File name:

king.exe

Full analysis: https://app.any.run/tasks/08d8cda5-123e-434b-af59-981364904a68
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: January 15, 2025, 10:57:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
stealer
agenttesla
exfiltration
smtp
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

0763CD65F6B5702458494123E97F2749

SHA1:

655386A271C50570C47D9CE909F10DE1719E3CC6

SHA256:

35AF2E0E56A27587170E0F093D625A6123E49AF4EA8B939C30CCD9FD8E69A2ED

SSDEEP:

24576:bAfTVnahE0m1N7tYFDCNXbIyozZjNrtvdbroLUU8NGq+DzBxFL2nEEMqY4qULTh8:bAfTVnahEjN74DCNXbIyozZjNrtvdbrK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 5432)

    • Starts PowerShell from an unusual location

      • cmd.exe (PID: 5432)

    • Changes the autorun value in the registry

      • king.exe (PID: 5004)
      • wcwlmeyP.pif (PID: 3620)

    • Steals credentials from Web Browsers

      • wcwlmeyP.pif (PID: 3620)

    • AGENTTESLA has been detected (SURICATA)

      • wcwlmeyP.pif (PID: 3620)

    • Actions looks like stealing of personal data

      • wcwlmeyP.pif (PID: 3620)

    • Connects to the CnC server

      • wcwlmeyP.pif (PID: 3620)

    • AGENTTESLA has been detected (YARA)

      • wcwlmeyP.pif (PID: 3620)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • king.exe (PID: 5004)
      • svchost.pif (PID: 3092)

    • There is functionality for taking screenshot (YARA)

      • king.exe (PID: 5004)

    • Reads security settings of Internet Explorer

      • king.exe (PID: 5004)
      • xkn.pif (PID: 6056)

    • Executing commands from ".cmd" file

      • king.exe (PID: 5004)
      • svchost.pif (PID: 3092)

    • Drops a file with a rarely used extension (PIF)

      • king.exe (PID: 5004)
      • extrac32.exe (PID: 644)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 2440)
      • cmd.exe (PID: 5472)
      • extrac32.exe (PID: 644)
      • xkn.pif (PID: 6056)
      • cmd.exe (PID: 5432)
      • wcwlmeyP.pif (PID: 3620)

    • Process drops legitimate windows executable

      • king.exe (PID: 5004)
      • extrac32.exe (PID: 644)

    • Executable content was dropped or overwritten

      • king.exe (PID: 5004)
      • extrac32.exe (PID: 644)
      • wcwlmeyP.pif (PID: 3620)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5472)
      • cmd.exe (PID: 5432)
      • king.exe (PID: 5004)

    • Starts a Microsoft application from unusual location

      • xkn.pif (PID: 6056)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 5432)

    • Checks Windows Trust Settings

      • xkn.pif (PID: 6056)

    • Checks for external IP

      • wcwlmeyP.pif (PID: 3620)
      • svchost.exe (PID: 2192)

    • Potential Corporate Privacy Violation

      • wcwlmeyP.pif (PID: 3620)

    • Connects to SMTP port

      • wcwlmeyP.pif (PID: 3620)

  • INFO

    • Reads the machine GUID from the registry

      • king.exe (PID: 5004)
      • xkn.pif (PID: 6056)
      • wcwlmeyP.pif (PID: 3620)

    • Reads the software policy settings

      • king.exe (PID: 5004)
      • xkn.pif (PID: 6056)
      • wcwlmeyP.pif (PID: 3620)

    • Checks proxy server information

      • king.exe (PID: 5004)

    • Reads the computer name

      • king.exe (PID: 5004)
      • extrac32.exe (PID: 644)
      • xkn.pif (PID: 6056)

    • Checks supported languages

      • king.exe (PID: 5004)
      • svchost.pif (PID: 3092)
      • extrac32.exe (PID: 644)
      • wcwlmeyP.pif (PID: 3620)
      • xkn.pif (PID: 6056)

    • The sample compiled with english language support

      • king.exe (PID: 5004)
      • extrac32.exe (PID: 644)

    • The process uses the downloaded file

      • cmd.exe (PID: 5472)
      • wcwlmeyP.pif (PID: 3620)

    • Process checks Powershell version

      • xkn.pif (PID: 6056)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • xkn.pif (PID: 6056)

    • Script raised an exception (POWERSHELL)

      • xkn.pif (PID: 6056)

    • Reads Environment values

      • xkn.pif (PID: 6056)

    • Create files in a temporary directory

      • xkn.pif (PID: 6056)

    • Creates files or folders in the user directory

      • wcwlmeyP.pif (PID: 3620)

    • .NET Reactor protector has been detected

      • wcwlmeyP.pif (PID: 3620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (37.4)
.scr | Windows screen saver (34.5)
.exe | Win32 Executable (generic) (11.9)
.exe | Win16/32 Executable Delphi generic (5.4)
.exe | Generic Win/DOS Executable (5.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 354304
InitializedDataSize: 498688
UninitializedDataSize: -
EntryPoint: 0x57754
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
15
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start king.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs svchost.pif no specs svchost.pif no specs svchost.pif cmd.exe no specs conhost.exe no specs extrac32.exe xkn.pif no specs ping.exe no specs #AGENTTESLA wcwlmeyp.pif svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
396\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.pif" C:\Windows\System32\extrac32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2440C:\WINDOWS\system32\cmd.exe /c ""C:\Users\Public\PyemlwcwF.cmd" "C:\Windows\SysWOW64\cmd.exe—king.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2928"C:\Windows \SysWOW64\svchost.pif" C:\Windows \SysWOW64\svchost.pif—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Exchange ActiveSync Invoker
Exit code:
3221226540
Version:
10.0.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\windows \syswow64\svchost.pif
c:\windows\system32\ntdll.dll
3092"C:\Windows \SysWOW64\svchost.pif" C:\Windows \SysWOW64\svchost.pif
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Exchange ActiveSync Invoker
Exit code:
87
Version:
10.0.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\windows \syswow64\svchost.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3620C:\Users\Public\Libraries\wcwlmeyP.pifC:\Users\Public\Libraries\wcwlmeyP.pif
king.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\public\libraries\wcwlmeyp.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
3988"C:\Windows \SysWOW64\svchost.pif" C:\Windows \SysWOW64\svchost.pif—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Exchange ActiveSync Invoker
Exit code:
3221226540
Version:
10.0.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\windows \syswow64\svchost.pif
c:\windows\system32\ntdll.dll
4444ping 127.0.0.1 -n 10 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
5004"C:\Users\admin\Desktop\king.exe" C:\Users\admin\Desktop\king.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\king.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
13 450
Read events
13 432
Write events
18
Delete events
0

Modification events

(PID) Process:(5472) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(5004) king.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Pyemlwcw
Value:
C:\Users\Public\Pyemlwcw.url
(PID) Process:(3620) wcwlmeyP.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wcwlmeyP_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3620) wcwlmeyP.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wcwlmeyP_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3620) wcwlmeyP.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wcwlmeyP_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3620) wcwlmeyP.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wcwlmeyP_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3620) wcwlmeyP.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wcwlmeyP_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3620) wcwlmeyP.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wcwlmeyP_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3620) wcwlmeyP.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wcwlmeyP_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3620) wcwlmeyP.pifKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wcwlmeyP_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
6
Suspicious files
3
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
5004king.exeC:\Users\Public\PyemlwcwF.cmdtext
MD5:F82AEB3B12F33250E404DF6EC873DD1D
SHA256:23B7417B47C7EFB96FB7CE395E325DC831AB2EE03EADDA59058D31BDBE9C1EA6
644extrac32.exeC:\Users\Public\xkn.pifexecutable
MD5:2E5A8590CF6848968FC23DE3FA1E25F1
SHA256:9785001B0DCF755EDDB8AF294A373C0B87B2498660F724E76C4D53F9C217C7A3
5004king.exeC:\Users\Public\Libraries\Pyemlwcwbinary
MD5:D43502D49E5ACEDE223FC0FC3341C787
SHA256:671D6F1F876898AAB5A3B432FE2B23D320584C05BFD8D76C9BCFC5DD24F99AF4
3620wcwlmeyP.pifC:\Users\admin\AppData\Roaming\aWUFv\aWUFv.exeexecutable
MD5:22331ABCC9472CC9DC6F37FAF333AA2C
SHA256:BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
5004king.exeC:\Users\Public\Libraries\YKAtext
MD5:5B464DABF13E3AA70604E6097E6BB30B
SHA256:22154F0969AED4ED804CD7DAD5C7C1764E9641CE698B82D572CB058546A9C2B5
5004king.exeC:\Windows \SysWOW64\NETUTILS.dllexecutable
MD5:A88976A70AED45F610A032E438A82A95
SHA256:F3D5A6EBCD8CAB3CC9A98488B23C2DE740C6EF04E33ED317A3E2A047D53D169B
5004king.exeC:\Windows \SysWOW64\svchost.pifexecutable
MD5:869640D0A3F838694AB4DFEA9E2F544D
SHA256:0DB4D3FFDB96D13CF3B427AF8BE66D985728C55AE254E4B67D287797E4C0B323
5004king.exeC:\Users\Public\Libraries\NEO.cmdtext
MD5:E24FA8FB365A89779B026772B9342AF3
SHA256:10D7B4EA056FC1037109FE6E6694849D145B0745FAA9AE02957104A2834A14A0
6056xkn.pifC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_esefqhci.vwp.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5004king.exeC:\Users\Public\Libraries\FX.cmdtext
MD5:7821E3DE3812E791CF3B223500D73BC9
SHA256:3DAA7F9EEE129F61F7A452F7150EE21A1C4141586A37F37842B9C3BB53152A74
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
10
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5564
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
5564
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
QA
binary
973 b
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
1.01 Kb
whitelisted
—
—
GET
200
172.67.74.152:443
https://api.ipify.org/
US
text
13 b
malicious
3620
wcwlmeyP.pif
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
US
text
6 b
shared
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
QA
binary
973 b
whitelisted
—
—
GET
200
166.62.27.188:443
https://amazonenviro.com/admin/245_Pyemlwcwdhj
US
text
835 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.23.227.198:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5564
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5564
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5004
king.exe
166.62.27.188:443
amazonenviro.com
AS-26496-GO-DADDY-COM-LLC
SG
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.227.198
  • 2.23.227.205
  • 2.23.227.221
  • 2.23.227.208
  • 2.23.227.219
  • 2.23.227.220
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
amazonenviro.com
  • 166.62.27.188
unknown
api.ipify.org
  • 172.67.74.152
  • 104.26.12.205
  • 104.26.13.205
shared
ip-api.com
  • 208.95.112.1
shared
techniqueqatar.com
  • 208.91.198.176
malicious
self.events.data.microsoft.com
  • 20.50.80.214
whitelisted

Threats

PID
Process
Class
Message
3620
wcwlmeyP.pif
Potential Corporate Privacy Violation
ET POLICY Possible IP Check api.ipify.org
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
3620
wcwlmeyP.pif
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
3620
wcwlmeyP.pif
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
3620
wcwlmeyP.pif
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
3620
wcwlmeyP.pif
Generic Protocol Command Decode
SURICATA SMTP invalid reply
3620
wcwlmeyP.pif
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration (raw TCP)
3620
wcwlmeyP.pif
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
king.exe