File name:

DOCS LAZ21123066.exe

Full analysis: https://app.any.run/tasks/f6e9e871-d5a3-4938-b943-9652a69875cc
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: April 19, 2025, 00:26:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
snake
keylogger
stealer
evasion
auto-startup
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

9ED19FD66C7D653137F7554B1A8DC934

SHA1:

0D2EF6F21F5C60F9EE044A6505F34560706BECE6

SHA256:

A266D6977872AFD73E5334BE2D16ED9002DE1B208D5C3021A5D31AE5C8F9C5F9

SSDEEP:

49152:Adx631G26EMWNBnPwp+ryVO/V+s8iDFV4+Xve6OfUYuaxh5rRYOAMDBwQCoYQOzW:r1GlDeOcDF29FRugCOAMdwTQOtU26

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • DOCS LAZ21123066.exe (PID: 5216)

    • Actions looks like stealing of personal data

      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)

    • Steals credentials from Web Browsers

      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • DOCS LAZ21123066.exe (PID: 5216)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 664)

    • The process verifies whether the antivirus software is installed

      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)

  • INFO

    • Reads the computer name

      • DOCS LAZ21123066.exe (PID: 5216)
      • InstallUtil.exe (PID: 7084)
      • IsClosed.exe (PID: 6808)
      • InstallUtil.exe (PID: 6640)

    • Creates files or folders in the user directory

      • DOCS LAZ21123066.exe (PID: 5216)

    • Auto-launch of the file from Startup directory

      • DOCS LAZ21123066.exe (PID: 5216)

    • Reads the machine GUID from the registry

      • DOCS LAZ21123066.exe (PID: 5216)
      • InstallUtil.exe (PID: 7084)
      • IsClosed.exe (PID: 6808)
      • InstallUtil.exe (PID: 6640)

    • Manual execution by a user

      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)
      • wscript.exe (PID: 664)

    • Checks supported languages

      • DOCS LAZ21123066.exe (PID: 5216)
      • InstallUtil.exe (PID: 7084)
      • IsClosed.exe (PID: 6808)
      • InstallUtil.exe (PID: 6640)

    • Disables trace logs

      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)

    • Reads the software policy settings

      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)
      • slui.exe (PID: 3900)

    • Checks proxy server information

      • InstallUtil.exe (PID: 7084)
      • InstallUtil.exe (PID: 6640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (62)
.exe | Win64 Executable (generic) (23.3)
.dll | Win32 Dynamic Link Library (generic) (5.5)
.exe | Win32 Executable (generic) (3.8)
.exe | Win16/32 Executable Delphi generic (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:18 08:17:59+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 1051136
InitializedDataSize: 182272
UninitializedDataSize: -
EntryPoint: 0x10288e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.8601.21802
ProductVersionNumber: 1.0.8601.21802
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Taugipqnrid
FileVersion: 1.0.8601.21802
InternalName: Taugipqnrid.exe
LegalCopyright: Copyright © 2016
LegalTrademarks: -
OriginalFileName: Taugipqnrid.exe
ProductName: Taugipqnrid
ProductVersion: 1.0.8601.21802
AssemblyVersion: 1.0.8088.5703
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
9
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start docs laz21123066.exe #SNAKEKEYLOGGER installutil.exe sppextcomobj.exe no specs slui.exe svchost.exe wscript.exe no specs isclosed.exe no specs #SNAKEKEYLOGGER installutil.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664wscript "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsClosed.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1096C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3900"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5216"C:\Users\admin\AppData\Local\Temp\DOCS LAZ21123066.exe" C:\Users\admin\AppData\Local\Temp\DOCS LAZ21123066.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Taugipqnrid
Exit code:
4294967295
Version:
1.0.8601.21802
Modules
Images
c:\users\admin\appdata\local\temp\docs laz21123066.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5776C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6640"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6808"C:\Users\admin\AppData\Roaming\IsClosed.exe" C:\Users\admin\AppData\Roaming\IsClosed.exe—wscript.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Taugipqnrid
Exit code:
4294967295
Version:
1.0.8601.21802
Modules
Images
c:\users\admin\appdata\roaming\isclosed.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7084"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
3 333
Read events
3 319
Write events
14
Delete events
0

Modification events

(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7084) InstallUtil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\InstallUtil_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
5216DOCS LAZ21123066.exeC:\Users\admin\AppData\Roaming\IsClosed.exeexecutable
MD5:9ED19FD66C7D653137F7554B1A8DC934
SHA256:A266D6977872AFD73E5334BE2D16ED9002DE1B208D5C3021A5D31AE5C8F9C5F9
5216DOCS LAZ21123066.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsClosed.vbstext
MD5:6AC1D10B99E6EE955EFABE8AAAF005D3
SHA256:A12F20865A14013D1ECE974D507A9A485442B1D5A9F5B4A303443B3FF1197AC5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
25
DNS requests
18
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7084
InstallUtil.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6640
InstallUtil.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7084
InstallUtil.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6640
InstallUtil.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
5392
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5392
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7084
InstallUtil.exe
132.226.247.73:80
checkip.dyndns.org
ORACLE-BMC-31898
BR
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7084
InstallUtil.exe
104.21.80.1:443
reallyfreegeoip.org
CLOUDFLARENET
—
malicious
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
checkip.dyndns.org
  • 132.226.247.73
  • 193.122.130.0
  • 193.122.6.168
  • 132.226.8.169
  • 158.101.44.242
whitelisted
login.live.com
  • 20.190.160.64
  • 40.126.32.68
  • 20.190.160.5
  • 40.126.32.138
  • 20.190.160.132
  • 40.126.32.134
  • 20.190.160.2
  • 20.190.160.3
whitelisted
reallyfreegeoip.org
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.48.1
  • 104.21.16.1
  • 104.21.64.1
malicious
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
7084
InstallUtil.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7084
InstallUtil.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
7084
InstallUtil.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
7084
InstallUtil.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6640
InstallUtil.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6640
InstallUtil.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6640
InstallUtil.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DOCS LAZ21123066.exe