File name:

32acd0a9-0a72-499e-850c-fa68fa42ad1f

Full analysis: https://app.any.run/tasks/8111c029-85ff-4f7a-81be-2ac0c69436c2
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 20:57:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
attachments
attc-unc
susp-attachments
stealer
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

F16B0A21F5A558312CA934417035F0C2

SHA1:

A42891480E0E0769CFA9DB56B02A6739D962811A

SHA256:

448774E59631B7756C4350148BE4B70998F8A47DDF62263D6AC04235259F594D

SSDEEP:

49152:sv9nBt6kVgeUBTyi4998nVy2o7wBSMZwJgwK6foibpp80JlvFp8NhD+YAHl/G9o5:G9BA4tri4n8nVy28wBLw+wKJvYpFiL6D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7728)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 3884)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7976)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)

    • Actions looks like stealing of personal data

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

    • Stealers network behavior

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7428)
      • WinRAR.exe (PID: 7780)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

    • Reads Microsoft Outlook installation path

      • WinRAR.exe (PID: 7428)

    • Creates file in the systems drive root

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7728)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 3884)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7976)

    • The process creates files with name similar to system file names

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7728)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 3884)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7976)

    • Executable content was dropped or overwritten

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7728)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 3884)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7976)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7728)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 3884)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7976)

    • Application launched itself

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7728)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 3884)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7976)

    • Checks for external IP

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

    • Uses TASKKILL.EXE to kill Browsers

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7428)
      • OUTLOOK.EXE (PID: 6972)
      • WinRAR.exe (PID: 7780)

    • Reads the software policy settings

      • slui.exe (PID: 7616)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 7428)

    • Checks supported languages

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7728)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 3884)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7976)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7780)

    • Create files in a temporary directory

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7728)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 3884)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7976)

    • Checks proxy server information

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

    • Reads the machine GUID from the registry

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

    • Reads the computer name

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)

    • Creates files or folders in the user directory

      • BANK SLIP_TT COPY-0237844735748.exe (PID: 7964)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 632)
      • BANK SLIP_TT COPY-0237844735748.exe (PID: 1012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0801
ZipCompression: Unknown (99)
ZipModifyDate: 2025:04:15 20:54:50
ZipCRC: 0x00000000
ZipCompressedSize: 1101608
ZipUncompressedSize: 1101580
ZipFileName: aee9bf3747fb171023713ac15a124c4f256f9151c592f2dac2555bf7ffd0b9e5.eml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
20
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe outlook.exe ai.exe no specs winrar.exe slui.exe no specs bank slip_tt copy-0237844735748.exe bank slip_tt copy-0237844735748.exe bank slip_tt copy-0237844735748.exe bank slip_tt copy-0237844735748.exe bank slip_tt copy-0237844735748.exe bank slip_tt copy-0237844735748.exe taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs outlook.exe no specs taskkill.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Users\admin\AppData\Local\Temp\Rar$EXa7780.1380\BANK SLIP_TT COPY-0237844735748.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7780.1380\BANK SLIP_TT COPY-0237844735748.exe
BANK SLIP_TT COPY-0237844735748.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\rar$exa7780.1380\bank slip_tt copy-0237844735748.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
1012"C:\Users\admin\AppData\Local\Temp\Rar$EXa7780.2064\BANK SLIP_TT COPY-0237844735748.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7780.2064\BANK SLIP_TT COPY-0237844735748.exe
BANK SLIP_TT COPY-0237844735748.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\rar$exa7780.2064\bank slip_tt copy-0237844735748.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
2568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3884"C:\Users\admin\AppData\Local\Temp\Rar$EXa7780.1380\BANK SLIP_TT COPY-0237844735748.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7780.1380\BANK SLIP_TT COPY-0237844735748.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7780.1380\bank slip_tt copy-0237844735748.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4528taskkill /f /im chrome.exeC:\Windows\SysWOW64\taskkill.exe—BANK SLIP_TT COPY-0237844735748.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5256"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "DCE5EFC3-302B-43BA-9811-74FB874AB71B" "1C17CA4B-3297-4FAC-BE43-00360DD5E91C" "6972"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\sechost.dll
5680taskkill /f /im chrome.exeC:\Windows\SysWOW64\taskkill.exe—BANK SLIP_TT COPY-0237844735748.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6344taskkill /f /im chrome.exeC:\Windows\SysWOW64\taskkill.exe—BANK SLIP_TT COPY-0237844735748.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
33 387
Read events
31 187
Write events
2 076
Delete events
124

Modification events

(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\32acd0a9-0a72-499e-850c-fa68fa42ad1f.zip
(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(7428) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
6
Suspicious files
50
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
6972OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
7428WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb7428.47323\aee9bf3747fb171023713ac15a124c4f256f9151c592f2dac2555bf7ffd0b9e5.emlhtml
MD5:05DFCA2C37826B1AF40FB22EAE41B4D2
SHA256:EE70A246DBD37BC1F204434E601544A039D09726C632915C7C1444701BA48A43
7428WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb7428.47323\aee9bf3747fb171023713ac15a124c4f256f9151c592f2dac2555bf7ffd0b9e5.eml:OECustomPropertybinary
MD5:2EA2D3E787E264E94F6EA446ADD1411F
SHA256:0E82CABC7E0F41AF62367102A1038EC73C532B75DF8C9763388446EB6F04FD6A
6972OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\40EC43C5-2C4A-4D80-8205-EE8F1CCD65E9xml
MD5:A6EC13359394F73D2D33C78D65690A69
SHA256:3CEE29CE8CBE6536E148593A9CB52BEB1BF76900E3D1DCD6EB9FB1401FC913D3
6972OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:8F262A930527AE9D8ED59AB687A6A635
SHA256:7EE7CAED54B6B2C7A7E94A75C33C983AC56462826D27BD5F54DF8421BB500E15
7428WinRAR.exeC:\Users\admin\AppData\Local\Temp\32acd0a9-0a72-499e-850c-fa68fa42ad1f.zipcompressed
MD5:DD9C4B3C459BFF4E8EBA7EEF2C32198E
SHA256:86E32DEA64A507B22CEE24293D7D819659FE17678613DBB567DC004558A1DA28
7780WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7780.755\BANK SLIP_TT COPY-0237844735748.exeexecutable
MD5:556B6E3EE804326E7CF384E7F6A5B5CE
SHA256:A96579EB67E671BC34D9AC9D036BD64622F73AB96D93322827B78A8BB0086B85
6972OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:BDD9E4D75C96C444C0E84FA9CE84D806
SHA256:194A27B4932E1EB5B29B65C46F08D26BCF4FF9144812E9E6FFBBD9C6D9503B28
7728BANK SLIP_TT COPY-0237844735748.exeC:\Users\admin\pacifist\Eksperimentets\mendelssohnic.tra —
MD5:—
SHA256:—
6972OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
40
DNS requests
31
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7964
BANK SLIP_TT COPY-0237844735748.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
632
BANK SLIP_TT COPY-0237844735748.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
1012
BANK SLIP_TT COPY-0237844735748.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
—
—
GET
200
2.16.168.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8152
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6972
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
7964
BANK SLIP_TT COPY-0237844735748.exe
GET
200
142.250.185.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEDmdiANCnbVJCTfkel4NKS0%3D
unknown
—
—
whitelisted
7964
BANK SLIP_TT COPY-0237844735748.exe
GET
200
142.250.185.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
8152
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.122:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.168.122
  • 2.16.168.124
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.2
  • 20.190.159.131
  • 20.190.159.129
  • 40.126.31.73
  • 20.190.159.75
  • 40.126.31.130
  • 20.190.159.71
  • 40.126.31.69
  • 20.190.159.68
  • 40.126.31.71
  • 40.126.31.1
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted

Threats

PID
Process
Class
Message
7964
BANK SLIP_TT COPY-0237844735748.exe
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
7964
BANK SLIP_TT COPY-0237844735748.exe
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
7964
BANK SLIP_TT COPY-0237844735748.exe
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
632
BANK SLIP_TT COPY-0237844735748.exe
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
632
BANK SLIP_TT COPY-0237844735748.exe
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
632
BANK SLIP_TT COPY-0237844735748.exe
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
1012
BANK SLIP_TT COPY-0237844735748.exe
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
1012
BANK SLIP_TT COPY-0237844735748.exe
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
1012
BANK SLIP_TT COPY-0237844735748.exe
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
32acd0a9-0a72-499e-850c-fa68fa42ad1f