File name:

20250325252508951.zip

Full analysis: https://app.any.run/tasks/0c56fa2c-2d56-4311-8a9f-22b6c9cc0fda
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 00:09:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
evasion
snake
keylogger
stealer
telegram
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

AC9EC04DE5551D9F6AFCD50BF35F271C

SHA1:

600FB5ADF00AE93B8A2300E22EA906D70163053A

SHA256:

CEE4678D0F673696FD75F55B77367A394CDDC60CC4C499045F72CFC6D23EEB5D

SSDEEP:

98304:SI/POWMTVplk2C2+PSrnFInGQy3hu9naA2Au1bvSOvukFJQUIWajFDzoDvZpSsHA:incr37xj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6708)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 6272)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 6272)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 6272)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6272)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 6272)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 7348)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7452)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • RegSvcs.exe (PID: 7840)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 7848)
      • RegSvcs.exe (PID: 7840)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 7848)
      • RegSvcs.exe (PID: 7840)

  • SUSPICIOUS

    • The process executes VB scripts

      • WinRAR.exe (PID: 6708)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 6272)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6708)
      • ShellExperienceHost.exe (PID: 8056)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6272)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7348)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 6272)

    • Executing commands from ".cmd" file

      • wscript.exe (PID: 6272)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6272)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 6272)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 6272)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 7348)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7452)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 7452)

    • Process uses IPCONFIG to discard the IP address configuration

      • powershell.exe (PID: 7452)

    • The process executes Powershell scripts

      • cmd.exe (PID: 7348)

    • Starts a Microsoft application from unusual location

      • RegSvcs.exe (PID: 7840)
      • RegSvcs.exe (PID: 7848)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 7452)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • RegSvcs.exe (PID: 7848)
      • RegSvcs.exe (PID: 7840)

    • Process uses IPCONFIG to renew DHCP configuration

      • powershell.exe (PID: 7452)

    • The process verifies whether the antivirus software is installed

      • RegSvcs.exe (PID: 7840)
      • RegSvcs.exe (PID: 7848)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • RegSvcs.exe (PID: 7840)
      • RegSvcs.exe (PID: 7848)

  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7788)
      • BackgroundTransferHost.exe (PID: 7680)
      • BackgroundTransferHost.exe (PID: 8000)
      • BackgroundTransferHost.exe (PID: 7424)
      • BackgroundTransferHost.exe (PID: 6640)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6708)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7680)

    • Checks proxy server information

      • wscript.exe (PID: 6272)
      • powershell.exe (PID: 7452)
      • RegSvcs.exe (PID: 7848)
      • RegSvcs.exe (PID: 7840)
      • BackgroundTransferHost.exe (PID: 7680)

    • The sample compiled with english language support

      • powershell.exe (PID: 7452)

    • Disables trace logs

      • powershell.exe (PID: 7452)
      • RegSvcs.exe (PID: 7840)
      • RegSvcs.exe (PID: 7848)

    • The executable file from the user directory is run by the Powershell process

      • RegSvcs.exe (PID: 7840)
      • RegSvcs.exe (PID: 7848)

    • Checks supported languages

      • RegSvcs.exe (PID: 7840)
      • RegSvcs.exe (PID: 7848)
      • ShellExperienceHost.exe (PID: 8056)

    • Reads the computer name

      • RegSvcs.exe (PID: 7840)
      • RegSvcs.exe (PID: 7848)
      • ShellExperienceHost.exe (PID: 8056)

    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 7840)
      • RegSvcs.exe (PID: 7848)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7452)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7452)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 7452)

    • Reads the software policy settings

      • RegSvcs.exe (PID: 7840)
      • RegSvcs.exe (PID: 7848)
      • BackgroundTransferHost.exe (PID: 7680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:03:24 21:32:48
ZipCRC: 0xd43a8f44
ZipCompressedSize: 2716053
ZipUncompressedSize: 6053056
ZipFileName: 20250325252508951.vbs
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
18
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs wscript.exe cmd.exe no specs conhost.exe no specs powershell.exe ipconfig.exe no specs #SNAKEKEYLOGGER regsvcs.exe regsvcs.exe svchost.exe shellexperiencehost.exe no specs ipconfig.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1348"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6032C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6272"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa6708.18008\20250325252508951.vbs" C:\Windows\System32\wscript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6640"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6708"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\20250325252508951.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7348C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\WindowsUpdate\YINHF.cmd" "C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
7424"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7452PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command C:\Users\admin\AppData\Roaming\WindowsUpdate\JBPPY.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7624\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
15 707
Read events
15 645
Write events
62
Delete events
0

Modification events

(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\20250325252508951.zip
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6708) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7424) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7424) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
1
Suspicious files
10
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
7680BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f05830a5-98b9-44b2-9e1b-19bf9bd958e1.down_data —
MD5:—
SHA256:—
6708WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6708.18008\20250325252508951.vbs —
MD5:—
SHA256:—
7680BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
7680BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3c6572ce-8480-4d00-8120-51312835e95a.up_meta_securebinary
MD5:F85445A9EF6D2C2794A04339ADA6F84D
SHA256:44503D74182533618AC633371A60087EE3DEA10514853D57293841C89383B896
6272wscript.exeC:\Users\admin\AppData\Roaming\WindowsUpdate\YINHF.cmdtext
MD5:78F6DEF0BD0A8B0CAEF8ED1EA66A5AC8
SHA256:498E716ACD98B6597304B4E16F3260B6168BDF473B56B825B47FD70BAE2D5200
7680BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:0AD5AAFEB8A430853BF2B7665BB3E905
SHA256:4A530298D6424AA57AFC62150EB878BD267E750A6EA3B40D7711320886FABD5F
7680BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3c6572ce-8480-4d00-8120-51312835e95a.2c3a5598-fb86-4600-9707-df432b07ddb4.down_metabinary
MD5:339295B4336C1A522089162C087EE24D
SHA256:5C969FFEC88C51744A010C68EE728924C874561B5DC06997C8552121AC71A3B3
6272wscript.exeC:\Users\admin\AppData\Roaming\WindowsUpdate\WXIGZ.tmptext
MD5:65398BFE407191095772CCA3A303A916
SHA256:3D0F202E54B090FECB55DDE7C97EC6D53BE45037B3567DC07F0D8ECEED744496
7452powershell.exeC:\Users\admin\AppData\Local\Temp\RegSvcs.exeexecutable
MD5:6279D136310C22894F605938B4CB93D8
SHA256:FB7D514B3322810463655473D2D7C704D3405C1C9DD81F0D4D423518EF416987
6272wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:237101A053BCD1494815E8CFA6E60A35
SHA256:8222E28BE63A494212E7D6415BA09611890F214A190D80569536904BDEF01DEE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
33
DNS requests
18
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4988
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7680
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7476
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7476
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7848
RegSvcs.exe
GET
502
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7840
RegSvcs.exe
GET
502
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7848
RegSvcs.exe
GET
502
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7840
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4988
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.65
  • 20.190.160.67
  • 40.126.32.134
  • 20.190.160.130
  • 40.126.32.68
  • 40.126.32.138
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
7840
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7840
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
7840
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
7840
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
7840
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
7840
RegSvcs.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
7848
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
20250325252508951.zip