File name:

RFQ Inquiry.exe

Full analysis: https://app.any.run/tasks/47e98493-51ac-4984-8fb9-d6270050e062
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: March 03, 2025, 07:43:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lokibot
stealer
trojan
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

26928EBB2401EC731A1C6B768AE99EA3

SHA1:

1C50732DC4BBCD1727C90E40354B5C958C968BD2

SHA256:

50282203A7B1158CFF82796B1FA5A7725ABD91E2D85BD68EAD4C2E1E910B46B2

SSDEEP:

24576:890liH+NZXz62Up7WhVuNofZcbFX+eMHgbQHgokzWQ5piCPNm30c93bfcx0vQv9F:++NZXz62Up7WhVuNofZcbFX+eMHgbQHQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • RFQ Inquiry.exe (PID: 7264)

    • Uses Task Scheduler to run other applications

      • RFQ Inquiry.exe (PID: 7264)

    • LOKIBOT mutex has been found

      • RegSvcs.exe (PID: 6652)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 6652)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 6652)

    • Scans artifacts that could help determine the target

      • RegSvcs.exe (PID: 6652)

    • Lokibot is detected

      • RegSvcs.exe (PID: 6652)

    • LOKIBOT has been detected (SURICATA)

      • RegSvcs.exe (PID: 6652)

    • LOKIBOT has been detected (YARA)

      • RegSvcs.exe (PID: 6652)

    • Connects to the CnC server

      • RegSvcs.exe (PID: 6652)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RFQ Inquiry.exe (PID: 7264)
      • RegSvcs.exe (PID: 6652)

    • Reads security settings of Internet Explorer

      • RFQ Inquiry.exe (PID: 7264)
      • RegSvcs.exe (PID: 6652)

    • Contacting a server suspected of hosting an CnC

      • RegSvcs.exe (PID: 6652)

    • Connects to the server without a host name

      • RegSvcs.exe (PID: 6652)

    • Process drops legitimate windows executable

      • RegSvcs.exe (PID: 6652)

  • INFO

    • Reads the computer name

      • RFQ Inquiry.exe (PID: 7264)
      • RegSvcs.exe (PID: 6652)

    • Reads the machine GUID from the registry

      • RFQ Inquiry.exe (PID: 7264)
      • RegSvcs.exe (PID: 6652)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8180)
      • BackgroundTransferHost.exe (PID: 7336)
      • BackgroundTransferHost.exe (PID: 4756)
      • BackgroundTransferHost.exe (PID: 7972)
      • BackgroundTransferHost.exe (PID: 6644)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8180)
      • RFQ Inquiry.exe (PID: 7264)
      • RegSvcs.exe (PID: 6652)

    • Checks supported languages

      • RFQ Inquiry.exe (PID: 7264)
      • RegSvcs.exe (PID: 6652)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 8180)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8180)
      • slui.exe (PID: 7388)

    • Create files in a temporary directory

      • RFQ Inquiry.exe (PID: 7264)

    • Process checks computer location settings

      • RFQ Inquiry.exe (PID: 7264)

    • Reads Microsoft Office registry keys

      • RegSvcs.exe (PID: 6652)

    • The sample compiled with english language support

      • RegSvcs.exe (PID: 6652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

LokiBot

(PID) Process(6652) RegSvcs.exe
C294.156.177.41/sss1/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2063:04:14 03:05:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 601600
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x94c5a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.781
ProductVersionNumber: 2.0.0.781
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: PDF document
CompanyName: Adobe Reader
FileDescription: Microsoft PDF Document
FileVersion: 2.0.0.781
InternalName: qblR.exe
LegalCopyright: Adobe Inc. All rights reserved
LegalTrademarks: PDF document
OriginalFileName: qblR.exe
ProductName: Adobe Reader
ProductVersion: 2.0.0.781
AssemblyVersion: 2.0.0.781
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rfq inquiry.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs schtasks.exe no specs conhost.exe no specs #LOKIBOT regsvcs.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4756"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6644"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6652"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
RFQ Inquiry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
LokiBot
(PID) Process(6652) RegSvcs.exe
C294.156.177.41/sss1/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php
7264"C:\Users\admin\AppData\Local\Temp\RFQ Inquiry.exe" C:\Users\admin\AppData\Local\Temp\RFQ Inquiry.exe
explorer.exe
User:
admin
Company:
Adobe Reader
Integrity Level:
MEDIUM
Description:
Microsoft PDF Document
Exit code:
0
Version:
2.0.0.781
Modules
Images
c:\users\admin\appdata\local\temp\rfq inquiry.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7336"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7356C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
7388"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7504"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QFXtpJHprFGm" /XML "C:\Users\admin\AppData\Local\Temp\tmp2CC.tmp"C:\Windows\SysWOW64\schtasks.exe—RFQ Inquiry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7972"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
3 687
Read events
3 668
Write events
19
Delete events
0

Modification events

(PID) Process:(7972) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7972) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7972) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4756) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4756) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4756) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8180) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8180) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8180) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6644) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
2
Suspicious files
9
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
8180BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\466d5ee2-ed6a-4c68-897b-11f3351e34e4.down_data —
MD5:—
SHA256:—
8180BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:CA6173FC5E87CAB1BEF55DAC3B19CB8F
SHA256:2784FA484E6E373A9A1451396BA9BF7E52CB1D3208E446A62EE6FC9E9D3D73D1
7264RFQ Inquiry.exeC:\Users\admin\AppData\Roaming\QFXtpJHprFGm.exeexecutable
MD5:26928EBB2401EC731A1C6B768AE99EA3
SHA256:50282203A7B1158CFF82796B1FA5A7725ABD91E2D85BD68EAD4C2E1E910B46B2
8180BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4ffc387b-4ba9-487c-8b5c-1d8ce683782a.up_meta_securebinary
MD5:3470B27A945B2991E5D99FFAE5CB528F
SHA256:555A1B1C5A9E468CC2C14D68CD6C3F5DECF447A7CD9F43E6CDEF34CF743027FE
6652RegSvcs.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.exeexecutable
MD5:6279D136310C22894F605938B4CB93D8
SHA256:FB7D514B3322810463655473D2D7C704D3405C1C9DD81F0D4D423518EF416987
6652RegSvcs.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:D898504A722BFF1524134C6AB6A5EAA5
SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
6652RegSvcs.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.hdbbinary
MD5:1013079A9BF8FFA458C230EA6AAF8A89
SHA256:1B1F3BCE8DF0FC7E33B518DAB09D09AF3680E39BCC3C760DADCC50C931007BE8
8180BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4ffc387b-4ba9-487c-8b5c-1d8ce683782a.f6867ae5-e5a2-4f4d-a988-fc0963b62cb4.down_metabinary
MD5:A148BE8C337129AE6C4FD4F5841796F7
SHA256:B7C78363634F9BBB1F925B050331A2A7AE0217429DB61AE45E80B2988ABD1A1C
6652RegSvcs.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.lckbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
7264RFQ Inquiry.exeC:\Users\admin\AppData\Local\Temp\tmp2CC.tmpxml
MD5:7D06373D26E54DE78EC4AFB82EFE2948
SHA256:5FA91C582F9D55CBCF3C7933143AD351976368EBD2AC3AA645350BA6414D89A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
16
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8180
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6652
RegSvcs.exe
POST
404
94.156.177.41:80
http://94.156.177.41/sss1/five/fre.php
unknown
—
—
malicious
6652
RegSvcs.exe
POST
404
94.156.177.41:80
http://94.156.177.41/sss1/five/fre.php
unknown
—
—
malicious
8136
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8136
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6652
RegSvcs.exe
POST
404
94.156.177.41:80
http://94.156.177.41/sss1/five/fre.php
unknown
—
—
malicious
6652
RegSvcs.exe
POST
404
94.156.177.41:80
http://94.156.177.41/sss1/five/fre.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7580
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8180
BackgroundTransferHost.exe
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.69
  • 20.190.159.23
  • 20.190.159.0
  • 40.126.31.129
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.128
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.123
  • 104.126.37.128
  • 104.126.37.171
  • 104.126.37.178
  • 104.126.37.176
  • 104.126.37.185
  • 104.126.37.129
  • 104.126.37.177
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
6652
RegSvcs.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
6652
RegSvcs.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
6652
RegSvcs.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
6652
RegSvcs.exe
A Network Trojan was detected
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
6652
RegSvcs.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
6652
RegSvcs.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
6652
RegSvcs.exe
A Network Trojan was detected
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
6652
RegSvcs.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
6652
RegSvcs.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Request for C2 Commands Detected M1
6652
RegSvcs.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RFQ Inquiry.exe