File name:

POP_Swift_Copy_MTC78362-N70002.exe

Full analysis: https://app.any.run/tasks/823d8c9b-8e3b-479a-a71c-ef42531b9eac
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:05:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
m0yv
evasion
stealer
redline
metastealer
exfiltration
smtp
ultravnc
rmm-tool
agenttesla
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

834A71BADC84386BC9079F7836A78CB9

SHA1:

69D5C88CEB1C2A01DB7F33BD98AECA34AE91144A

SHA256:

F358BFF386209D025B38DEBC10A1A5297AC981099EB2F724E14FD1DBBC1C97BE

SSDEEP:

98304:YAPQX21RBt7QjTmcaTH/vU4do9Pcjq1GvXB1sg58N32+Rr181vWDZT3FcIwEAiRM:cFECoj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • carryover.exe (PID: 6712)

    • Create files in the Startup directory

      • carryover.exe (PID: 3884)

    • Actions looks like stealing of personal data

      • Origin_rawfile.exe (PID: 1228)
      • build.exe (PID: 1184)

    • Steals credentials from Web Browsers

      • Origin_rawfile.exe (PID: 1228)
      • build.exe (PID: 1184)

    • REDLINE has been detected (SURICATA)

      • build.exe (PID: 1184)

    • METASTEALER has been detected (SURICATA)

      • build.exe (PID: 1184)

    • AGENTTESLA has been detected (YARA)

      • Origin_rawfile.exe (PID: 1228)

    • Connects to the CnC server

      • build.exe (PID: 1184)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)

    • Executable content was dropped or overwritten

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • RegSvcs.exe (PID: 2384)

    • Starts itself from another location

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)

    • Executes application which crashes

      • carryover.exe (PID: 3884)
      • carryover.exe (PID: 6712)

    • Reads security settings of Internet Explorer

      • RegSvcs.exe (PID: 2384)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 960)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Origin_rawfile.exe (PID: 1228)

    • Connects to unusual port

      • build.exe (PID: 1184)

    • The process connected to a server suspected of theft

      • Origin_rawfile.exe (PID: 1228)

    • Connects to SMTP port

      • Origin_rawfile.exe (PID: 1228)

  • INFO

    • Checks supported languages

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • Origin_rawfile.exe (PID: 1228)
      • RegSvcs.exe (PID: 2384)
      • carryover.exe (PID: 6712)
      • build.exe (PID: 1184)

    • The sample compiled with english language support

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)

    • Reads the computer name

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • RegSvcs.exe (PID: 2384)
      • Origin_rawfile.exe (PID: 1228)
      • carryover.exe (PID: 6712)
      • build.exe (PID: 1184)

    • Creates files or folders in the user directory

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • WerFault.exe (PID: 4688)
      • WerFault.exe (PID: 1056)
      • BackgroundTransferHost.exe (PID: 8032)

    • Reads mouse settings

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • carryover.exe (PID: 3884)
      • carryover.exe (PID: 6712)

    • Reads the machine GUID from the registry

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • RegSvcs.exe (PID: 2384)
      • build.exe (PID: 1184)
      • Origin_rawfile.exe (PID: 1228)

    • Create files in a temporary directory

      • POP_Swift_Copy_MTC78362-N70002.exe (PID: 6268)
      • RegSvcs.exe (PID: 2384)
      • carryover.exe (PID: 3884)
      • carryover.exe (PID: 6712)

    • Process checks computer location settings

      • RegSvcs.exe (PID: 2384)

    • Autorun file from Startup directory

      • carryover.exe (PID: 3884)

    • Manual execution by a user

      • wscript.exe (PID: 960)

    • Checks proxy server information

      • Origin_rawfile.exe (PID: 1228)
      • carryover.exe (PID: 6712)
      • BackgroundTransferHost.exe (PID: 8032)

    • Disables trace logs

      • Origin_rawfile.exe (PID: 1228)

    • ULTRAVNC has been detected

      • Origin_rawfile.exe (PID: 1228)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8032)
      • BackgroundTransferHost.exe (PID: 7796)
      • BackgroundTransferHost.exe (PID: 8136)
      • BackgroundTransferHost.exe (PID: 1012)
      • BackgroundTransferHost.exe (PID: 7572)

    • Reads the software policy settings

      • Origin_rawfile.exe (PID: 1228)
      • BackgroundTransferHost.exe (PID: 8032)
      • slui.exe (PID: 732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AgentTesla

(PID) Process(1228) Origin_rawfile.exe
Protocolsmtp
Hostmail.xma0.com
Port587
Usernamed.cloud@xma0.com
Passwordlondon@1759
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:17 23:23:41+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 1051136
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
19
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #M0YV pop_swift_copy_mtc78362-n70002.exe #M0YV carryover.exe regsvcs.exe werfault.exe no specs #AGENTTESLA origin_rawfile.exe #REDLINE build.exe sppextcomobj.exe no specs slui.exe wscript.exe no specs #M0YV carryover.exe svchost.exe regsvcs.exe no specs werfault.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
732"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
960"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\carryover.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1056C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6712 -s 936C:\Windows\SysWOW64\WerFault.exe—carryover.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1184"C:\Users\admin\AppData\Local\Temp\build.exe" C:\Users\admin\AppData\Local\Temp\build.exe
RegSvcs.exe
User:
admin
Integrity Level:
MEDIUM
Description:
XHP
Exit code:
0
Version:
12.9.1.22
Modules
Images
c:\users\admin\appdata\local\temp\build.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1228"C:\Users\admin\AppData\Local\Temp\Origin_rawfile.exe" C:\Users\admin\AppData\Local\Temp\Origin_rawfile.exe
RegSvcs.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\origin_rawfile.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AgentTesla
(PID) Process(1228) Origin_rawfile.exe
Protocolsmtp
Hostmail.xma0.com
Port587
Usernamed.cloud@xma0.com
Passwordlondon@1759
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2384"C:\Users\admin\AppData\Local\Temp\POP_Swift_Copy_MTC78362-N70002.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
carryover.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2656C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3884"C:\Users\admin\AppData\Local\Temp\POP_Swift_Copy_MTC78362-N70002.exe" C:\Users\admin\AppData\Local\nonsubmerged\carryover.exe
POP_Swift_Copy_MTC78362-N70002.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\nonsubmerged\carryover.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
Total events
9 964
Read events
9 935
Write events
29
Delete events
0

Modification events

(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1228) Origin_rawfile.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Origin_rawfile_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
9
Suspicious files
17
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4688WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_carryover.exe_aecea849dec939e3923f13f5e1f3c31fb5e13e6_29c9f6f6_798a5e7d-329e-4072-9d7a-ff4cb164fc5f\Report.wer —
MD5:—
SHA256:—
3884carryover.exeC:\Users\admin\AppData\Local\Temp\autB9EB.tmpbinary
MD5:6388DD134BA1D7D89935C15DB0B9981C
SHA256:3355BD701D72B9D12C8B8B3579B8D06E18B0D803D555A605B609CA68D6233F1E
6268POP_Swift_Copy_MTC78362-N70002.exeC:\Users\admin\AppData\Local\nonsubmerged\carryover.exeexecutable
MD5:834A71BADC84386BC9079F7836A78CB9
SHA256:F358BFF386209D025B38DEBC10A1A5297AC981099EB2F724E14FD1DBBC1C97BE
3884carryover.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeexecutable
MD5:E960F4F941C5F4B7E0CEFAD4EDAD7379
SHA256:E5026F9BF1E3F0AC03CA072DB9F391BB9D5936C7E4BED3E100A285183AC3A9D3
1056WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_carryover.exe_aecea849dec939e3923f13f5e1f3c31fb5e13e6_29c9f6f6_a60cbf49-4f95-4100-9988-0e6aee05546c\Report.wer —
MD5:—
SHA256:—
3884carryover.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\carryover.vbsbinary
MD5:DDCFDB37B084CB252B62FBF8CF94C067
SHA256:3627FCFEA48A1F6AD7F3BD10E45292EE3EB2839D02A205B877978C67812D2F30
4688WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBF99.tmp.dmpbinary
MD5:899245A9AD670365743D5D4EC406E34B
SHA256:DC8C1EEE04DD01369364328C7943C522417CA645BEE3DC025CDBB6C8FD7F879A
6268POP_Swift_Copy_MTC78362-N70002.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeexecutable
MD5:85E29631AC18FDF9B5D0C930CBE8C730
SHA256:E79FE12A0A5306A00AB5A7568F6AE1BF94E508D71912DE1B1B53CF7A023F034E
8032BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\7e266145-f48e-47db-a97f-53503843bc9a.down_data —
MD5:—
SHA256:—
6268POP_Swift_Copy_MTC78362-N70002.exeC:\Users\admin\AppData\Local\Temp\ghautsbinary
MD5:6388DD134BA1D7D89935C15DB0B9981C
SHA256:3355BD701D72B9D12C8B8B3579B8D06E18B0D803D555A605B609CA68D6233F1E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
33
DNS requests
23
Threats
34

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1228
Origin_rawfile.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
6712
carryover.exe
POST
—
52.11.240.239:80
http://pywolwnvd.biz/nkmukfjujaidkc
unknown
—
—
malicious
7844
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7844
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8032
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1244
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4724
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1184
build.exe
204.10.161.147:7082
—
UNREAL-SERVERS
CA
malicious
1228
Origin_rawfile.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6712
carryover.exe
52.11.240.239:80
pywolwnvd.biz
AMAZON-02
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
whitelisted
pywolwnvd.biz
  • 52.11.240.239
malicious
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.128
  • 20.190.160.67
  • 20.190.160.22
  • 20.190.160.20
  • 20.190.160.132
  • 20.190.160.66
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
mail.xma0.com
  • 51.195.65.154
malicious
arc.msn.com
  • 20.74.47.205
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
1184
build.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
1228
Origin_rawfile.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
1228
Origin_rawfile.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
1184
build.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
1184
build.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
1184
build.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC - Id1Response
1228
Origin_rawfile.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
1184
build.exe
A Network Trojan was detected
ET MALWARE Redline Stealer TCP CnC Activity
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
POP_Swift_Copy_MTC78362-N70002.exe