File name:

99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe

Full analysis: https://app.any.run/tasks/21e4a62e-e4ba-4fd4-a581-6a7246455c95
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: April 24, 2026, 04:43:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
stealer
agenttesla
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

D59C1D8398BA61756A9865D96A502B1C

SHA1:

D1D8821BB9F5B97DC12904E58E040337EF8A58D0

SHA256:

99BF83BAB6B3FA1205EB86A8C9ED9332A006FE63FF6D263847DE7D53EE932DE3

SSDEEP:

49152:IiU3NUmrccnxDfosfKrkOSfiD7nIUOuvmL42Z4INtSSfJyA/jDfQI2OU/Geg7AHX:e3fDorVSfc7nIPkGygwayA7DffU/Gb7s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)

    • Steals credentials from Web Browsers

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)

    • AGENTTESLA has been detected (YARA)

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)

  • SUSPICIOUS

    • Application launched itself

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7096)

    • Checks for external IP

      • svchost.exe (PID: 2232)
      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)

    • Possible stealing from browsers

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)

    • Possible stealing of email data

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)

    • Connects to FTP

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)

  • INFO

    • Checks supported languages

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7096)
      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)

    • Disables trace logs

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)

    • Reads the machine GUID from the registry

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)
      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7096)

    • Reads the computer name

      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7728)
      • 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe (PID: 7096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2026:04:23 09:17:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 931328
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xe545a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Simple Atmospheric Chemistry Network
CompanyName: -
FileDescription: AtmosphericNetwork
FileVersion: 1.0.0.0
InternalName: KBry.exe
LegalCopyright: Copyright © 2026
LegalTrademarks: -
OriginalFileName: KBry.exe
ProductName: AtmosphericNetwork
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe no specs slui.exe 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe no specs #AGENTTESLA 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2232C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2308C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6424"C:\Users\admin\Desktop\99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe"C:\Users\admin\Desktop\99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe—99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AtmosphericNetwork
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7096"C:\Users\admin\Desktop\99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe" C:\Users\admin\Desktop\99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AtmosphericNetwork
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7728"C:\Users\admin\Desktop\99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe"C:\Users\admin\Desktop\99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe
99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AtmosphericNetwork
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
4 534
Read events
4 519
Write events
15
Delete events
0

Modification events

(PID) Process:(2308) slui.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@%SystemRoot%\System32\sppcomapi.dll,-3200
Value:
Software Licensing
(PID) Process:(7728) 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7728) 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7728) 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7728) 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7728) 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7728) 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7728) 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7728) 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7728) 99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
24
DNS requests
12
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
6076
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
2308
slui.exe
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
6076
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
2308
slui.exe
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
3280
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
US
binary
814 b
whitelisted
3280
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
US
binary
813 b
whitelisted
7728
99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
US
text
6 b
malicious
3280
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
US
binary
400 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7312
slui.exe
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6076
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
95.101.23.43:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
6076
svchost.exe
23.216.77.28:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6076
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
2308
slui.exe
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted
www.bing.com
  • 95.101.23.43
  • 95.101.23.83
  • 95.101.23.81
whitelisted
google.com
  • 142.251.14.139
  • 142.251.14.113
  • 142.251.14.100
  • 142.251.14.102
  • 142.251.14.101
  • 142.251.14.138
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.52.181.212
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
ftp.transotraval.cl
  • 201.148.104.110
unknown
self.events.data.microsoft.com
  • 13.89.179.9
whitelisted

Threats

PID
Process
Class
Message
5276
MoUsoCoreWorker.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2232
svchost.exe
Misc activity
INFO [ANY.RUN] External IP Check (ip-api .com)
2232
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7728
99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
7728
99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe
A Network Trojan was detected
ET MALWARE Common Stealer Behavior - Source IP Associated with Hosting Provider Check via ip.api .com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
99bf83bab6b3fa1205eb86a8c9ed9332a006fe63ff6d263847de7d53ee932de3.exe