File name:

CAF58B085A.eml

Full analysis: https://app.any.run/tasks/f8b986a8-176c-4aeb-8a17-b43cee17a756
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 12:30:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
stealer
evasion
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text
MD5:

F55F82EB95E408E83AE0257C882A692B

SHA1:

0D999976F001E45BC4E905DD4D76126BEBDFC4FF

SHA256:

65C165C1C6900715A6EEDFB77D8913DBCC1EBB6CBA1DC8A7C9070D22D1C17D96

SSDEEP:

24576:CYQ0uKxJxx0IL7xQdLvbyQuaGVsM59kIWzMHIUCJX/KNOchRMatLTd:xjJxKtyQqbkhvyrVR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • OUTLOOK.EXE (PID: 5164)

    • Uses Task Scheduler to run other applications

      • Kaefer 31052025.scr (PID: 6768)
      • Kaefer 31052025.scr (PID: 5416)

    • Changes the autorun value in the registry

      • RegSvcs.exe (PID: 1804)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • RegSvcs.exe (PID: 1804)
      • WinRAR.exe (PID: 4208)
      • Kaefer 31052025.scr (PID: 6768)
      • Kaefer 31052025.scr (PID: 5416)

    • Starts application with an unusual extension

      • WinRAR.exe (PID: 4208)

    • Executable content was dropped or overwritten

      • Kaefer 31052025.scr (PID: 5416)
      • RegSvcs.exe (PID: 1804)

    • Checks for external IP

      • RegSvcs.exe (PID: 1804)

    • Uses TASKKILL.EXE to kill Browsers

      • RegSvcs.exe (PID: 1804)

    • Process drops legitimate windows executable

      • RegSvcs.exe (PID: 1804)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4208)

    • Reads the machine GUID from the registry

      • Kaefer 31052025.scr (PID: 6768)
      • Kaefer 31052025.scr (PID: 5416)
      • RegSvcs.exe (PID: 1804)

    • Checks supported languages

      • Kaefer 31052025.scr (PID: 6768)
      • Kaefer 31052025.scr (PID: 5416)
      • RegSvcs.exe (PID: 7720)
      • RegSvcs.exe (PID: 1804)

    • Reads the computer name

      • Kaefer 31052025.scr (PID: 6768)
      • Kaefer 31052025.scr (PID: 5416)
      • RegSvcs.exe (PID: 1804)

    • Creates files or folders in the user directory

      • Kaefer 31052025.scr (PID: 5416)
      • RegSvcs.exe (PID: 1804)

    • Process checks computer location settings

      • Kaefer 31052025.scr (PID: 5416)
      • Kaefer 31052025.scr (PID: 6768)

    • Reads the software policy settings

      • slui.exe (PID: 7300)
      • RegSvcs.exe (PID: 1804)

    • Failed to create an executable file in Windows directory

      • RegSvcs.exe (PID: 1804)

    • Create files in a temporary directory

      • Kaefer 31052025.scr (PID: 6768)
      • Kaefer 31052025.scr (PID: 5416)

    • The sample compiled with english language support

      • RegSvcs.exe (PID: 1804)

    • Checks proxy server information

      • RegSvcs.exe (PID: 1804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
17
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start outlook.exe sppextcomobj.exe no specs slui.exe ai.exe no specs winrar.exe kaefer 31052025.scr schtasks.exe no specs conhost.exe no specs regsvcs.exe kaefer 31052025.scr no specs taskkill.exe no specs conhost.exe no specs slui.exe no specs schtasks.exe no specs conhost.exe no specs regsvcs.exe no specs outlook.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VeVgjwr" /XML "C:\Users\admin\AppData\Local\Temp\tmpF71F.tmp"C:\Windows\SysWOW64\schtasks.exe—Kaefer 31052025.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1804"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Kaefer 31052025.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
3132"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VeVgjwr" /XML "C:\Users\admin\AppData\Local\Temp\tmp855A.tmp"C:\Windows\SysWOW64\schtasks.exe—Kaefer 31052025.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
3888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4208"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\81SD2YUX\Kaefer 31052025.uue"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5164"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml C:\Users\admin\AppData\Local\Temp\CAF58B085A.emlC:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5416"C:\Users\admin\AppData\Local\Temp\Rar$DIa4208.19885\Kaefer 31052025.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa4208.19885\Kaefer 31052025.scr
WinRAR.exe
User:
admin
Company:
锦程软件工作室
Integrity Level:
MEDIUM
Description:
表单大师旗舰版
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia4208.19885\kaefer 31052025.scr
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6768"C:\Users\admin\AppData\Local\Temp\Rar$DIa4208.22998\Kaefer 31052025.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa4208.22998\Kaefer 31052025.scr—WinRAR.exe
User:
admin
Company:
锦程软件工作室
Integrity Level:
MEDIUM
Description:
表单大师旗舰版
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia4208.22998\kaefer 31052025.scr
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7244C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
17 180
Read events
15 962
Write events
1 076
Delete events
142

Modification events

(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:6
Value:
01941A000000001000B24E9A3E06000000000000000600000000000000
(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\5164
Operation:writeName:0
Value:
0B0E102F70C0AA3FA9E644A96A13196DBF195F230046E49BE1929E97F2ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511AC28D2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
Operation:writeName:>)<
Value:
3E293C002C14000004000000000000009C584FE4B9C8DB0196000000010000008E000000430043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C0045006D00610069006C002E0064006F0074006D00000000000000
(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
Operation:delete valueName:h}<
Value:
絨<ᐬ
(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
Operation:delete keyName:(default)
Value:
(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency
Operation:delete keyName:(default)
Value:
(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootCommand
Value:
(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootFailureCount
Value:
(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:delete keyName:(default)
Value:
(PID) Process:(5164) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:CantBootResolution
Value:
BootSuccess
Executable files
4
Suspicious files
15
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
5164OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
5164OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:47DB1AA6179F749500B4304F1B960186
SHA256:1DDC955DE2C7458CA253C68F9A6EB4B86E8EFF1AC0382133391FF30415E52EA1
5164OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:A14DE65F1F7C50BFED8312BF2B2D6CEC
SHA256:4C9A6F9B6EB8C8822BC5EEFF261406AAFEF46611A74F837A178408196E801C4C
5164OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\olkDDEE.tmpcompressed
MD5:8EF2916FDE624B71FF5FE77A5E4647A6
SHA256:AB911555EEAE42ADAFCAE8D817391E901D187E6443BE038B958503B4CDD7B433
5164OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\607529AE-F133-4BF6-97CD-88D594C8F6D9xml
MD5:96543A4C220DBF81AB0EFFE630885C46
SHA256:19C1FB6D523AEE80C06250306FA153D73E49D275CF895A19AB6A7795A99DEEB9
5164OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:2E2FBD1FCE55BD61CCCF0D4B0264C9AC
SHA256:893F1F11A2B0602EAB680F255A2060365F4A58E57F47BFA2C4B9CEA648542528
5164OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:D874A718D9FD4C0FBDE3893B2F93CD33
SHA256:84CCBBD1241B23F254BA4708FB16D434185C07304EEF4758F94B8883D534317E
5164OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TableViewPreviewPrefs_2_142D4E7F88BADE499732DDB829F76CED.datxml
MD5:0E092DB99AEE99FDFF9B5B222C732CFD
SHA256:D1614AD99ADED9F6F5C1BE7FE7FFA5124BD04A526580DA3818EA8A954E852AA6
4208WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa4208.19885\Kaefer 31052025.screxecutable
MD5:12EE8837101ED2228B27C00252832043
SHA256:BE535CA266042B0E45A33715F5A1B7A3639CC18A445A6E6BD7CF967BC6CB588F
5164OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\81SD2YUX\Kaefer 31052025 (002).uue:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
39
DNS requests
25
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5164
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8164
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8164
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1804
RegSvcs.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5164
OUTLOOK.EXE
52.109.32.97:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
5164
OUTLOOK.EXE
52.123.128.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
google.com
  • 142.250.185.110
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted
login.live.com
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.132
  • 40.126.32.140
  • 20.190.160.2
  • 40.126.32.74
  • 20.190.160.131
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
roaming.officeapps.live.com
  • 52.109.32.7
whitelisted
omex.cdn.office.net
  • 2.16.168.113
  • 2.16.168.119
whitelisted

Threats

PID
Process
Class
Message
1804
RegSvcs.exe
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
1804
RegSvcs.exe
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
1804
RegSvcs.exe
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CAF58B085A.eml