File name:

Dekont- 18031108 05162025 191120013.exe

Full analysis: https://app.any.run/tasks/1ecca78e-dd52-4c46-b87c-679b6411fa12
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 11:51:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
snake
keylogger
evasion
telegram
stealer
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

0BD26842CD4BCEF8AFD3A71B85AB2059

SHA1:

7E8483541F47B4BC70577DB6FAC8479597A321D0

SHA256:

4797CB80B22BA0DA0EDE6593BFC16399A5FFC289400155115C8DE7786EA0DB49

SSDEEP:

24576:/QoL8vsdeq5n/II7p4KVNin1bwwRkiKUDNvCgfzXTIm356rHJTeXBcIhc2HxVOtv:/QoL8vsdeq5n/II7p4KVNin1bwwRkiK/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)

    • Actions looks like stealing of personal data

      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)

    • Steals credentials from Web Browsers

      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)

    • Changes the autorun value in the registry

      • CCleaner64.exe (PID: 6048)

  • SUSPICIOUS

    • Application launched itself

      • Dekont- 18031108 05162025 191120013.exe (PID: 6640)
      • CCleaner64.exe (PID: 6324)
      • CCleaner64.exe (PID: 5436)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)
      • CCleaner64.exe (PID: 5436)

    • Reads security settings of Internet Explorer

      • CCleaner64.exe (PID: 6324)
      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Reads the date of Windows installation

      • CCleaner64.exe (PID: 6324)
      • CCleaner64.exe (PID: 5436)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)

    • The process verifies whether the antivirus software is installed

      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)
      • CCleaner64.exe (PID: 6048)
      • CCleaner64.exe (PID: 5436)

    • Executable content was dropped or overwritten

      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Searches for installed software

      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Reads Internet Explorer settings

      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Starts application from unusual location

      • CCleaner64.exe (PID: 5436)

  • INFO

    • Checks supported languages

      • Dekont- 18031108 05162025 191120013.exe (PID: 6640)
      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)
      • CCleaner64.exe (PID: 6324)
      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Reads the computer name

      • Dekont- 18031108 05162025 191120013.exe (PID: 6640)
      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)
      • CCleaner64.exe (PID: 6324)
      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Reads the machine GUID from the registry

      • Dekont- 18031108 05162025 191120013.exe (PID: 6640)
      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)
      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Disables trace logs

      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)

    • .NET Reactor protector has been detected

      • Dekont- 18031108 05162025 191120013.exe (PID: 6640)

    • Checks proxy server information

      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)
      • CCleaner64.exe (PID: 5436)

    • Reads the software policy settings

      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)
      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Reads Environment values

      • CCleaner64.exe (PID: 6324)
      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Process checks computer location settings

      • CCleaner64.exe (PID: 6324)
      • CCleaner64.exe (PID: 5436)

    • Attempting to use instant messaging service

      • Dekont- 18031108 05162025 191120013.exe (PID: 6988)
      • svchost.exe (PID: 2196)

    • Manual execution by a user

      • CCleaner64.exe (PID: 6324)

    • The sample compiled with english language support

      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Creates files or folders in the user directory

      • CCleaner64.exe (PID: 5436)

    • Reads product name

      • CCleaner64.exe (PID: 6048)
      • CCleaner64.exe (PID: 5436)

    • Reads CPU info

      • CCleaner64.exe (PID: 5436)
      • CCleaner64.exe (PID: 6048)

    • Creates files in the program directory

      • CCleaner64.exe (PID: 6048)
      • CCleaner64.exe (PID: 5436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2049:03:10 03:57:33+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 720384
InitializedDataSize: 9216
UninitializedDataSize: -
EntryPoint: 0xb1ce2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.5.2240.18
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: 智能图书编目系统，具备阅读分析功能。
CompanyName: 博典创新科技
FileDescription: 亚历山大学者版
FileVersion: 3.5.2240.18
InternalName: FuvY.exe
LegalCopyright: © 博典创新科技 二零二五年
LegalTrademarks: 亚历山大™ • 学者版
OriginalFileName: FuvY.exe
ProductName: 亚历山大
ProductVersion: 亚历山大.学者版.第三卷
AssemblyVersion: 3.5.2240.18
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dekont- 18031108 05162025 191120013.exe no specs sppextcomobj.exe no specs slui.exe no specs dekont- 18031108 05162025 191120013.exe no specs #SNAKEKEYLOGGER dekont- 18031108 05162025 191120013.exe svchost.exe ccleaner64.exe no specs ccleaner64.exe ccleaner64.exe

Process information

PID
CMD
Path
Indicators
Parent process
2096"C:\Users\admin\AppData\Local\Temp\Dekont- 18031108 05162025 191120013.exe"C:\Users\admin\AppData\Local\Temp\Dekont- 18031108 05162025 191120013.exe—Dekont- 18031108 05162025 191120013.exe
User:
admin
Company:
博典创新科技
Integrity Level:
MEDIUM
Description:
亚历山大学者版
Exit code:
4294967295
Version:
3.5.2240.18
Modules
Images
c:\users\admin\appdata\local\temp\dekont- 18031108 05162025 191120013.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2320C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5436"C:\Program Files\CCleaner\CCleaner64.exe" /uacC:\Program Files\CCleaner\CCleaner64.exe
CCleaner64.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Version:
6.20.0.10897
Modules
Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6048"C:\Program Files\CCleaner\CCleaner64.exe" /monitorC:\Program Files\CCleaner\CCleaner64.exe
CCleaner64.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Version:
6.20.0.10897
Modules
Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6324"C:\Program Files\CCleaner\CCleaner64.exe" C:\Program Files\CCleaner\CCleaner64.exe—explorer.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
MEDIUM
Description:
CCleaner
Exit code:
0
Version:
6.20.0.10897
Modules
Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6640"C:\Users\admin\AppData\Local\Temp\Dekont- 18031108 05162025 191120013.exe" C:\Users\admin\AppData\Local\Temp\Dekont- 18031108 05162025 191120013.exe—explorer.exe
User:
admin
Company:
博典创新科技
Integrity Level:
MEDIUM
Description:
亚历山大学者版
Exit code:
0
Version:
3.5.2240.18
Modules
Images
c:\users\admin\appdata\local\temp\dekont- 18031108 05162025 191120013.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6988"C:\Users\admin\AppData\Local\Temp\Dekont- 18031108 05162025 191120013.exe"C:\Users\admin\AppData\Local\Temp\Dekont- 18031108 05162025 191120013.exe
Dekont- 18031108 05162025 191120013.exe
User:
admin
Company:
博典创新科技
Integrity Level:
MEDIUM
Description:
亚历山大学者版
Version:
3.5.2240.18
Modules
Images
c:\users\admin\appdata\local\temp\dekont- 18031108 05162025 191120013.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7148"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
23 222
Read events
23 028
Write events
128
Delete events
66

Modification events

(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6988) Dekont- 18031108 05162025 191120013.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Dekont- 18031108 05162025 191120013_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
5
Suspicious files
118
Text files
21
Unknown types
1

Dropped files

PID
Process
Filename
Type
5436CCleaner64.exeC:\Program Files\CCleaner\gcapi_dll.dllexecutable
MD5:F17F96322F8741FE86699963A1812897
SHA256:8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
5436CCleaner64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:C22301B5245B697AA0D960E7D3A2D560
SHA256:8E63BB9D833DDFF90DB225799A6B20821540B2A10AB3764EE07767259765DA0E
5436CCleaner64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:7B7856124CFEB2BCC7A8C440DAD85B79
SHA256:4C88F326F0B63608E5A8D69152C754BC1AF683790171A3DAC6ED575BEA2CC62F
5436CCleaner64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F44F0D8080C8C3429C5AB2379F33E907_36516A32D5B34401A68F7B7E010B64C8binary
MD5:0A76FFFF77EBB9F2AF2E688DF0FAB258
SHA256:A9F10E60BFFE577C76A3D2F9444859CB9578801AEEE80B3B1912AB28BF4FC309
5436CCleaner64.exe —
MD5:—
SHA256:—
6048CCleaner64.exeC:\Program Files\CCleaner\gcapi_17474827396048.dllexecutable
MD5:F17F96322F8741FE86699963A1812897
SHA256:8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
5436CCleaner64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:927E9463769C0DB5125574DB8A2E5F59
SHA256:667FDF1599C05AD422235F00B4E1177B861128961C7133E9A4F0405D3D0DF8A2
5436CCleaner64.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RJZ2E9JSDOMLPHXEDQF9.tempbinary
MD5:91B4AF9888394FA104BB39648EA385BC
SHA256:312F0804E31155992D5B9F1CA17F9A7F3A2A1D041CD18567FEA242B9E37093CE
5436CCleaner64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:9E5F1DF28C9064E2E73198AD7E98B197
SHA256:AA8FFDB539E9F331784341B0F81283C2AE251CBE574A473EAA4DE279D744777A
5436CCleaner64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F44F0D8080C8C3429C5AB2379F33E907_36516A32D5B34401A68F7B7E010B64C8binary
MD5:9FB581A7BF87D5F229B50392E423B96F
SHA256:E7F68D3B87B8A1A23FFF49E428160FF91AB4A417F9986C9F78B4E491647CE8FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
41
DNS requests
40
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6988
Dekont- 18031108 05162025 191120013.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6988
Dekont- 18031108 05162025 191120013.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6988
Dekont- 18031108 05162025 191120013.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6988
Dekont- 18031108 05162025 191120013.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6988
Dekont- 18031108 05162025 191120013.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6988
Dekont- 18031108 05162025 191120013.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.147:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.147
  • 23.48.23.164
  • 23.48.23.176
  • 23.48.23.173
  • 23.48.23.194
  • 23.48.23.143
  • 23.48.23.145
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.174
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.76
  • 20.190.160.22
  • 40.126.32.74
  • 40.126.32.140
  • 20.190.160.20
  • 20.190.160.2
  • 20.190.160.132
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
checkip.dyndns.org
  • 132.226.247.73
  • 193.122.6.168
  • 158.101.44.242
  • 132.226.8.169
  • 193.122.130.0
whitelisted
reallyfreegeoip.org
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.48.1
  • 104.21.80.1
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.32.1
malicious
api.telegram.org
  • 149.154.167.220
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
6988
Dekont- 18031108 05162025 191120013.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6988
Dekont- 18031108 05162025 191120013.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
6988
Dekont- 18031108 05162025 191120013.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6988
Dekont- 18031108 05162025 191120013.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
6988
Dekont- 18031108 05162025 191120013.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
6988
Dekont- 18031108 05162025 191120013.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6988
Dekont- 18031108 05162025 191120013.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Dekont- 18031108 05162025 191120013.exe