File name:

522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7

Full analysis: https://app.any.run/tasks/d2ea64ab-0a6e-4257-8c9a-46666a4c8488
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: September 03, 2025, 17:13:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-sch-xml
stealer
evasion
ultravnc
rmm-tool
telegram
exfiltration
agenttesla
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

ADE450C7A2B33CA4502E5AADC1CFDFEA

SHA1:

8BBFB32AE8E014F72CE8E984ECF4F314A6438A76

SHA256:

522DF31FA6822A48A743918CC4371DAAA6CA5AADE2713DDF6E4A7726C78D54A7

SSDEEP:

12288:CbxJWY62duZifTigwKmTeO99bImyPP1H+oTDLdjq5Kax6C5wUeWxFD:52duZifTigwK4j99bP8LdoKaxvejW/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)

    • Actions looks like stealing of personal data

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

    • Steals credentials from Web Browsers

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

    • AGENTTESLA has been detected (YARA)

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

  • SUSPICIOUS

    • Application launched itself

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)

    • Executable content was dropped or overwritten

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)

    • Reads security settings of Internet Explorer

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)

    • Checks for external IP

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)
      • svchost.exe (PID: 2200)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

    • The process connected to a server suspected of theft

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

  • INFO

    • Checks supported languages

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)
      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

    • Creates files or folders in the user directory

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)

    • Create files in a temporary directory

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)

    • Process checks computer location settings

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)

    • Reads the software policy settings

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

    • Reads the machine GUID from the registry

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)
      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

    • Disables trace logs

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

    • Checks proxy server information

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)

    • Reads the computer name

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)
      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 6404)

    • ULTRAVNC has been detected

      • 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe (PID: 4036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
Telegram-Tokens (1)6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
Telegram-Info-Links
6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
Get info about bothttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getMe
Get incoming updateshttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getUpdates
Get webhookhttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/deleteWebhook?drop_pending_updates=true
Telegram-Tokens (1)6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
Telegram-Info-Links
6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
Get info about bothttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getMe
Get incoming updateshttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getUpdates
Get webhookhttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
End-PointsendDocument
Args
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:15 10:52:23+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 659968
InitializedDataSize: 69632
UninitializedDataSize: -
EntryPoint: 0xa2ff2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: NYju.exe
LegalCopyright:
OriginalFileName: NYju.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe schtasks.exe no specs conhost.exe no specs #AGENTTESLA 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4036"C:\Users\admin\AppData\Local\Temp\522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe"C:\Users\admin\AppData\Local\Temp\522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
ims-api
(PID) Process(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
Telegram-Tokens (1)6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
Telegram-Info-Links
6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
Get info about bothttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getMe
Get incoming updateshttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getUpdates
Get webhookhttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/deleteWebhook?drop_pending_updates=true
(PID) Process(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
Telegram-Tokens (1)6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
Telegram-Info-Links
6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
Get info about bothttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getMe
Get incoming updateshttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getUpdates
Get webhookhttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token6963761648:AAEL0SFPQj0Q9fEkjK4Z24oZsmsROQs_c4M
End-PointsendDocument
Args
4120\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4800"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FiWRXehUNDI" /XML "C:\Users\admin\AppData\Local\Temp\tmpF1CD.tmp"C:\Windows\SysWOW64\schtasks.exe—522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5432C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6404"C:\Users\admin\AppData\Local\Temp\522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe" C:\Users\admin\AppData\Local\Temp\522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
2 077
Read events
2 063
Write events
14
Delete events
0

Modification events

(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4036) 522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6404522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeC:\Users\admin\AppData\Roaming\FiWRXehUNDI.exeexecutable
MD5:ADE450C7A2B33CA4502E5AADC1CFDFEA
SHA256:522DF31FA6822A48A743918CC4371DAAA6CA5AADE2713DDF6E4A7726C78D54A7
6404522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exeC:\Users\admin\AppData\Local\Temp\tmpF1CD.tmpxml
MD5:B8126EA9D548FF66754740EB433258CC
SHA256:89C347E9BCE28BCCF1EC98E18A12521563BC5C7D3840CA1156115393ECF23941
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
16
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1468
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
1268
svchost.exe
GET
200
2.16.164.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
4036
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
US
text
6 b
whitelisted
1740
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
NL
binary
419 b
whitelisted
1740
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
NL
binary
407 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1636
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1468
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1468
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1268
svchost.exe
2.16.164.112:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4036
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.72
  • 40.126.32.133
  • 40.126.32.74
  • 20.190.160.128
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.112
  • 2.16.164.24
  • 2.16.164.129
  • 2.16.164.98
  • 2.16.164.17
  • 2.16.164.9
  • 2.16.164.96
  • 2.16.164.122
  • 2.16.164.130
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
api.telegram.org
  • 149.154.167.220
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
4036
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
4036
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
A Network Trojan was detected
ET MALWARE Common Stealer Behavior - Source IP Associated with Hosting Provider Check via ip.api .com
2200
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2200
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
4036
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2200
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
2200
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
4036
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
4036
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
4036
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Telegram
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
522df31fa6822a48a743918cc4371daaa6ca5aade2713ddf6e4a7726c78d54a7