File name:

JIL-_Document_No._2500015903.GZ

Full analysis: https://app.any.run/tasks/de7056c8-9ce0-4522-9085-c6b56721cb06
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: December 26, 2024, 02:22:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
snake
keylogger
stealer
Indicators:
MIME: application/octet-stream
File info: data
MD5:

04CAC86B62C708C6BA2A15A4B2692187

SHA1:

A47A5BF4F198EDCB77CE628B7375B2B8ACDB903C

SHA256:

992AF75446DF3C44B9AACDD44E756C57610458970C2472BB7A1C397E9B2A3335

SSDEEP:

24576:/7z/xc0NwRb6ec25JrnX+yoxEjMUKQKiTxodKIbEcOoTPhXDXv:/Ppc0mRb6ec25JrnX+yoxEjMUKQKiTxe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • JIL-_Document_No._2500015903.scr (PID: 2512)
      • Trading_AIBot.exe (PID: 5008)

    • Actions looks like stealing of personal data

      • Microsofts.exe (PID: 4876)

    • Steals credentials from Web Browsers

      • Microsofts.exe (PID: 4876)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • Microsofts.exe (PID: 4876)

    • Adds path to the Windows Defender exclusion list

      • Trading_AIBot.exe (PID: 5008)

    • Create files in the Startup directory

      • Trading_AIBot.exe (PID: 5008)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • JIL-_Document_No._2500015903.scr (PID: 2512)
      • JIL-_Document_No._2500015903.scr (PID: 624)
      • Trading_AIBot.exe (PID: 5008)

    • Application launched itself

      • JIL-_Document_No._2500015903.scr (PID: 2512)

    • Reads security settings of Internet Explorer

      • JIL-_Document_No._2500015903.scr (PID: 2512)
      • WinRAR.exe (PID: 6320)
      • JIL-_Document_No._2500015903.scr (PID: 624)

    • Process drops legitimate windows executable

      • JIL-_Document_No._2500015903.scr (PID: 2512)
      • WinRAR.exe (PID: 6320)

    • Starts application with an unusual extension

      • JIL-_Document_No._2500015903.scr (PID: 2512)
      • WinRAR.exe (PID: 6320)

    • Starts a Microsoft application from unusual location

      • JIL-_Document_No._2500015903.scr (PID: 624)
      • JIL-_Document_No._2500015903.scr (PID: 2512)

    • Script adds exclusion path to Windows Defender

      • Trading_AIBot.exe (PID: 5008)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • Microsofts.exe (PID: 4876)

    • Starts POWERSHELL.EXE for commands execution

      • Trading_AIBot.exe (PID: 5008)

    • The process creates files with name similar to system file names

      • Trading_AIBot.exe (PID: 5008)

    • The process verifies whether the antivirus software is installed

      • Microsofts.exe (PID: 4876)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6320)
      • JIL-_Document_No._2500015903.scr (PID: 2512)
      • JIL-_Document_No._2500015903.scr (PID: 624)
      • powershell.exe (PID: 4592)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6320)

    • Process checks computer location settings

      • JIL-_Document_No._2500015903.scr (PID: 2512)
      • JIL-_Document_No._2500015903.scr (PID: 624)

    • Reads the machine GUID from the registry

      • JIL-_Document_No._2500015903.scr (PID: 2512)
      • JIL-_Document_No._2500015903.scr (PID: 624)
      • Microsofts.exe (PID: 4876)

    • Create files in a temporary directory

      • JIL-_Document_No._2500015903.scr (PID: 2512)
      • JIL-_Document_No._2500015903.scr (PID: 624)

    • Checks supported languages

      • JIL-_Document_No._2500015903.scr (PID: 624)
      • Trading_AIBot.exe (PID: 5008)
      • Microsofts.exe (PID: 4876)
      • JIL-_Document_No._2500015903.scr (PID: 2512)

    • Reads the computer name

      • JIL-_Document_No._2500015903.scr (PID: 624)
      • Trading_AIBot.exe (PID: 5008)
      • Microsofts.exe (PID: 4876)
      • JIL-_Document_No._2500015903.scr (PID: 2512)

    • Disables trace logs

      • Microsofts.exe (PID: 4876)

    • Reads the software policy settings

      • Microsofts.exe (PID: 4876)

    • Creates files or folders in the user directory

      • Trading_AIBot.exe (PID: 5008)
      • JIL-_Document_No._2500015903.scr (PID: 2512)

    • Checks proxy server information

      • Microsofts.exe (PID: 4876)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4592)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
12
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe jil-_document_no._2500015903.scr schtasks.exe no specs conhost.exe no specs jil-_document_no._2500015903.scr trading_aibot.exe #SNAKEKEYLOGGER microsofts.exe powershell.exe no specs schtasks.exe no specs conhost.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
624"C:\Users\admin\AppData\Local\Temp\Rar$DIa6320.5907\JIL-_Document_No._2500015903.scr"C:\Users\admin\AppData\Local\Temp\Rar$DIa6320.5907\JIL-_Document_No._2500015903.scr
JIL-_Document_No._2500015903.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Packaged CWA Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia6320.5907\jil-_document_no._2500015903.scr
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
836\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2512"C:\Users\admin\AppData\Local\Temp\Rar$DIa6320.5907\JIL-_Document_No._2500015903.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa6320.5907\JIL-_Document_No._2500015903.scr
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Packaged CWA Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia6320.5907\jil-_document_no._2500015903.scr
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2788"schtasks.exe" /create /tn AccSys /tr "C:\Users\admin\AppData\Roaming\ACCApi\apihost.exe" /st 02:27 /du 23:59 /sc daily /ri 1 /fC:\Windows\SysWOW64\schtasks.exe—Trading_AIBot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
4264"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wextljZWDA" /XML "C:\Users\admin\AppData\Local\Temp\tmpF4C3.tmp"C:\Windows\SysWOW64\schtasks.exe—JIL-_Document_No._2500015903.scr
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
4592"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming\ACCApi' C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—Trading_AIBot.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
4876"C:\Users\admin\AppData\Local\Temp\Microsofts.exe" C:\Users\admin\AppData\Local\Temp\Microsofts.exe
JIL-_Document_No._2500015903.scr
User:
admin
Integrity Level:
MEDIUM
Description:
CloudServices
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\microsofts.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5008"C:\Users\admin\AppData\Local\Temp\Trading_AIBot.exe" C:\Users\admin\AppData\Local\Temp\Trading_AIBot.exe
JIL-_Document_No._2500015903.scr
User:
admin
Integrity Level:
MEDIUM
Description:
Stub
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\trading_aibot.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5308\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 147
Read events
10 109
Write events
25
Delete events
13

Modification events

(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\JIL-_Document_No._2500015903.GZ.zip
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6320) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
5
Suspicious files
2
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2512JIL-_Document_No._2500015903.scrC:\Users\admin\AppData\Roaming\wextljZWDA.exeexecutable
MD5:952A0BEAB1BEB852A79A140548CA5806
SHA256:9F09699182EB81A7A4F31B58B8B7BB4C23A46DCB816C8B5468DEF63437075403
624JIL-_Document_No._2500015903.scrC:\Users\admin\AppData\Local\Temp\Microsofts.exeexecutable
MD5:F6B8018A27BCDBAA35778849B586D31B
SHA256:DDC6B2BD4382D1AE45BEE8F3C4BB19BD20933A55BDF5C2E76C8D6C46BC1516CE
6320WinRAR.exeC:\Users\admin\Desktop\Chine_ana121983D605908193D491920FF33229307FF80688loodatke.PNGimage
MD5:DC156637AEBF04336700A9BC71C78AAD
SHA256:E739A88AC8FB4FEFA998F8DBF4402A8D7A22EB079EDD05BEE412C4D4C99014EB
6320WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6320.5907\JIL-_Document_No._2500015903.screxecutable
MD5:952A0BEAB1BEB852A79A140548CA5806
SHA256:9F09699182EB81A7A4F31B58B8B7BB4C23A46DCB816C8B5468DEF63437075403
2512JIL-_Document_No._2500015903.scrC:\Users\admin\AppData\Local\Temp\tmpF4C3.tmpxml
MD5:24BA1300FD203BF09158CE2B73D4846D
SHA256:BD7D49B250E65AF28AA0DF593964056FEBB97C341DB31D7E9CD0F4D73E9578DE
624JIL-_Document_No._2500015903.scrC:\Users\admin\AppData\Local\Temp\Trading_AIBot.exeexecutable
MD5:E91A1DB64F5262A633465A0AAFF7A0B0
SHA256:F19763B48B2D2CC92E61127DD0B29760A1C630F03AD7F5055FD1ED9C7D439428
4592powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_t5g5spv0.s01.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5008Trading_AIBot.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnkbinary
MD5:FE3BB1D04F34DB1C56850C8206DC3AA3
SHA256:573DF21182D93F02CB4C46B19C8D5D007E4A60604653459B0E95849240FCC1CF
4592powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hdhycgi4.22z.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4592powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:C33FBA8CE2868E2511227DC145D1A9BA
SHA256:CC5124FC607C53D02A3C8F81CC8AAC4633382B8BB11C5E2E51EA8D5293A7211F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
33
DNS requests
20
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6576
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4876
Microsofts.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
—
—
malicious
6316
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6316
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4876
Microsofts.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.185:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
184.30.17.189:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.178
  • 104.126.37.128
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.136
  • 104.126.37.129
  • 104.126.37.176
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.145
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.23
  • 40.126.31.73
  • 40.126.31.67
  • 40.126.31.69
  • 20.190.159.75
  • 20.190.159.2
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
4876
Microsofts.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
2192
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
4876
Microsofts.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
4876
Microsofts.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
4876
Microsofts.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
JIL-_Document_No._2500015903.GZ