settings

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 5244)

    • Disables trace logs

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • Checks proxy server information

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)

    • Reads the software policy settings

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)
      • slui.exe (PID: 4944)

    • ULTRAVNC has been detected

      • 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe (PID: 1660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
Telegram-Tokens (1)7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
Telegram-Info-Links
7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
Get info about bothttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getMe
Get incoming updateshttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getUpdates
Get webhookhttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/deleteWebhook?drop_pending_updates=true
Telegram-Tokens (1)7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
Telegram-Info-Links
7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
Get info about bothttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getMe
Get incoming updateshttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getUpdates
Get webhookhttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
End-PointsendDocument
Args
Telegram-Responses
oktrue
result
message_id48981
from
id7309095694
is_bottrue
first_nameFregona App
usernameFregonaAppBot
chat
id5366689155
first_nameJet
last_nameMixer
typeprivate
date1746845714
document
file_nameadmin-DESKTOP-JGLLJLD 2025-05-10 02-55-13.html
mime_typeapplication/octet-stream
file_idBQACAgEAAxkDAAK_VWgewBKkLI_jpt5OdLwMLgsxDZxDAAIzBgACqK34RDNBNtvHi46GNgQ
file_unique_idAgADMwYAAqit-EQ
file_size453
captionNew PW Recovered! Time: 05/10/2025 02:55:12 User Name: admin/DESKTOP-JGLLJLD OSFullName: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz RAM: 4090.45 MB IP Address: 87.249.132.164
caption_entities
offset188
length14
typeurl
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:28 03:57:22+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 760320
InitializedDataSize: 372736
UninitializedDataSize: -
EntryPoint: 0xbb92e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Change Tracking
FileVersion: 1.0.0.0
InternalName: BnnU.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: BnnU.exe
ProductName: Change Tracking
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe sppextcomobj.exe no specs slui.exe schtasks.exe no specs conhost.exe no specs 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe no specs #AGENTTESLA 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Users\admin\AppData\Local\Temp\2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe"C:\Users\admin\AppData\Local\Temp\2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe—2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1660"C:\Users\admin\AppData\Local\Temp\2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe"C:\Users\admin\AppData\Local\Temp\2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
ims-api
(PID) Process(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
Telegram-Tokens (1)7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
Telegram-Info-Links
7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
Get info about bothttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getMe
Get incoming updateshttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getUpdates
Get webhookhttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/deleteWebhook?drop_pending_updates=true
(PID) Process(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
Telegram-Tokens (1)7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
Telegram-Info-Links
7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
Get info about bothttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getMe
Get incoming updateshttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getUpdates
Get webhookhttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g
End-PointsendDocument
Args
Telegram-Responses
oktrue
result
message_id48981
from
id7309095694
is_bottrue
first_nameFregona App
usernameFregonaAppBot
chat
id5366689155
first_nameJet
last_nameMixer
typeprivate
date1746845714
document
file_nameadmin-DESKTOP-JGLLJLD 2025-05-10 02-55-13.html
mime_typeapplication/octet-stream
file_idBQACAgEAAxkDAAK_VWgewBKkLI_jpt5OdLwMLgsxDZxDAAIzBgACqK34RDNBNtvHi46GNgQ
file_unique_idAgADMwYAAqit-EQ
file_size453
captionNew PW Recovered! Time: 05/10/2025 02:55:12 User Name: admin/DESKTOP-JGLLJLD OSFullName: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz RAM: 4090.45 MB IP Address: 87.249.132.164
caption_entities
offset188
length14
typeurl
4464C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4944"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5072C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5244"C:\Users\admin\AppData\Local\Temp\2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe" C:\Users\admin\AppData\Local\Temp\2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6148\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6668"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yvKiblshsLAZ" /XML "C:\Users\admin\AppData\Local\Temp\tmp4F36.tmp"C:\Windows\SysWOW64\schtasks.exe—2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 958
Read events
1 944
Write events
14
Delete events
0

Modification events

(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1660) 2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
52442f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeC:\Users\admin\AppData\Roaming\yvKiblshsLAZ.exeexecutable
MD5:1463C051217002CED80840E653C57353
SHA256:2F275CB26E70027332FB1A62F86CA222924062B48866F5D9D5936471CE88F0CB
52442f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exeC:\Users\admin\AppData\Local\Temp\tmp4F36.tmpxml
MD5:5B0C83C565AE2DDD1069273A94744CFC
SHA256:B2A29332E6AA2C53CF9E1689DC5CBE96835464818F089E52F0FF4D7AE5EC0281
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
16
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.21:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5640
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.21
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 216.58.206.78
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.131
  • 40.126.31.130
  • 20.190.159.68
  • 40.126.31.0
  • 20.190.159.2
  • 40.126.31.2
  • 20.190.159.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
api.ipify.org
  • 104.26.13.205
  • 104.26.12.205
  • 172.67.74.152
shared
api.telegram.org
  • 149.154.167.220
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
1660
2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2196
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
1660
2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
1660
2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
1660
2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Telegram
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb