File name:

re_webhook.exe

Full analysis: https://app.any.run/tasks/919a4dcf-99dd-4a4d-8788-11a2710565f4
Verdict: Malicious activity
Analysis date: April 29, 2025, 00:48:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
telegram
ims-api
generic
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 3 sections
MD5:

5EC17EDA2C560A5A97C712B3ED12B9B5

SHA1:

1F6C552FB3ECDDFF16BAB417DF9F916F1B4D02A9

SHA256:

018453B2C579EDBEC83248F6CFC2D0426279F543B8729D9561960B164A585773

SSDEEP:

1536:j/Rnm90YLSRoXSrQ1YM5iN+foNjT9PdRhhNUR7FJ07h5H2lryAnKX:j/oeYLSSqCYai/XRPQ7Fm7h5H2lGx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • re_webhook.exe (PID: 4424)

    • Identifying current user with WHOAMI command

      • cmd.exe (PID: 6940)
      • cmd.exe (PID: 2140)

    • Starts CMD.EXE for commands execution

      • re_webhook.exe (PID: 4424)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • re_webhook.exe (PID: 4424)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • re_webhook.exe (PID: 4424)

  • INFO

    • Creates files or folders in the user directory

      • re_webhook.exe (PID: 4424)

    • Reads the machine GUID from the registry

      • re_webhook.exe (PID: 4424)

    • Reads the computer name

      • re_webhook.exe (PID: 4424)

    • Checks supported languages

      • re_webhook.exe (PID: 4424)

    • Checks proxy server information

      • re_webhook.exe (PID: 4424)

    • Reads the software policy settings

      • re_webhook.exe (PID: 4424)

    • Attempting to use instant messaging service

      • re_webhook.exe (PID: 4424)

    • UPX packer has been detected

      • re_webhook.exe (PID: 4424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(4424) re_webhook.exe
Telegram-Tokens (1)8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Telegram-Info-Links
8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Get info about bothttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getMe
Get incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getUpdates
Get webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60
Telegram-Tokens (1)8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Telegram-Info-Links
8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Get info about bothttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getMe
Get incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getUpdates
Get webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointsendMessage
Args
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60 HTTP/1.1
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60 HTTP/1.1 Host: api.telegram.org Cache-Control: no-cache
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60
Telegram-Tokens (1)8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Telegram-Info-Links
8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Get info about bothttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getMe
Get incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getUpdates
Get webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointsendMessage
Args
Telegram-Tokens (1)8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Telegram-Info-Links
8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Get info about bothttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getMe
Get incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getUpdates
Get webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook?drop_pending_updates=true
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:04:29 00:35:09+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.39
CodeSize: 73728
InitializedDataSize: 4096
UninitializedDataSize: 155648
EntryPoint: 0x37b50
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start re_webhook.exe cmd.exe no specs conhost.exe no specs whoami.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs whoami.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
732C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1312"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1804whoamiC:\Windows\System32\whoami.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
whoami - displays logged on user information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\whoami.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140C:\WINDOWS\system32\cmd.exe /c whoamiC:\Windows\System32\cmd.exe—re_webhook.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
4152\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4424"C:\Users\admin\AppData\Local\Temp\re_webhook.exe" C:\Users\admin\AppData\Local\Temp\re_webhook.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\re_webhook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
ims-api
(PID) Process(4424) re_webhook.exe
Telegram-Tokens (1)8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Telegram-Info-Links
8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Get info about bothttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getMe
Get incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getUpdates
Get webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60
(PID) Process(4424) re_webhook.exe
Telegram-Tokens (1)8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Telegram-Info-Links
8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Get info about bothttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getMe
Get incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getUpdates
Get webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointsendMessage
Args
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60 HTTP/1.1
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60 HTTP/1.1 Host: api.telegram.org Cache-Control: no-cache
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60
(PID) Process(4424) re_webhook.exe
Telegram-Tokens (1)8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Telegram-Info-Links
8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Get info about bothttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getMe
Get incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getUpdates
Get webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointgetUpdates
Args
offset (1)ld
timeout (1)60
Token8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
End-PointsendMessage
Args
(PID) Process(4424) re_webhook.exe
Telegram-Tokens (1)8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Telegram-Info-Links
8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ
Get info about bothttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getMe
Get incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getUpdates
Get webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot8178043038:AAFtcZ4x9Lv9W8s3MkOU3h-kcM5MAW2QIOQ/deleteWebhook?drop_pending_updates=true
5864whoamiC:\Windows\System32\whoami.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
whoami - displays logged on user information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\whoami.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6940C:\WINDOWS\system32\cmd.exe /c whoamiC:\Windows\System32\cmd.exe—re_webhook.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
957
Read events
954
Write events
3
Delete events
0

Modification events

(PID) Process:(4424) re_webhook.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4424) re_webhook.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4424) re_webhook.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
10
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4424re_webhook.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:E1F170B0812F6AAA6F20A31DA190C431
SHA256:4A3AF71CC782D88467B9E3CCD73EA991195E6CF1B381DC5555802DAA81EAE9E3
4424re_webhook.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:B57BE63C13DB2A03D167B7A8018A3FB1
SHA256:49D91B52207C4C8BCA2C7F1624C471BC7812D47BC33A4CA131ABE32B5C49DCC8
4424re_webhook.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:C351E59BA78FCF6750038D9E8570E467
SHA256:65794CAF1CA53D45D076F64A7E06EB400FEAD9E2185A599EAEDFB2F42FC0C87F
4424re_webhook.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:C982CAAC1EE79D35BC30A282A203A366
SHA256:5087FB740D6B00B08594DACE8CD47B2C455F9E3F14CAE1FDF0C25F115A656B84
4424re_webhook.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACA7D89F79C6EF86F63EB2FF5D5C876A_8AD14988285EE6F6CBBCCEE3BD7C8E58binary
MD5:919787F1CE802E8EEC4A31EC32C84859
SHA256:B61B404F6B2CCFB2157086E6E43FA7979F749DE1A22309A174EAB8E751F07F15
4424re_webhook.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\getUpdates[1].jsonbinary
MD5:757D9DDE2917BCFF7548501A7CEA651C
SHA256:0C3BA6D15315B56C7752FA1605230D92120B1F6C07A708D8A9BCCA03BA5995C8
4424re_webhook.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\getUpdates[1].jsonbinary
MD5:757D9DDE2917BCFF7548501A7CEA651C
SHA256:0C3BA6D15315B56C7752FA1605230D92120B1F6C07A708D8A9BCCA03BA5995C8
4424re_webhook.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACA7D89F79C6EF86F63EB2FF5D5C876A_8AD14988285EE6F6CBBCCEE3BD7C8E58binary
MD5:5C9C13C1858D5D1F26CB28496F02EE9F
SHA256:DB5E8A6DF9EC29042EE9BB0168673E0A86A1BA6FA42166E84A94177CDD46DFC3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
22
DNS requests
15
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4424
re_webhook.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
unknown
—
—
whitelisted
4424
re_webhook.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCEVy5zGFpEO7
unknown
—
—
whitelisted
4424
re_webhook.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
unknown
—
—
whitelisted
1088
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1088
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4424
re_webhook.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
whitelisted
4424
re_webhook.exe
192.124.249.24:80
ocsp.godaddy.com
SUCURI-SEC
US
whitelisted
6544
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
api.telegram.org
  • 149.154.167.220
whitelisted
ocsp.godaddy.com
  • 192.124.249.24
  • 192.124.249.36
  • 192.124.249.22
  • 192.124.249.23
  • 192.124.249.41
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.0
  • 20.190.159.128
  • 20.190.159.75
  • 20.190.159.129
  • 20.190.159.0
  • 40.126.31.3
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
4424
re_webhook.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
4424
re_webhook.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
re_webhook.exe