File name:

New Order Inquiry.exe

Full analysis: https://app.any.run/tasks/3e34baf6-8c37-48f1-8c86-68c90a059069
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:09:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
snake
keylogger
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

EFB4EF0D97CA2061BA6FAF3D526C8E10

SHA1:

BE2553E46FAB38E8277C748083145B7A066D5BDD

SHA256:

EEBCEA4D611B0D633F72D2224F4DC09D2E7A606B87F3AB1A3FC3DB0B7AD9150F

SSDEEP:

49152:gHlGAXWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZW:xAGQX21RBt7QjTmcaTH/vU4do9Pcjq1j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Hymenophyllaceae.exe (PID: 1852)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • New Order Inquiry.exe (PID: 6044)

    • Starts itself from another location

      • New Order Inquiry.exe (PID: 6044)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6740)

    • The process verifies whether the antivirus software is installed

      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)

  • INFO

    • Create files in a temporary directory

      • New Order Inquiry.exe (PID: 6044)
      • Hymenophyllaceae.exe (PID: 1852)
      • Hymenophyllaceae.exe (PID: 920)

    • Reads mouse settings

      • New Order Inquiry.exe (PID: 6044)
      • Hymenophyllaceae.exe (PID: 1852)
      • Hymenophyllaceae.exe (PID: 920)

    • The sample compiled with english language support

      • New Order Inquiry.exe (PID: 6044)

    • Checks supported languages

      • New Order Inquiry.exe (PID: 6044)
      • Hymenophyllaceae.exe (PID: 1852)
      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)
      • Hymenophyllaceae.exe (PID: 920)

    • Reads the machine GUID from the registry

      • New Order Inquiry.exe (PID: 6044)
      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)

    • Creates files or folders in the user directory

      • New Order Inquiry.exe (PID: 6044)
      • Hymenophyllaceae.exe (PID: 1852)
      • BackgroundTransferHost.exe (PID: 4688)

    • Autorun file from Startup directory

      • Hymenophyllaceae.exe (PID: 1852)

    • Reads the computer name

      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)

    • Disables trace logs

      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)

    • Checks proxy server information

      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)
      • BackgroundTransferHost.exe (PID: 4688)

    • Manual execution by a user

      • wscript.exe (PID: 6740)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 2420)
      • BackgroundTransferHost.exe (PID: 4688)
      • BackgroundTransferHost.exe (PID: 728)
      • BackgroundTransferHost.exe (PID: 4944)
      • BackgroundTransferHost.exe (PID: 7000)

    • Reads the software policy settings

      • RegSvcs.exe (PID: 4180)
      • RegSvcs.exe (PID: 6272)
      • slui.exe (PID: 4784)
      • BackgroundTransferHost.exe (PID: 4688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:21 02:29:47+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 387584
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
15
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start new order inquiry.exe hymenophyllaceae.exe #SNAKEKEYLOGGER regsvcs.exe sppextcomobj.exe no specs slui.exe svchost.exe wscript.exe no specs hymenophyllaceae.exe no specs #SNAKEKEYLOGGER regsvcs.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
920"C:\Users\admin\AppData\Local\Halitherses\Hymenophyllaceae.exe" C:\Users\admin\AppData\Local\Halitherses\Hymenophyllaceae.exe—wscript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\halitherses\hymenophyllaceae.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
1852"C:\Users\admin\AppData\Local\Temp\New Order Inquiry.exe" C:\Users\admin\AppData\Local\Halitherses\Hymenophyllaceae.exe
New Order Inquiry.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\halitherses\hymenophyllaceae.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2420"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4180"C:\Users\admin\AppData\Local\Temp\New Order Inquiry.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Hymenophyllaceae.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4688"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4784"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4944"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5508C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 682
Read events
4 653
Write events
29
Delete events
0

Modification events

(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4180) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
10
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4688BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1c1d712d-3f05-4da1-82c3-97493a13abc5.down_data —
MD5:—
SHA256:—
6044New Order Inquiry.exeC:\Users\admin\AppData\Local\Halitherses\Hymenophyllaceae.exeexecutable
MD5:EFB4EF0D97CA2061BA6FAF3D526C8E10
SHA256:EEBCEA4D611B0D633F72D2224F4DC09D2E7A606B87F3AB1A3FC3DB0B7AD9150F
6044New Order Inquiry.exeC:\Users\admin\AppData\Local\Temp\partersbinary
MD5:D26C07EB1E7878C9B0885CE0062A57E7
SHA256:B6A0B386C0EC3F6DF67610A1694C11ABF1EF513469E1625D9571CE543C7CD05B
6044New Order Inquiry.exeC:\Users\admin\AppData\Local\Temp\autBDB4.tmpbinary
MD5:E9E1C96A2E971E546FFE89539DABF59F
SHA256:3BB366733CB4E6C02C9F283FE06CF00C22D2E7852F124C513D72A2A8FDCC5A22
4688BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1c1d712d-3f05-4da1-82c3-97493a13abc5.8a2e0858-ad50-47be-918d-76eb109d9e2d.down_metabinary
MD5:4899AA733EDDCFFB170F4FF244D6EE95
SHA256:0018F30AADE6D7C438603BB607522279928F81AF1B364CB81728911C5AA730D2
4688BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\84b9436c-109b-4dea-a14d-e6a8cad12b79.up_meta_securebinary
MD5:E0BFD3AC365FA4F8C3EC24D7F1B679BA
SHA256:BF7ED8E0EE87C64645CE53769339248EB83077FCD909087B7EFEA493AE7B8200
4688BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
4688BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:C969F1F535F1BC909E295C63D3C21105
SHA256:18392E83C74749BE55DE7140089D93699A08F0859CCEAA645DBE60C65CC35965
920Hymenophyllaceae.exeC:\Users\admin\AppData\Local\Temp\autE84E.tmpbinary
MD5:E9E1C96A2E971E546FFE89539DABF59F
SHA256:3BB366733CB4E6C02C9F283FE06CF00C22D2E7852F124C513D72A2A8FDCC5A22
1852Hymenophyllaceae.exeC:\Users\admin\AppData\Local\Temp\autC110.tmpbinary
MD5:E9E1C96A2E971E546FFE89539DABF59F
SHA256:3BB366733CB4E6C02C9F283FE06CF00C22D2E7852F124C513D72A2A8FDCC5A22
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
30
DNS requests
18
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4180
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
2852
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4180
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
4688
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6272
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6272
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6108
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6108
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4180
RegSvcs.exe
158.101.44.242:80
checkip.dyndns.org
ORACLE-BMC-31898
US
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2852
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 88.221.110.122
  • 88.221.110.114
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 20.197.71.89
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.5
  • 20.190.160.4
  • 20.190.160.131
  • 40.126.32.76
  • 20.190.160.128
  • 40.126.32.68
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
checkip.dyndns.org
  • 158.101.44.242
  • 132.226.247.73
  • 193.122.130.0
  • 132.226.8.169
  • 193.122.6.168
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
reallyfreegeoip.org
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.32.1
  • 104.21.112.1
  • 104.21.80.1
  • 104.21.48.1
malicious
www.bing.com
  • 2.19.96.129
  • 2.19.96.128
  • 2.19.96.130
  • 2.19.96.26
  • 2.19.96.66
  • 2.19.96.11
  • 2.19.96.91
  • 2.19.96.82
  • 2.19.96.120
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
4180
RegSvcs.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
4180
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
4180
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
4180
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
6272
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6272
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
6272
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
New Order Inquiry.exe