File name:

7166d30a3576ab141b7d49097f20e70136759e6567f8b9a0dddfb8a023383031

Full analysis: https://app.any.run/tasks/4c20560e-cdbb-477f-a131-faa527f77ccb
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 15:15:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
snake
keylogger
evasion
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

509A6974B3C54E58948D5B746FC8AF58

SHA1:

3E6EA5287F59079E1AD6A8C1DB563116DFA60DC3

SHA256:

7166D30A3576AB141B7D49097F20E70136759E6567F8B9A0DDDFB8A023383031

SSDEEP:

24576:QuXk/dwJh9B6KRRQo0VVAElO8mk+sCXegJQIHgAlFGzPXLh3ATdpCasu:QuXk/dwJh9B6KRRQo0VVAElO8mk+sCOU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • surmit.exe (PID: 7508)

    • SNAKE has been detected (YARA)

      • RegSvcs.exe (PID: 7544)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • RegSvcs.exe (PID: 7544)
      • RegSvcs.exe (PID: 536)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 7544)
      • RegSvcs.exe (PID: 536)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 7544)
      • RegSvcs.exe (PID: 536)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • New Purchase Order.exe (PID: 7432)

    • Starts itself from another location

      • New Purchase Order.exe (PID: 7432)

    • Executes application which crashes

      • surmit.exe (PID: 7508)

    • Checks for external IP

      • RegSvcs.exe (PID: 7544)
      • svchost.exe (PID: 2196)
      • RegSvcs.exe (PID: 536)

    • The process verifies whether the antivirus software is installed

      • RegSvcs.exe (PID: 7544)
      • RegSvcs.exe (PID: 536)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1056)

  • INFO

    • Reads mouse settings

      • New Purchase Order.exe (PID: 7432)
      • surmit.exe (PID: 7508)

    • Manual execution by a user

      • New Purchase Order.exe (PID: 7432)
      • wscript.exe (PID: 1056)

    • Checks supported languages

      • New Purchase Order.exe (PID: 7432)
      • surmit.exe (PID: 7508)
      • RegSvcs.exe (PID: 7544)

    • Creates files or folders in the user directory

      • New Purchase Order.exe (PID: 7432)
      • surmit.exe (PID: 7508)
      • WerFault.exe (PID: 7644)

    • Create files in a temporary directory

      • New Purchase Order.exe (PID: 7432)
      • surmit.exe (PID: 7508)
      • surmit.exe (PID: 5008)

    • Reads the machine GUID from the registry

      • New Purchase Order.exe (PID: 7432)
      • RegSvcs.exe (PID: 7544)
      • RegSvcs.exe (PID: 536)

    • The sample compiled with english language support

      • New Purchase Order.exe (PID: 7432)
      • WinRAR.exe (PID: 7292)

    • Autorun file from Startup directory

      • surmit.exe (PID: 7508)

    • Reads the software policy settings

      • RegSvcs.exe (PID: 7544)

    • Checks proxy server information

      • RegSvcs.exe (PID: 7544)
      • RegSvcs.exe (PID: 536)
      • slui.exe (PID: 5400)

    • Reads the computer name

      • RegSvcs.exe (PID: 7544)

    • Disables trace logs

      • RegSvcs.exe (PID: 7544)
      • RegSvcs.exe (PID: 536)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

SnakeKeylogger

(PID) Process(7544) RegSvcs.exe
Keys
DES6fc98cd68a1aab8b
Options
Telegram Bot Token7725623378:AAFyPRXLgMaz6RepcrwiG-KkR7jNMc-SEgI
Telegram Chat ID5411784088
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:03:24 13:15:26
ZipCRC: 0xe5cee3c0
ZipCompressedSize: 571385
ZipUncompressedSize: 998400
ZipFileName: New Purchase Order.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
10
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe new purchase order.exe surmit.exe #SNAKE regsvcs.exe werfault.exe no specs svchost.exe slui.exe wscript.exe no specs surmit.exe no specs #SNAKEKEYLOGGER regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Users\admin\AppData\Local\untrashed\surmit.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
surmit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1056"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\surmit.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5008"C:\Users\admin\AppData\Local\untrashed\surmit.exe" C:\Users\admin\AppData\Local\untrashed\surmit.exe—wscript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\untrashed\surmit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
5400C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7292"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\7166d30a3576ab141b7d49097f20e70136759e6567f8b9a0dddfb8a023383031.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7432"C:\Users\admin\Desktop\New Purchase Order.exe" C:\Users\admin\Desktop\New Purchase Order.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\new purchase order.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7508"C:\Users\admin\Desktop\New Purchase Order.exe" C:\Users\admin\AppData\Local\untrashed\surmit.exe
New Purchase Order.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\untrashed\surmit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7544"C:\Users\admin\Desktop\New Purchase Order.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
surmit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
SnakeKeylogger
(PID) Process(7544) RegSvcs.exe
Keys
DES6fc98cd68a1aab8b
Options
Telegram Bot Token7725623378:AAFyPRXLgMaz6RepcrwiG-KkR7jNMc-SEgI
Telegram Chat ID5411784088
7644C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7508 -s 780C:\Windows\SysWOW64\WerFault.exe—surmit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
15 778
Read events
15 708
Write events
57
Delete events
13

Modification events

(PID) Process:(7292) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7292) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7292) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7292) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\7166d30a3576ab141b7d49097f20e70136759e6567f8b9a0dddfb8a023383031.zip
(PID) Process:(7292) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7292) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7292) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7292) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7292) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList
Operation:writeName:ArcSort
Value:
32
(PID) Process:(7544) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
2
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_surmit.exe_c0404e48e263ba3036dd721c74a39e24f5aff2_d5d1dd81_2a1e24e9-4726-4aa5-b551-563cf6153f1e\Report.wer —
MD5:—
SHA256:—
7644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER1A2E.tmp.xmlxml
MD5:84FDA77CFA2C00F9501C63C478332A5C
SHA256:B75F0EB850C2400AFC085B3DEBE06ED3A5DE0ACB36C83CF5D9D42529B8B62D4D
7432New Purchase Order.exeC:\Users\admin\AppData\Local\Temp\autFD3E.tmpbinary
MD5:C2FEE6DD7A14B04B8F3C3B97E599DDC3
SHA256:717CFB2BC91B164597022B7B10B05296CC18C480D08ACBF2A3B36152CE37EF0C
7508surmit.exeC:\Users\admin\AppData\Local\Temp\aut5BA.tmpbinary
MD5:C2FEE6DD7A14B04B8F3C3B97E599DDC3
SHA256:717CFB2BC91B164597022B7B10B05296CC18C480D08ACBF2A3B36152CE37EF0C
7432New Purchase Order.exeC:\Users\admin\AppData\Local\untrashed\surmit.exeexecutable
MD5:1D51A399962939A06396A4B4944EB33C
SHA256:EC50AF21B4179D62B3D9B417B5C1BEDBD83CA369F3358E0FFE7073D3187BB8A9
7432New Purchase Order.exeC:\Users\admin\AppData\Local\Temp\vehiculationbinary
MD5:F0AE9165EBA07DFF9F23B698F852B8A7
SHA256:8B69B85BEBE8F824A7C6210CCD54A8166185ADCD12EF6EBF0D3EE55649937D3E
7508surmit.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\surmit.vbsbinary
MD5:C3824FEB90DE303D0F97BD3901FB121D
SHA256:7308372AA8ABE65B58C2FCDFCC9FDDDBBC3388B831CB9FA71A63CD09CEE11E8C
7644WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\surmit.exe.7508.dmpbinary
MD5:131172517371246E5E6F37AC0552FF45
SHA256:BEBE6CCDEA07376F9014C7F78160AC763F791A255058FC1BE466FB034A9373A7
7644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER1450.tmp.dmpbinary
MD5:853657C72DE3312B462C73D6CB3925E8
SHA256:92EE37AE71F466E92788AEB9B8BDC31255ED818BADC646E578FE0D9687AA0A75
7644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER1897.tmp.WERInternalMetadata.xmlxml
MD5:97F58BFCE4746DD132D01F839A05E342
SHA256:F6616C0B331D656CE8CD97CBC4A5F63F7E7ED326F236F941571CD1FE37B17306
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
70
TCP/UDP connections
62
DNS requests
18
Threats
26

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7544
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7544
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
744
svchost.exe
GET
200
23.48.23.149:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7544
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7544
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7544
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7544
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
—
—
GET
304
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
104.21.16.1:443
https://reallyfreegeoip.org/xml/72.22.151.29
unknown
—
—
—
7544
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
744
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
744
svchost.exe
23.48.23.149:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
20.198.162.76:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7544
RegSvcs.exe
158.101.44.242:80
checkip.dyndns.org
ORACLE-BMC-31898
US
whitelisted
7544
RegSvcs.exe
104.21.48.1:443
reallyfreegeoip.org
CLOUDFLARENET
—
malicious
7472
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.48.23.149
  • 23.48.23.145
  • 23.48.23.148
  • 23.48.23.158
  • 23.48.23.144
  • 23.48.23.156
  • 23.48.23.147
  • 23.48.23.153
  • 23.48.23.142
  • 23.48.23.169
  • 23.48.23.173
  • 23.48.23.181
  • 23.48.23.179
  • 23.48.23.174
  • 23.48.23.185
  • 23.48.23.188
  • 23.48.23.177
  • 23.48.23.175
whitelisted
client.wns.windows.com
  • 20.198.162.76
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.130
  • 40.126.31.129
  • 40.126.31.2
  • 20.190.159.0
  • 20.190.159.128
  • 20.190.159.2
  • 40.126.31.1
whitelisted
checkip.dyndns.org
  • 158.101.44.242
  • 132.226.247.73
  • 193.122.130.0
  • 132.226.8.169
  • 193.122.6.168
whitelisted
reallyfreegeoip.org
  • 104.21.48.1
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.64.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.32.1
malicious
arc.msn.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
7544
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7544
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
7544
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
7544
RegSvcs.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
7544
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7544
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7544
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7166d30a3576ab141b7d49097f20e70136759e6567f8b9a0dddfb8a023383031