File name:

Document LCPAYOUT-633422216764.msg

Full analysis: https://app.any.run/tasks/34c15207-c6c7-44b6-928a-20a2a54c0443
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 18:32:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
snakekeylogger
keylogger
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

322B223A197C71B62E3336F5C6EAA4AA

SHA1:

09A148713E3A014D2F84A42A4E3EDC04B8820669

SHA256:

F52A1128A4F8B7126C5FDC6D34244EC51B1BD7012FDDAE9D3F281DBA07B1A15F

SSDEEP:

1536:cjHmek+MW2W3fJ7B0Wj5RGgve1tv1Ndb9q0p5xiwLN8h5xDmTzo3fyHzPDzeYeBb:cjBdBH+gve1tvbdb9qwjiwLIT/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 7z2107-x64.exe (PID: 3568)
      • 7z2107-x64.exe (PID: 4068)
      • 7z2107.exe (PID: 2176)
      • 7z2107.exe (PID: 2120)
      • 7zG.exe (PID: 2060)
      • 633422216764.bat (PID: 2680)

    • Loads dropped or rewritten executable

      • Explorer.EXE (PID: 740)
      • svchost.exe (PID: 860)
      • 7zG.exe (PID: 2060)

    • Drops executable file immediately after starts

      • 7zG.exe (PID: 2060)

    • Changes the autorun value in the registry

      • 633422216764.bat (PID: 2680)

    • SNAKEKEYLOGGER was detected

      • MSBuild.exe (PID: 1572)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • Explorer.EXE (PID: 740)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2164)

    • Reads default file associations for system extensions

      • Explorer.EXE (PID: 740)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 308)
      • 7z2107.exe (PID: 2120)
      • 7zG.exe (PID: 2060)
      • 633422216764.bat (PID: 2680)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 308)
      • 7z2107.exe (PID: 2120)
      • 7zG.exe (PID: 2060)
      • 633422216764.bat (PID: 2680)

    • Checks supported languages

      • 7z2107-x64.exe (PID: 4068)
      • 7z2107.exe (PID: 2120)
      • 7zG.exe (PID: 2060)
      • 633422216764.bat (PID: 2680)
      • cmd.exe (PID: 2740)
      • MSBuild.exe (PID: 1572)

    • Creates files in the program directory

      • 7z2107.exe (PID: 2120)

    • Creates/Modifies COM task schedule object

      • 7z2107.exe (PID: 2120)

    • Creates a directory in Program Files

      • 7z2107.exe (PID: 2120)

    • Creates a software uninstall entry

      • 7z2107.exe (PID: 2120)

    • Reads the computer name

      • 7zG.exe (PID: 2060)
      • 633422216764.bat (PID: 2680)
      • 7z2107.exe (PID: 2120)
      • MSBuild.exe (PID: 1572)

    • Suspicious files were dropped or overwritten

      • 7zG.exe (PID: 2060)

    • Starts application with an unusual extension

      • Explorer.EXE (PID: 740)

    • Reads Environment values

      • 633422216764.bat (PID: 2680)
      • MSBuild.exe (PID: 1572)

    • Starts CMD.EXE for commands execution

      • 633422216764.bat (PID: 2680)

    • Checks for external IP

      • MSBuild.exe (PID: 1572)

    • Creates files in the user directory

      • 633422216764.bat (PID: 2680)

  • INFO

    • Starts Microsoft Office Application

      • Explorer.EXE (PID: 740)

    • Checks supported languages

      • OUTLOOK.EXE (PID: 1496)
      • svchost.exe (PID: 860)
      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 1944)
      • chrome.exe (PID: 1712)
      • chrome.exe (PID: 2576)
      • chrome.exe (PID: 388)
      • chrome.exe (PID: 308)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 116)
      • chrome.exe (PID: 3948)
      • chrome.exe (PID: 3240)
      • chrome.exe (PID: 576)
      • chrome.exe (PID: 2600)
      • chrome.exe (PID: 2816)
      • chrome.exe (PID: 1124)
      • chrome.exe (PID: 668)
      • chrome.exe (PID: 2528)
      • chrome.exe (PID: 2188)
      • chrome.exe (PID: 1840)
      • chrome.exe (PID: 2748)
      • chrome.exe (PID: 3308)
      • chrome.exe (PID: 3948)
      • chrome.exe (PID: 824)
      • chrome.exe (PID: 3476)
      • chrome.exe (PID: 576)
      • chrome.exe (PID: 2420)
      • chrome.exe (PID: 2264)
      • chrome.exe (PID: 1888)
      • chrome.exe (PID: 2568)
      • timeout.exe (PID: 1292)
      • chrome.exe (PID: 3508)
      • chrome.exe (PID: 3344)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 1496)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 1496)
      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 1944)
      • chrome.exe (PID: 3948)
      • chrome.exe (PID: 308)
      • chrome.exe (PID: 2816)
      • chrome.exe (PID: 2188)
      • chrome.exe (PID: 2420)
      • chrome.exe (PID: 2568)
      • chrome.exe (PID: 3948)

    • Manual execution by user

      • chrome.exe (PID: 2164)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1496)

    • Reads the hosts file

      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 308)

    • Application launched itself

      • chrome.exe (PID: 2164)

    • Reads settings of System Certificates

      • chrome.exe (PID: 308)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
89
Monitored processes
42
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start outlook.exe chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 7z2107-x64.exe no specs 7z2107-x64.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 7z2107.exe no specs 7z2107.exe chrome.exe no specs explorer.exe no specs svchost.exe no specs 7zg.exe 633422216764.bat cmd.exe no specs timeout.exe no specs #SNAKEKEYLOGGER msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
308"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1336 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
388"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
576"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1956 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
576"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1560 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
668"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
740C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
824"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3656 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
860C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
24 856
Read events
23 951
Write events
878
Delete events
27

Modification events

(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
(PID) Process:(1496) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
Off
Executable files
18
Suspicious files
160
Text files
239
Unknown types
29

Dropped files

PID
Process
Filename
Type
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR312F.tmp.cvr —
MD5:—
SHA256:—
1496OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61EEF0E7-874.pma —
MD5:—
SHA256:—
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:—
SHA256:—
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_DFB995BF98A7E340B2568F900BC0C0A9.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{68CF329D-A473-46AF-AA83-949C3A8C1A8A}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_D3A94F1B9DB1F44689908ACD6030FF6C.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
2164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_6D0A8D68DE2D1647867CF3F28E635B3D.datxml
MD5:57F30B1BCA811C2FCB81F4C13F6A927B
SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3
2164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:8FF312A95D60ED89857FEB720D80D4E1
SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
42
DNS requests
24
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1572
MSBuild.exe
GET
—
158.101.44.242:80
http://checkip.dyndns.org/
US
—
—
shared
2680
633422216764.bat
GET
200
185.252.31.60:80
http://gbtak.ir/wp-content/Ygjklu.log
unknown
gmc
282 Kb
malicious
1572
MSBuild.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
US
html
107 b
shared
308
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
308
chrome.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6218f49f95c943b0
US
compressed
59.9 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1496
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
308
chrome.exe
216.58.212.164:443
www.google.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.185.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.186.174:443
clients2.google.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.186.77:443
accounts.google.com
Google Inc.
US
suspicious
308
chrome.exe
142.250.184.227:443
www.gstatic.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.186.35:443
ssl.gstatic.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.185.195:443
update.googleapis.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.184.238:443
consent.google.co.uk
Google Inc.
US
whitelisted
308
chrome.exe
142.250.186.142:443
consent.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
clientservices.googleapis.com
  • 142.250.185.163
whitelisted
accounts.google.com
  • 142.250.186.77
shared
clients2.google.com
  • 142.250.186.174
whitelisted
www.google.com
  • 216.58.212.164
malicious
fonts.googleapis.com
  • 142.250.186.138
whitelisted
www.gstatic.com
  • 142.250.184.227
whitelisted
fonts.gstatic.com
  • 142.250.186.99
whitelisted
apis.google.com
  • 172.217.16.142
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.174
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
—
—
Misc activity
AV INFO Query to checkip.dyndns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
—
—
Misc activity
AV INFO Query to checkip.dyndns. Domain
1572
MSBuild.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup - checkip.dyndns.org
1572
MSBuild.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup - checkip.dyndns.org
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Document LCPAYOUT-633422216764.msg