File name:

a5c1c0eb16016e22e2df4c09e91929d0f1aa4dc55c4e3d3f6d1b33918589eb5a.zip

Full analysis: https://app.any.run/tasks/b196e527-3a54-4dd8-a90b-dd8c0a015f4f
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: August 01, 2025, 05:36:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
auto-sch-xml
snake
keylogger
evasion
stealer
ims-api
generic
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

08C5F7DE76B6ADAA973ADE0FD97E9027

SHA1:

A2DAE2B8A0C2B6EBB777D5C028617F0C0B30CD99

SHA256:

A5C1C0EB16016E22E2DF4C09E91929D0F1AA4DC55C4E3D3F6D1B33918589EB5A

SSDEEP:

12288:LgM7QCD80J2X2HYx+dqOm6wi4l/Zd1pYDG131lHMn:LgM7F4W2X+Yx776wtl/f1p331lsn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 1156)

    • Uses Task Scheduler to run other applications

      • PO#240145.bat (PID: 504)
      • FSEUWuGde.exe (PID: 6748)

    • Actions looks like stealing of personal data

      • FSEUWuGde.exe (PID: 1156)
      • PO#240145.bat (PID: 2384)

    • Generic archive extractor

      • WinRAR.exe (PID: 6492)

    • Steals credentials from Web Browsers

      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 1156)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • PO#240145.bat (PID: 504)

    • Reads security settings of Internet Explorer

      • PO#240145.bat (PID: 504)
      • FSEUWuGde.exe (PID: 6748)
      • WinRAR.exe (PID: 6492)

    • The process verifies whether the antivirus software is installed

      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 1156)

    • Checks for external IP

      • svchost.exe (PID: 2200)
      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 1156)

    • Application launched itself

      • PO#240145.bat (PID: 504)
      • FSEUWuGde.exe (PID: 6748)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 1156)

    • Connects to SMTP port

      • FSEUWuGde.exe (PID: 1156)
      • PO#240145.bat (PID: 2384)

    • Suspicious files were dropped or overwritten

      • WinRAR.exe (PID: 6492)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 6492)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 6492)

    • Executable content was dropped or overwritten

      • PO#240145.bat (PID: 504)

  • INFO

    • Manual execution by a user

      • PO#240145.bat (PID: 504)
      • FSEUWuGde.exe (PID: 6748)

    • Creates files or folders in the user directory

      • PO#240145.bat (PID: 504)

    • Create files in a temporary directory

      • PO#240145.bat (PID: 504)
      • FSEUWuGde.exe (PID: 6748)
      • MpCmdRun.exe (PID: 4120)

    • Process checks computer location settings

      • PO#240145.bat (PID: 504)
      • FSEUWuGde.exe (PID: 6748)

    • Disables trace logs

      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 1156)

    • Checks supported languages

      • PO#240145.bat (PID: 504)
      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 6748)
      • MpCmdRun.exe (PID: 4120)
      • FSEUWuGde.exe (PID: 1156)

    • Reads the software policy settings

      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 1156)
      • slui.exe (PID: 4948)

    • Reads the machine GUID from the registry

      • PO#240145.bat (PID: 2384)
      • PO#240145.bat (PID: 504)
      • FSEUWuGde.exe (PID: 6748)
      • FSEUWuGde.exe (PID: 1156)

    • Reads the computer name

      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 1156)
      • FSEUWuGde.exe (PID: 6748)
      • MpCmdRun.exe (PID: 4120)
      • PO#240145.bat (PID: 504)

    • Checks proxy server information

      • PO#240145.bat (PID: 2384)
      • FSEUWuGde.exe (PID: 1156)
      • slui.exe (PID: 4948)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:07:31 20:59:02
ZipCRC: 0x3063530a
ZipCompressedSize: 463256
ZipUncompressedSize: 550920
ZipFileName: PO#240145.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
14
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe po#240145.bat schtasks.exe no specs conhost.exe no specs #SNAKEKEYLOGGER po#240145.bat svchost.exe fseuwugde.exe no specs schtasks.exe no specs conhost.exe no specs #SNAKEKEYLOGGER fseuwugde.exe slui.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
72\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
504"C:\Users\admin\Desktop\PO#240145.bat" C:\Users\admin\Desktop\PO#240145.bat
explorer.exe
User:
admin
Company:
晶彩遊戲工作室
Integrity Level:
MEDIUM
Description:
三鍵反應遊戲
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\po#240145.bat
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1156"C:\Users\admin\AppData\Roaming\FSEUWuGde.exe"C:\Users\admin\AppData\Roaming\FSEUWuGde.exe
FSEUWuGde.exe
User:
admin
Company:
晶彩遊戲工作室
Integrity Level:
MEDIUM
Description:
三鍵反應遊戲
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\fseuwugde.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2384"C:\Users\admin\Desktop\PO#240145.bat"C:\Users\admin\Desktop\PO#240145.bat
PO#240145.bat
User:
admin
Company:
晶彩遊戲工作室
Integrity Level:
MEDIUM
Description:
三鍵反應遊戲
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\po#240145.bat
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3896"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FSEUWuGde" /XML "C:\Users\admin\AppData\Local\Temp\tmp749A.tmp"C:\Windows\SysWOW64\schtasks.exe—FSEUWuGde.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4120"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR6492.49905"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
4948C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5468C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR6492.49905\Rar$Scan97877.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6172\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
13 843
Read events
13 805
Write events
38
Delete events
0

Modification events

(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\a5c1c0eb16016e22e2df4c09e91929d0f1aa4dc55c4e3d3f6d1b33918589eb5a.zip
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6492) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2384) PO#240145.batKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#240145_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2384) PO#240145.batKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#240145_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
2
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
504PO#240145.batC:\Users\admin\AppData\Roaming\FSEUWuGde.exeexecutable
MD5:F11B7752D4D90ABCE909F3C580AEDD1C
SHA256:F6DC3F5E765A384C8317D418BE852E6B1909B89B2F90EA5483858FCA4CFFED4F
504PO#240145.batC:\Users\admin\AppData\Local\Temp\tmp2B2D.tmpxml
MD5:896313A9DE4B05FA75157B23A0DEF7B7
SHA256:8F7F331BAE4EC6C27A50C2F0BAD67BD87213E4EB3C7AD96382B2840BE1F36FA9
6748FSEUWuGde.exeC:\Users\admin\AppData\Local\Temp\tmp749A.tmpxml
MD5:896313A9DE4B05FA75157B23A0DEF7B7
SHA256:8F7F331BAE4EC6C27A50C2F0BAD67BD87213E4EB3C7AD96382B2840BE1F36FA9
4120MpCmdRun.exeC:\Users\admin\AppData\Local\Temp\MpCmdRun.logtext
MD5:C971152AA48A3AC3E63FE9C550955011
SHA256:3ED987727C66B677F8192ABCB22E80D98C5CE6366AFC5B258D435CFE25A20B0E
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6492.49905\a5c1c0eb16016e22e2df4c09e91929d0f1aa4dc55c4e3d3f6d1b33918589eb5a.zip\PO#240145.batexecutable
MD5:F11B7752D4D90ABCE909F3C580AEDD1C
SHA256:F6DC3F5E765A384C8317D418BE852E6B1909B89B2F90EA5483858FCA4CFFED4F
6492WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR6492.49905\Rar$Scan97877.battext
MD5:7E8310A7812A51BD6DA0FCE9E0822927
SHA256:88A497CBF6800A9ABACF35BA7F63F2442EBDB8F7DBE711F8C39D9F8A6FA00C4C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
25
DNS requests
10
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4944
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4944
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2384
PO#240145.bat
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
2384
PO#240145.bat
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
2384
PO#240145.bat
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
—
—
GET
200
104.21.80.1:443
https://reallyfreegeoip.org/xml/109.26.61.227
unknown
text
352 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4944
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4944
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
checkip.dyndns.org
  • 132.226.247.73
  • 193.122.6.168
  • 193.122.130.0
  • 158.101.44.242
  • 132.226.8.169
whitelisted
reallyfreegeoip.org
  • 104.21.96.1
  • 104.21.80.1
  • 104.21.64.1
  • 104.21.32.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.48.1
malicious
cphost14.qhoster.net
  • 78.110.166.82
malicious
self.events.data.microsoft.com
  • 20.42.65.89
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
2384
PO#240145.bat
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2384
PO#240145.bat
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2200
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
2384
PO#240145.bat
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2384
PO#240145.bat
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
2200
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
2384
PO#240145.bat
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
1156
FSEUWuGde.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
1156
FSEUWuGde.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
a5c1c0eb16016e22e2df4c09e91929d0f1aa4dc55c4e3d3f6d1b33918589eb5a.zip