File name:

b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20

Full analysis: https://app.any.run/tasks/e3dc7f52-6c3c-49d0-8e3a-39b40472065c
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 00:51:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
evasion
stealer
ultravnc
rmm-tool
exfiltration
smtp
agenttesla
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

12F1F16D5EB1D9BF2440524C1033E8E1

SHA1:

F8CCB55F53D846F6D017DDA0A5A9083B309F0568

SHA256:

B8068C2CC437CDE14517E2B16AAEFC85F9911678499E956CF7F57BEA0C6A0F20

SSDEEP:

49152:0RnuBD7tSq0QcNj+NM2bm5JcxboHf2ZIfDdLc3LVd4Z/c5GdgCB2hgvRzpg5fVBV:+uBftSXNj+NM2bm5JcxboHf2ZCDdLc3h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • nonhazardousness.exe (PID: 1272)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 496)
      • RegSvcs.exe (PID: 5452)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 496)
      • RegSvcs.exe (PID: 5452)

    • AGENTTESLA has been detected (YARA)

      • RegSvcs.exe (PID: 5452)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe (PID: 4008)

    • Starts itself from another location

      • b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe (PID: 4008)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • RegSvcs.exe (PID: 496)
      • RegSvcs.exe (PID: 5452)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6752)

    • Connects to SMTP port

      • RegSvcs.exe (PID: 5452)

    • The process connected to a server suspected of theft

      • RegSvcs.exe (PID: 5452)

  • INFO

    • Reads mouse settings

      • b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe (PID: 4008)
      • nonhazardousness.exe (PID: 1272)
      • nonhazardousness.exe (PID: 6620)

    • The sample compiled with english language support

      • b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe (PID: 4008)

    • Checks supported languages

      • b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe (PID: 4008)
      • nonhazardousness.exe (PID: 1272)
      • RegSvcs.exe (PID: 496)
      • nonhazardousness.exe (PID: 6620)
      • RegSvcs.exe (PID: 5452)

    • Create files in a temporary directory

      • b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe (PID: 4008)
      • nonhazardousness.exe (PID: 1272)
      • nonhazardousness.exe (PID: 6620)

    • Reads the machine GUID from the registry

      • b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe (PID: 4008)
      • RegSvcs.exe (PID: 5452)
      • RegSvcs.exe (PID: 496)

    • Creates files or folders in the user directory

      • b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe (PID: 4008)
      • nonhazardousness.exe (PID: 1272)

    • Auto-launch of the file from Startup directory

      • nonhazardousness.exe (PID: 1272)

    • Reads the computer name

      • RegSvcs.exe (PID: 496)
      • RegSvcs.exe (PID: 5452)

    • Manual execution by a user

      • wscript.exe (PID: 6752)

    • ULTRAVNC has been detected

      • RegSvcs.exe (PID: 496)
      • RegSvcs.exe (PID: 5452)

    • Disables trace logs

      • RegSvcs.exe (PID: 5452)
      • RegSvcs.exe (PID: 496)

    • Checks proxy server information

      • RegSvcs.exe (PID: 5452)
      • RegSvcs.exe (PID: 496)

    • Reads the software policy settings

      • slui.exe (PID: 6404)
      • RegSvcs.exe (PID: 5452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AgentTesla

(PID) Process(5452) RegSvcs.exe
Protocolsmtp
Hostmail.xma0.com
Port587
Username[email protected]
Passwordlondon@1759
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:25 00:12:09+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 570880
InitializedDataSize: 496128
UninitializedDataSize: -
EntryPoint: 0x25f74
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
10
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe nonhazardousness.exe regsvcs.exe sppextcomobj.exe no specs slui.exe wscript.exe no specs svchost.exe nonhazardousness.exe no specs #AGENTTESLA regsvcs.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Users\admin\AppData\Local\Temp\b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
nonhazardousness.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1272"C:\Users\admin\AppData\Local\Temp\b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe" C:\Users\admin\AppData\Local\troopwise\nonhazardousness.exe
b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\troopwise\nonhazardousness.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1276C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4008"C:\Users\admin\AppData\Local\Temp\b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe" C:\Users\admin\AppData\Local\Temp\b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
5384C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5452"C:\Users\admin\AppData\Local\troopwise\nonhazardousness.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
nonhazardousness.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
AgentTesla
(PID) Process(5452) RegSvcs.exe
Protocolsmtp
Hostmail.xma0.com
Port587
Username[email protected]
Passwordlondon@1759
6404"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6620"C:\Users\admin\AppData\Local\troopwise\nonhazardousness.exe" C:\Users\admin\AppData\Local\troopwise\nonhazardousness.exe—wscript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\troopwise\nonhazardousness.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
6752wscript "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nonhazardousness.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 277
Read events
3 263
Write events
14
Delete events
0

Modification events

(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(496) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
5
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4008b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exeC:\Users\admin\AppData\Local\Temp\autCF58.tmpbinary
MD5:BC92D06BE8236F21E4A90BCF922F5E7D
SHA256:BA77825CA1AB08AC04B009124586B8984217774DFCFD832F87AD88D5A83B354E
1272nonhazardousness.exeC:\Users\admin\AppData\Local\Temp\autD563.tmpbinary
MD5:BC92D06BE8236F21E4A90BCF922F5E7D
SHA256:BA77825CA1AB08AC04B009124586B8984217774DFCFD832F87AD88D5A83B354E
1272nonhazardousness.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nonhazardousness.vbsbinary
MD5:6C69004B042AB8CC94511490B52E74FD
SHA256:5E472C21EEDCAEA49FCCA3F3AC3C85048B9D288B4FD9B7E485656F4BAD04DF3A
4008b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exeC:\Users\admin\AppData\Local\Temp\lardsbinary
MD5:D1A7D13ED1953916EFD10163E85BE5B4
SHA256:34EDC9150E98612108A8E04D8A64EED4EF42B61430893F5865956664DC7B49DE
6620nonhazardousness.exeC:\Users\admin\AppData\Local\Temp\autF5DB.tmpbinary
MD5:BC92D06BE8236F21E4A90BCF922F5E7D
SHA256:BA77825CA1AB08AC04B009124586B8984217774DFCFD832F87AD88D5A83B354E
4008b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20.exeC:\Users\admin\AppData\Local\troopwise\nonhazardousness.exeexecutable
MD5:12F1F16D5EB1D9BF2440524C1033E8E1
SHA256:B8068C2CC437CDE14517E2B16AAEFC85F9911678499E956CF7F57BEA0C6A0F20
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
23
DNS requests
15
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
496
RegSvcs.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
5452
RegSvcs.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
1132
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1132
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
104.75.232.13:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.75.232.13:80
ocsp.digicert.com
Akamai International B.V.
FR
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
496
RegSvcs.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
5452
RegSvcs.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.166
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.129
  • 20.190.159.0
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.130
  • 20.190.159.2
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 104.75.232.13
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
mail.xma0.com
  • 51.195.65.154
malicious
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
—
—
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
—
—
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b8068c2cc437cde14517e2b16aaefc85f9911678499e956cf7f57bea0c6a0f20