File name:

POP_Swift_Copy_MTC78362-N70002.exe

Full analysis: https://app.any.run/tasks/823d8c9b-8e3b-479a-a71c-ef42531b9eac
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:05:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
m0yv
evasion
stealer
redline
metastealer
exfiltration
smtp
ultravnc
rmm-tool
agenttesla
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

834A71BADC84386BC9079F7836A78CB9

SHA1:

69D5C88CEB1C2A01DB7F33BD98AECA34AE91144A

SHA256:

F358BFF386209D025B38DEBC10A1A5297AC981099EB2F724E14FD1DBBC1C97BE

SSDEEP:

98304:YAPQX21RBt7QjTmcaTH/vU4do9Pcjq1GvXB1sg58N32+Rr181vWDZT3FcIwEAiRM:cFECoj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • carryover.exe (PID: 6712)

    • Create files in the Startup directory

      • carryover.exe (PID: 3884)

    • Steals credentials from Web Browsers

      • Origin_rawfile.exe (PID: 1228)
      • build.exe (PID: 1184)

    • Actions looks like stealing of personal data

      • Origin_rawfile.exe (PID: 1228)
      • build.exe (PID: 1184)

    • REDLINE has been detected (SURICATA)

      • build.exe (PID: 1184)

    • METASTEALER has been detected (SURICATA)

      • build.exe (PID: 1184)

    • Connects to the CnC server

      • build.exe (PID: 1184)

    • AGENTTESLA has been detected (YARA)

      • Origin_rawfile.exe (PID: 1228)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)

    • Starts itself from another location

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)

    • Executable content was dropped or overwritten

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • RegSvcs.exe (PID: 2384)

    • Executes application which crashes

      • carryover.exe (PID: 3884)
      • carryover.exe (PID: 6712)

    • Reads security settings of Internet Explorer

      • RegSvcs.exe (PID: 2384)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 960)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Origin_rawfile.exe (PID: 1228)

    • Connects to SMTP port

      • Origin_rawfile.exe (PID: 1228)

    • The process connected to a server suspected of theft

      • Origin_rawfile.exe (PID: 1228)

    • Connects to unusual port

      • build.exe (PID: 1184)

  • INFO

    • Reads the computer name

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • RegSvcs.exe (PID: 2384)
      • Origin_rawfile.exe (PID: 1228)
      • build.exe (PID: 1184)
      • carryover.exe (PID: 6712)

    • The sample compiled with english language support

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)

    • Creates files or folders in the user directory

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • WerFault.exe (PID: 4688)
      • WerFault.exe (PID: 1056)
      • BackgroundTransferHost.exe (PID: 8032)

    • Checks supported languages

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • RegSvcs.exe (PID: 2384)
      • Origin_rawfile.exe (PID: 1228)
      • build.exe (PID: 1184)
      • carryover.exe (PID: 6712)
      • carryover.exe (PID: 3884)

    • Reads the machine GUID from the registry

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • RegSvcs.exe (PID: 2384)
      • Origin_rawfile.exe (PID: 1228)
      • build.exe (PID: 1184)

    • Create files in a temporary directory

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • RegSvcs.exe (PID: 2384)
      • carryover.exe (PID: 6712)

    • Reads mouse settings

      • carryover.exe (PID: 3884)
      • carryover.exe (PID: 6712)
      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)

    • Autorun file from Startup directory

      • carryover.exe (PID: 3884)

    • Process checks computer location settings

      • RegSvcs.exe (PID: 2384)

    • Manual execution by a user

      • wscript.exe (PID: 960)

    • Disables trace logs

      • Origin_rawfile.exe (PID: 1228)

    • Checks proxy server information

      • Origin_rawfile.exe (PID: 1228)
      • carryover.exe (PID: 6712)
      • BackgroundTransferHost.exe (PID: 8032)

    • ULTRAVNC has been detected

      • Origin_rawfile.exe (PID: 1228)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7796)
      • BackgroundTransferHost.exe (PID: 8032)
      • BackgroundTransferHost.exe (PID: 8136)
      • BackgroundTransferHost.exe (PID: 7572)
      • BackgroundTransferHost.exe (PID: 1012)

    • Reads the software policy settings

      • Origin_rawfile.exe (PID: 1228)
      • BackgroundTransferHost.exe (PID: 8032)
      • slui.exe (PID: 732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AgentTesla

(PID) Process(1228) Origin_rawfile.exe
Protocolsmtp
Hostmail.xma0.com
Port587
Usernamed.cloud@xma0.com
Passwordlondon@1759
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:17 23:23:41+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 1051136
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
19
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #M0YV pop_swift_copy_mtc78362-n70002.exe #M0YV carryover.exe regsvcs.exe werfault.exe no specs #AGENTTESLA origin_rawfile.exe #REDLINE build.exe sppextcomobj.exe no specs slui.exe wscript.exe no specs #M0YV carryover.exe svchost.exe regsvcs.exe no specs werfault.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
732"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
960"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\carryover.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1056C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6712 -s 936C:\Windows\SysWOW64\WerFault.exe—carryover.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1184"C:\Users\admin\AppData\Local\Temp\build.exe" C:\Users\admin\AppData\Local\Temp\build.exe
RegSvcs.exe
User:
admin
Integrity Level:
MEDIUM
Description:
XHP
Exit code:
0
Version:
12.9.1.22
Modules
Images
c:\users\admin\appdata\local\temp\build.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1228"C:\Users\admin\AppData\Local\Temp\Origin_rawfile.exe" C:\Users\admin\AppData\Local\Temp\Origin_rawfile.exe
RegSvcs.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\origin_rawfile.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AgentTesla
(PID) Process(1228) Origin_rawfile.exe
Protocolsmtp
Hostmail.xma0.com
Port587
Usernamed.cloud@xma0.com
Passwordlondon@1759
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2384"C:\Users\admin\AppData\Local\Temp\POP_Swift_Copy_MTC78362-N70002.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
carryover.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2656C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3884"C:\Users\admin\AppData\Local\Temp\POP_Swift_Copy_MTC78362-N70002.exe" C:\Users\admin\AppData\Local\nonsubmerged\carryover.exe
POP_Swift_Copy_MTC78362-N70002.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\nonsubmerged\carryover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
Total events
9 964
Read events
9 935
Write events
29
Delete events
0

Modification events

(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
9
Suspicious files
17
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4688WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_carryover.exe_aecea849dec939e3923f13f5e1f3c31fb5e13e6_29c9f6f6_798a5e7d-329e-4072-9d7a-ff4cb164fc5f\Report.wer —
MD5:—
SHA256:—
6268POP_Swift_Copy_MTC78362-N70002.exeC:\Users\admin\AppData\Roaming\26b799fa89ba8c8f.binbinary
MD5:1B725A2EE98D5A5FC8A422A4FDD6D01B
SHA256:A2EA85252C0B52ABF11790C1D7651157F3F750DAD9D6D822FADF89754ED989C5
6268POP_Swift_Copy_MTC78362-N70002.exeC:\Users\admin\AppData\Local\Temp\ghautsbinary
MD5:6388DD134BA1D7D89935C15DB0B9981C
SHA256:3355BD701D72B9D12C8B8B3579B8D06E18B0D803D555A605B609CA68D6233F1E
4688WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC16F.tmp.xmlxml
MD5:2BC20493C417FA7F33323AEF17A86416
SHA256:E525132E3BDCD69D3E5039AB249F8762C09651176A8D75A5766A64CADA6177FF
1056WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_carryover.exe_aecea849dec939e3923f13f5e1f3c31fb5e13e6_29c9f6f6_a60cbf49-4f95-4100-9988-0e6aee05546c\Report.wer —
MD5:—
SHA256:—
6268POP_Swift_Copy_MTC78362-N70002.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeexecutable
MD5:85E29631AC18FDF9B5D0C930CBE8C730
SHA256:E79FE12A0A5306A00AB5A7568F6AE1BF94E508D71912DE1B1B53CF7A023F034E
4688WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\carryover.exe.3884.dmpbinary
MD5:7F17D9348746950705249B0C1C4715C0
SHA256:62904E6058230B298ABD028B32BE4AC0389A8D83694C77B6B2704BFD45A0BF66
6268POP_Swift_Copy_MTC78362-N70002.exeC:\Users\admin\AppData\Local\nonsubmerged\carryover.exeexecutable
MD5:834A71BADC84386BC9079F7836A78CB9
SHA256:F358BFF386209D025B38DEBC10A1A5297AC981099EB2F724E14FD1DBBC1C97BE
8032BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\7e266145-f48e-47db-a97f-53503843bc9a.down_data —
MD5:—
SHA256:—
3884carryover.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exeexecutable
MD5:3476536D10A5D3DA07F789C761A1B21D
SHA256:04BACBBEFFC2007E5B46505D0DD4661121187C1DB449D7AE2C8E1522C53958F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
33
DNS requests
23
Threats
34

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1228
Origin_rawfile.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4724
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7844
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6712
carryover.exe
POST
—
52.11.240.239:80
http://pywolwnvd.biz/nkmukfjujaidkc
unknown
—
—
malicious
8032
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1244
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7844
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1184
build.exe
204.10.161.147:7082
—
UNREAL-SERVERS
CA
malicious
1228
Origin_rawfile.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6712
carryover.exe
52.11.240.239:80
pywolwnvd.biz
AMAZON-02
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
whitelisted
pywolwnvd.biz
  • 52.11.240.239
malicious
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.128
  • 20.190.160.67
  • 20.190.160.22
  • 20.190.160.20
  • 20.190.160.132
  • 20.190.160.66
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
mail.xma0.com
  • 51.195.65.154
malicious
arc.msn.com
  • 20.74.47.205
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
1184
build.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
1228
Origin_rawfile.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
1228
Origin_rawfile.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
1184
build.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
1184
build.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
1184
build.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
1228
Origin_rawfile.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
1184
build.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
POP_Swift_Copy_MTC78362-N70002.exe