File name:

Netflix Valid Email Checker by X-Splinter v2.exe

Full analysis: https://app.any.run/tasks/20bd178f-326c-4c1d-bdb9-c59ac11e40a5
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 31, 2024, 16:36:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
crypto-regex
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1A4DA925D3CFEF0F8040AD9858133181

SHA1:

E912D052C7D778EEF4A3AB320D8C9E8D905147BE

SHA256:

EE5DB783F4FCAA53CA4BABB8DDB6C143BF34307AF0E1F7BE9912494C5D071AAE

SSDEEP:

24576:k+9Vfy/Nl0NUWxIKUpUCDj2bDienr2282x+nWLZsZZQ:kkVfyll0NUWxIDDj2bDPr2282x+nSZsA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Netflix Valid Email Checker by X-Splinter v2.exe (PID: 6404)

    • Changes the autorun value in the registry

      • svcwhost.exe (PID: 6424)
      • relog.exe (PID: 6512)

    • Uses Task Scheduler to run other applications

      • svcwhost.exe (PID: 6424)
      • relog.exe (PID: 6512)

    • Actions looks like stealing of personal data

      • relog.exe (PID: 6512)

    • Runs injected code in another process

      • relog.exe (PID: 6512)

    • Application was injected by another process

      • explorer.exe (PID: 4552)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Netflix Valid Email Checker by X-Splinter v2.exe (PID: 6404)

    • Executable content was dropped or overwritten

      • svcwhost.exe (PID: 6424)
      • Netflix Valid Email Checker by X-Splinter v2.exe (PID: 6404)
      • relog.exe (PID: 6512)

    • Potential Corporate Privacy Violation

      • relog.exe (PID: 6512)

    • Found regular expressions for crypto-addresses (YARA)

      • relog.exe (PID: 6512)

    • Executes application which crashes

      • Netflix_Checker.exe (PID: 3032)

    • Connects to the server without a host name

      • explorer.exe (PID: 4552)

  • INFO

    • Checks supported languages

      • Netflix Valid Email Checker by X-Splinter v2.exe (PID: 6404)
      • svcwhost.exe (PID: 6424)
      • Netflix_Checker.exe (PID: 3032)

    • Creates files or folders in the user directory

      • Netflix Valid Email Checker by X-Splinter v2.exe (PID: 6404)
      • svcwhost.exe (PID: 6424)
      • relog.exe (PID: 6512)
      • WerFault.exe (PID: 5920)

    • Create files in a temporary directory

      • Netflix Valid Email Checker by X-Splinter v2.exe (PID: 6404)
      • relog.exe (PID: 6512)

    • Reads the computer name

      • svcwhost.exe (PID: 6424)
      • Netflix_Checker.exe (PID: 3032)

    • Checks proxy server information

      • relog.exe (PID: 6512)
      • WerFault.exe (PID: 5920)

    • Reads security settings of Internet Explorer

      • relog.exe (PID: 6512)

    • Reads the software policy settings

      • WerFault.exe (PID: 5920)

    • Reads the machine GUID from the registry

      • Netflix_Checker.exe (PID: 3032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:30 23:36:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.4
CodeSize: 104960
InitializedDataSize: 897536
UninitializedDataSize: -
EntryPoint: 0x4a83
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.4.0.0
ProductVersionNumber: 1.4.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (2000)
CharacterSet: Unicode
CompanyName: Software
FileDescription: Software
FileVersion: 1.4.0.0
InternalName: Software.exe
LegalCopyright: Copyright (C) 2024
OriginalFileName: Software.exe
ProductName: Software
ProductVersion: 1.4.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
36
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start netflix valid email checker by x-splinter v2.exe svcwhost.exe schtasks.exe no specs conhost.exe no specs THREAT relog.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs explorer.exe netflix_checker.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
1948\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3032"Netflix_Checker.exe"C:\Users\admin\AppData\Local\Temp\Netflix_Checker.exe
Netflix Valid Email Checker by X-Splinter v2.exe
User:
admin
Company:
Netflix Valid Email Checker
Integrity Level:
MEDIUM
Description:
Netflix Valid Email Checker by X-Splinter v2
Exit code:
3762504530
Version:
1.9.0.9
Modules
Images
c:\users\admin\appdata\local\temp\netflix_checker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4552C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\aepic.dll
5408\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5796schtasks /create /tn "hCdLEzO33i" /tr "C:\Users\admin\AppData\Roaming\{2F33566DA0B91573532102}\Service_{2F33566DA0B91573532102}.exe" /sc onstart /fC:\Windows\System32\schtasks.exe—relog.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5920C:\WINDOWS\SysWOW64\WerFault.exe -u -p 3032 -s 1076C:\Windows\SysWOW64\WerFault.exe
Netflix_Checker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5940\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6296\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6300schtasks /create /tn "dqVEreCGFt" /tr "C:\Users\admin\AppData\Roaming\Sun\Service_Sun.exe" /sc onstart /fC:\Windows\System32\schtasks.exe—relog.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
8 533
Read events
8 510
Write events
23
Delete events
0

Modification events

(PID) Process:(6424) svcwhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\{2F33566DA0B91573532102}\{2F33566DA0B91573532102}.exe
(PID) Process:(6512) relog.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6512) relog.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6512) relog.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6512) relog.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6512) relog.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Service_Adobe
Value:
C:\Users\admin\AppData\Roaming\Adobe\Service_Adobe.exe
(PID) Process:(6512) relog.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Service_com.adobe.dunamis
Value:
C:\Users\admin\AppData\Roaming\com.adobe.dunamis\Service_com.adobe.dunamis.exe
(PID) Process:(6512) relog.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Service_FileZilla
Value:
C:\Users\admin\AppData\Roaming\FileZilla\Service_FileZilla.exe
(PID) Process:(6512) relog.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Service_Macromedia
Value:
C:\Users\admin\AppData\Roaming\Macromedia\Service_Macromedia.exe
(PID) Process:(6512) relog.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Service_Microsoft
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Service_Microsoft.exe
Executable files
18
Suspicious files
4
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
6424svcwhost.exeC:\Users\admin\AppData\Roaming\{2F33566DA0B91573532102}\{2F33566DA0B91573532102}.exeexecutable
MD5:63367FCFDCE16E690248CE76CF966BD6
SHA256:2CAF9C731AED0499A13F7D8EBFB0A12F67A554B8E101F0F888BE4B186CD512D8
6404Netflix Valid Email Checker by X-Splinter v2.exeC:\Users\admin\AppData\Roaming\svcwhost.exeexecutable
MD5:63367FCFDCE16E690248CE76CF966BD6
SHA256:2CAF9C731AED0499A13F7D8EBFB0A12F67A554B8E101F0F888BE4B186CD512D8
6512relog.exeC:\Users\admin\AppData\Roaming\com.adobe.dunamis\Service_com.adobe.dunamis.exeexecutable
MD5:61C5A8E414A47B8CC2C69E1AC4370A35
SHA256:4DA3BFF89FC796886CA615A29A2595C4109F86FFF2A9E699EA1036195719CB3B
6512relog.exeC:\Users\admin\AppData\Roaming\Microsoft\Service_Microsoft.exeexecutable
MD5:61C5A8E414A47B8CC2C69E1AC4370A35
SHA256:4DA3BFF89FC796886CA615A29A2595C4109F86FFF2A9E699EA1036195719CB3B
6512relog.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:B544D6183C9920CEBDA15C7519985ACA
SHA256:F0302B15990AE0C403A6380DF6CB6C9D95CF0D50206DFB3191C100633954A658
6512relog.exeC:\Users\admin\AppData\Local\Temp\SystemUpdate.exeexecutable
MD5:61C5A8E414A47B8CC2C69E1AC4370A35
SHA256:4DA3BFF89FC796886CA615A29A2595C4109F86FFF2A9E699EA1036195719CB3B
6512relog.exeC:\Users\admin\AppData\Roaming\NuGet\Service_NuGet.exeexecutable
MD5:61C5A8E414A47B8CC2C69E1AC4370A35
SHA256:4DA3BFF89FC796886CA615A29A2595C4109F86FFF2A9E699EA1036195719CB3B
5920WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Netflix_Checker._a03529e78cc5e580da3394145ae8e8cc991e2e6_fdeb6c52_7149e272-88a5-4a2a-a7d9-2dc220efca79\Report.wer —
MD5:—
SHA256:—
5920WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Netflix_Checker.exe.3032.dmp —
MD5:—
SHA256:—
6512relog.exeC:\Users\admin\AppData\Roaming\Adobe\Service_Adobe.exeexecutable
MD5:61C5A8E414A47B8CC2C69E1AC4370A35
SHA256:4DA3BFF89FC796886CA615A29A2595C4109F86FFF2A9E699EA1036195719CB3B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
50
DNS requests
18
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6512
relog.exe
GET
200
176.111.174.140:80
http://176.111.174.140/event.php
unknown
—
—
unknown
6512
relog.exe
GET
200
176.111.174.140:80
http://176.111.174.140/api/update.pack
unknown
—
—
suspicious
6512
relog.exe
GET
200
176.111.174.140:80
http://176.111.174.140/api/update2.pack
unknown
—
—
suspicious
4552
explorer.exe
POST
200
176.111.174.140:80
http://176.111.174.140/api.php?{2F33566DA0B91573532102}
unknown
—
—
suspicious
4552
explorer.exe
POST
200
176.111.174.140:80
http://176.111.174.140/api.php?{2F33566DA0B91573532102}
unknown
—
—
unknown
4552
explorer.exe
POST
200
176.111.174.140:80
http://176.111.174.140/api.php?{2F33566DA0B91573532102}
unknown
—
—
unknown
6588
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6564
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2272
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2536
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6012
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
6512
relog.exe
176.111.174.140:80
—
Chang Way Technologies Co. Limited
RU
unknown
4552
explorer.exe
176.111.174.140:80
—
Chang Way Technologies Co. Limited
RU
unknown
4
System
192.168.100.255:137
—
—
—
unknown
2536
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5920
WerFault.exe
20.189.173.21:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
unknown
google.com
  • 142.250.186.174
unknown
watson.events.data.microsoft.com
  • 20.189.173.21
unknown
www.bing.com
  • 92.123.104.62
  • 92.123.104.47
  • 92.123.104.57
  • 92.123.104.54
  • 92.123.104.50
  • 92.123.104.64
  • 92.123.104.61
  • 92.123.104.60
  • 92.123.104.46
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
login.live.com
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.133
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.134
unknown
client.wns.windows.com
  • 40.113.110.67
  • 40.115.3.253
unknown
fd.api.iris.microsoft.com
  • 20.199.58.43
unknown
th.bing.com
  • 92.123.104.10
  • 92.123.104.12
  • 92.123.104.5
  • 92.123.104.13
  • 92.123.104.11
  • 92.123.104.66
  • 92.123.104.7
  • 92.123.104.9
  • 92.123.104.8
unknown
arc.msn.com
  • 20.103.156.88
unknown

Threats

PID
Process
Class
Message
6512
relog.exe
A suspicious filename was detected
ET HUNTING Terse Named Filename EXE Download - Possibly Hostile
6512
relog.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 30
6512
relog.exe
Misc Attack
ET DROP Dshield Block Listed Source group 1
6512
relog.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6512
relog.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6512
relog.exe
Misc activity
ET INFO EXE - Served Inline HTTP
6512
relog.exe
A suspicious filename was detected
ET HUNTING Terse Named Filename EXE Download - Possibly Hostile
6512
relog.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6512
relog.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6512
relog.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Netflix Valid Email Checker by X-Splinter v2.exe