File name:

HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.7z

Full analysis: https://app.any.run/tasks/9837173e-5fb6-44b2-99a5-84c33e390398
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 08, 2025, 17:49:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
olader
loader
themida
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

65AB4EBFA22348F355AF3CA1DE58CE94

SHA1:

51D8061794554B3E934F51E2DF7DBDBFBE9F10F9

SHA256:

7008DBDF4069245D8B66870A0271423AA55FD0B51E771D8691839BA71B01C92F

SSDEEP:

98304:UMpYiT+38p6a/laR4tV8njnbPbqma19VJLJBOpTfXteL0MhuqMv1oifTQ5eYsy64:WLpQ/WoBAbxihpqM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • OLADER has been detected

      • HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe (PID: 4620)

    • Create files in the Startup directory

      • undirk.exe (PID: 4408)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 4424)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 4424)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 4424)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe (PID: 4620)

    • Executable content was dropped or overwritten

      • HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe (PID: 4620)
      • undirk.exe (PID: 4408)

    • Reads the BIOS version

      • yoicksvp.exe (PID: 2340)
      • undirk.exe (PID: 4408)
      • IntelRapid.exe (PID: 4024)

    • Reads security settings of Internet Explorer

      • yoicksvp.exe (PID: 2340)

    • Starts itself from another location

      • undirk.exe (PID: 4408)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • yoicksvp.exe (PID: 2340)
      • wscript.exe (PID: 4424)

    • The process executes VB scripts

      • yoicksvp.exe (PID: 2340)

    • Potential Corporate Privacy Violation

      • wscript.exe (PID: 4424)
      • svchost.exe (PID: 2196)

  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 2088)
      • BackgroundTransferHost.exe (PID: 2960)
      • BackgroundTransferHost.exe (PID: 3332)
      • BackgroundTransferHost.exe (PID: 1128)
      • BackgroundTransferHost.exe (PID: 4300)

    • Creates files in the program directory

      • HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe (PID: 4620)
      • yoicksvp.exe (PID: 2340)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 4300)

    • The sample compiled with english language support

      • HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe (PID: 4620)

    • Manual execution by a user

      • HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe (PID: 4620)

    • Checks supported languages

      • HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe (PID: 4620)
      • undirk.exe (PID: 4408)
      • IntelRapid.exe (PID: 4024)
      • yoicksvp.exe (PID: 2340)

    • Create files in a temporary directory

      • HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe (PID: 4620)
      • yoicksvp.exe (PID: 2340)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 4300)
      • yoicksvp.exe (PID: 2340)
      • wscript.exe (PID: 4424)

    • Process checks whether UAC notifications are on

      • yoicksvp.exe (PID: 2340)
      • undirk.exe (PID: 4408)
      • IntelRapid.exe (PID: 4024)

    • Reads the computer name

      • yoicksvp.exe (PID: 2340)
      • undirk.exe (PID: 4408)

    • Reads CPU info

      • yoicksvp.exe (PID: 2340)

    • Creates files or folders in the user directory

      • undirk.exe (PID: 4408)
      • yoicksvp.exe (PID: 2340)
      • BackgroundTransferHost.exe (PID: 4300)

    • Themida protector has been detected

      • yoicksvp.exe (PID: 2340)

    • Process checks computer location settings

      • yoicksvp.exe (PID: 2340)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:10:26 12:03:40+00:00
ArchivedFileName: HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
14
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #OLADER heur-trojan-banker.win32.convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe undirk.exe yoicksvp.exe intelrapid.exe no specs svchost.exe wscript.exe

Process information

PID
CMD
Path
Indicators
Parent process
1128"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2088"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2340"C:\Users\admin\AppData\Local\Temp\lizard\yoicksvp.exe"C:\Users\admin\AppData\Local\Temp\lizard\yoicksvp.exe
HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\lizard\yoicksvp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2960"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3240"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3332"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3900C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4024"C:\Users\admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\admin\AppData\Roaming\Intel Rapid\IntelRapid.exe—undirk.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\intel rapid\intelrapid.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4300"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
5 322
Read events
5 281
Write events
41
Delete events
0

Modification events

(PID) Process:(5048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\9837173e-5fb6-44b2-99a5-84c33e390398.7z
(PID) Process:(5048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5048) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2088) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
8
Suspicious files
13
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4300BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8b598184-50d3-4a1d-9f2f-fa0fab73252e.down_data —
MD5:—
SHA256:—
5048WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb5048.47529\HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exeexecutable
MD5:63C6959237B662401A9F78E799D34DB1
SHA256:E3D5B6D0C39C747762C25D021C7A8AEDAA7A30BEB9AF9187D15AEA7178EA9758
4300BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:AD7A7F2CD8F6B61032EE00693F5E9D43
SHA256:A4E66657A4625D0CF6407A5655E107A3DC9020F083CF764B184526C09442854F
4620HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exeC:\Program Files (x86)\foler\olader\acledit.dllexecutable
MD5:8D96CB171B4138F43A754317BE9E982C
SHA256:727B96DCA0363F7CD5767F94BF72E0655EF1D00F44B27D496DEB733EB32BE12B
2340yoicksvp.exeC:\Users\admin\AppData\Local\Temp\tsmdgkmulipb.vbstext
MD5:22D04C62B460FD18A1E65D4145D2E46C
SHA256:2E62E1971D9BB1BB99CEE4185764F6D57716F6F75F1419D965B28A5375944A5C
4620HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exeC:\Users\admin\AppData\Local\Temp\lizard\yoicksvp.exeexecutable
MD5:4456A0AD06E8801583FFDE598D485C06
SHA256:93BCAAD9DF41E2B94537D8F74FCA47676BF736FC77626D3EC5296177503C9937
4408undirk.exeC:\Users\admin\AppData\Roaming\Intel Rapid\IntelRapid.exeexecutable
MD5:202DC043812831E9B306ADBFAFC2E536
SHA256:9BA7F0102BB108D023BE94985CDF4F3ED80E5E260E4DDA531A212CECCE0D1D39
4620HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.exeC:\Program Files (x86)\foler\olader\adprovider.dllexecutable
MD5:F981199C82A40CF638D313C4498ECAB9
SHA256:338287DDB5FDBF0F7540DAC8AE8A3F02643F7B45F3B401A9DFA6447E39043049
2340yoicksvp.exeC:\Users\admin\AppData\Local\Temp\E8AC.tmpbinary
MD5:07A4E4A8814C7651180733D4E35C843F
SHA256:52729DDA6DB22A0B50948FE7D2A1E8ACD82776EBBE03BE0DE1CF4067C51354FE
4424wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:C9BE626E9715952E9B70F92F912B9787
SHA256:C13E8D22800C200915F87F71C31185053E4E60CA25DE2E41E160E09CD2D815D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
30
DNS requests
16
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2108
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4300
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2340
yoicksvp.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
1348
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1348
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4424
wscript.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
4424
wscript.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2108
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2108
backgroundTaskHost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.142
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.0
  • 40.126.31.128
  • 40.126.31.3
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
www.bing.com
  • 92.123.104.53
  • 92.123.104.32
  • 92.123.104.65
  • 92.123.104.67
  • 92.123.104.52
  • 92.123.104.28
  • 92.123.104.11
  • 92.123.104.61
  • 92.123.104.22
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2340
yoicksvp.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in DNS Lookup)
4424
wscript.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Banker.Win32.Convagent.gen-e3d5b6d0c39c747762c25d021c7a8aedaa7a30beb9af9187d15aea7178ea9758.7z