File name:

RFQ #115 - LUCID PROJECT.scr

Full analysis: https://app.any.run/tasks/01949d7e-27aa-4f1d-98f4-67edd02f657f
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: March 25, 2025, 06:00:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
raccoon
stealer
snake
keylogger
evasion
telegram
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

73F983A8F863E04D5A382A0C9540AE59

SHA1:

9EB1D26FF5B099EE060AFD5D1B658EB59FAB4541

SHA256:

8B6C728D7AF964D8A35D544EC376C7FF16DF2F329D514C82B315174A6DBA0A29

SSDEEP:

24576:RYSaEsjv0fe39b+ZVEZXoVl8aVNzW/9oLl9+KMxr+ZRTke3LOqhp5EFqrJIc:RnaEsjv0s9b+ZVOXoVl8aVNzW/9oLl9X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
    • Raccoon mutex has been detected

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
    • Uses Task Scheduler to run other applications

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
    • SNAKEKEYLOGGER has been detected (SURICATA)

      • RegSvcs.exe (PID: 6972)
    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 6972)
    • SNAKE has been detected (YARA)

      • RegSvcs.exe (PID: 6972)
    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 6972)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
    • Reads security settings of Internet Explorer

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
    • Checks for external IP

      • RegSvcs.exe (PID: 6972)
      • svchost.exe (PID: 2196)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • RegSvcs.exe (PID: 6972)
    • The process verifies whether the antivirus software is installed

      • RegSvcs.exe (PID: 6972)
  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 5072)
      • BackgroundTransferHost.exe (PID: 6560)
      • BackgroundTransferHost.exe (PID: 4212)
      • BackgroundTransferHost.exe (PID: 7268)
      • BackgroundTransferHost.exe (PID: 8012)
    • Reads the machine GUID from the registry

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
      • RegSvcs.exe (PID: 6972)
    • Reads the computer name

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
      • RegSvcs.exe (PID: 6972)
    • Checks supported languages

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
      • RegSvcs.exe (PID: 6972)
    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 4212)
      • RegSvcs.exe (PID: 6972)
    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 4212)
      • RegSvcs.exe (PID: 6972)
      • slui.exe (PID: 7688)
    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 4212)
      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
    • .NET Reactor protector has been detected

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
    • Create files in a temporary directory

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
    • Process checks computer location settings

      • RFQ #115 - LUCID PROJECT.scr.exe (PID: 7504)
    • Disables trace logs

      • RegSvcs.exe (PID: 6972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

SnakeKeylogger

(PID) Process(6972) RegSvcs.exe
Keys
DES6fc98cd68a1aab8b
Options
SMTP Userserverhenry23@gpsamsterdamqroup.com
SMTP PasswordtgQiGAVNH+H%
SMTP Hostfiber13.dnsiaas.com
SMTP SendToudsnakelogger@dklak.cam
SMTP Port587
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (38.3)
.exe | Win32 Executable (generic) (26.2)
.exe | Win16/32 Executable Delphi generic (12)
.exe | Generic Win/DOS Executable (11.6)
.exe | DOS Executable Generic (11.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:21 05:14:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 724992
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xb2d8e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.0.0.0
ProductVersionNumber: 4.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Quantum
CompanyName: Quantum
FileDescription: Quantum
FileVersion: 4.0.0.0
InternalName: xitw.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: xitw.exe
ProductName: Quantum
ProductVersion: 4.0.0.0
AssemblyVersion: 4.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
13
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rfq #115 - lucid project.scr.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs schtasks.exe no specs conhost.exe no specs #SNAKE regsvcs.exe svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4212"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5072"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6036"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nODadngjC" /XML "C:\Users\admin\AppData\Local\Temp\tmp2AC.tmp"C:\Windows\SysWOW64\schtasks.exeRFQ #115 - LUCID PROJECT.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6560"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6972"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
RFQ #115 - LUCID PROJECT.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
SnakeKeylogger
(PID) Process(6972) RegSvcs.exe
Keys
DES6fc98cd68a1aab8b
Options
SMTP Userserverhenry23@gpsamsterdamqroup.com
SMTP PasswordtgQiGAVNH+H%
SMTP Hostfiber13.dnsiaas.com
SMTP SendToudsnakelogger@dklak.cam
SMTP Port587
7268"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7504"C:\Users\admin\AppData\Local\Temp\RFQ #115 - LUCID PROJECT.scr.exe" C:\Users\admin\AppData\Local\Temp\RFQ #115 - LUCID PROJECT.scr.exe
explorer.exe
User:
admin
Company:
Quantum
Integrity Level:
MEDIUM
Description:
Quantum
Exit code:
0
Version:
4.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rfq #115 - lucid project.scr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7644C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7688"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 888
Read events
3 859
Write events
29
Delete events
0

Modification events

(PID) Process:(5072) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5072) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5072) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6560) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6560) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6560) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7268) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7268) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7268) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4212) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
1
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4212BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\86f38079-640b-43c5-a7fa-93193cfe8c5e.down_data
MD5:
SHA256:
4212BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
4212BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\86f38079-640b-43c5-a7fa-93193cfe8c5e.093614f6-ccdf-4761-aeb5-136ad5b3da3b.down_metabinary
MD5:03ACE49071B4579032929360771918AC
SHA256:B4415E4EF1F1195A2618CE41990D3A3F0767145C33DDB6FCD2C2C7BB4439E2E9
4212BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2deda45b-5695-4fc8-b419-1c80b9fd0fc5.up_meta_securebinary
MD5:A741B4D50DC139D90A524A12E520178C
SHA256:99F461976A0D2057090DAB6702A50D98DB99A31D9361FDA5A92E05DA9C8E8EC0
4212BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:E6F94B198495240BAC2E99FBFF34868E
SHA256:8ABD4188A7FCA9DE5D09C146800759877866E4111DE8A4CC74450CC4381904D4
4212BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2deda45b-5695-4fc8-b419-1c80b9fd0fc5.093614f6-ccdf-4761-aeb5-136ad5b3da3b.down_metabinary
MD5:03ACE49071B4579032929360771918AC
SHA256:B4415E4EF1F1195A2618CE41990D3A3F0767145C33DDB6FCD2C2C7BB4439E2E9
7504RFQ #115 - LUCID PROJECT.scr.exeC:\Users\admin\AppData\Local\Temp\tmp2AC.tmpxml
MD5:1577EEB09D5B16F4C8F0A5FD105A877F
SHA256:014AF2C9DDA6B2B435DCE332A276E89A3D63E929B2B2C30C117885387E189AA3
7504RFQ #115 - LUCID PROJECT.scr.exeC:\Users\admin\AppData\Roaming\nODadngjC.exeexecutable
MD5:73F983A8F863E04D5A382A0C9540AE59
SHA256:8B6C728D7AF964D8A35D544EC376C7FF16DF2F329D514C82B315174A6DBA0A29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
33
DNS requests
21
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
7556
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
6972
RegSvcs.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
whitelisted
6972
RegSvcs.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
whitelisted
4212
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6972
RegSvcs.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
whitelisted
6972
RegSvcs.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
whitelisted
6972
RegSvcs.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.20
  • 23.216.77.28
  • 23.216.77.6
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.31.131
  • 40.126.31.2
  • 20.190.159.0
  • 40.126.31.128
  • 20.190.159.130
  • 20.190.159.64
  • 40.126.31.129
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.137
  • 104.126.37.123
  • 104.126.37.128
  • 104.126.37.130
  • 104.126.37.177
  • 104.126.37.178
  • 104.126.37.131
  • 104.126.37.129
  • 104.126.37.186
whitelisted
checkip.dyndns.org
  • 193.122.6.168
  • 132.226.247.73
  • 193.122.130.0
  • 158.101.44.242
  • 132.226.8.169
whitelisted
reallyfreegeoip.org
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.80.1
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
6972
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6972
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
6972
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
6972
RegSvcs.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
6972
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6972
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
6972
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info