File name:

DOCUMENTO PDF CON LA INFORMACIO_N DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.zip

Full analysis: https://app.any.run/tasks/0ec1f63b-affe-462c-8302-aa619015d3a1
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: September 03, 2025, 16:51:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xworm
remote
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

60A149983F56882899E2CC560866A082

SHA1:

265CD9DF4849568C5349CF1D5FFBFEABCFD05556

SHA256:

18DCADCB23C6CE71E36EDFDEFE76683C1538DBFAE80FE6959A3207AA75C86982

SSDEEP:

98304:Q3k0WWgmXL1xuQ8bYUDOyJ1yVNIigMT2+OjkvHmzOPPLJIQsCeo/7hqdE/zklW+E:ig6pek/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 440)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 1488)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 6488)

    • XWORM has been detected (YARA)

      • AddInProcess32.exe (PID: 4884)

    • XWORM has been detected (SURICATA)

      • AddInProcess32.exe (PID: 4884)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 440)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 6488)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 1488)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3148)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 440)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3148)

    • Executable content was dropped or overwritten

      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 440)

    • Connects to unusual port

      • AddInProcess32.exe (PID: 4884)

    • Contacting a server suspected of hosting an CnC

      • AddInProcess32.exe (PID: 4884)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3148)

    • Checks supported languages

      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 440)
      • AddInProcess32.exe (PID: 4884)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 6488)
      • AddInProcess32.exe (PID: 6980)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 1488)
      • AddInProcess32.exe (PID: 5400)

    • Launching a file from a Registry key

      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 440)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 6488)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 1488)

    • Reads the computer name

      • AddInProcess32.exe (PID: 4884)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 440)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 6488)
      • AddInProcess32.exe (PID: 6980)
      • DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe (PID: 1488)
      • AddInProcess32.exe (PID: 5400)

    • Reads the machine GUID from the registry

      • AddInProcess32.exe (PID: 4884)
      • AddInProcess32.exe (PID: 6980)
      • AddInProcess32.exe (PID: 5400)

    • Create files in a temporary directory

      • AddInProcess32.exe (PID: 4884)

    • Reads the software policy settings

      • slui.exe (PID: 536)

    • Checks proxy server information

      • slui.exe (PID: 536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(4884) AddInProcess32.exe
C2213.209.150.144:2483
Keys
AES<666666>
Options
Splitter<Xwormmm>
Sleep time1
USB drop name1008554884
MutexVtEVkTI3knul8lGs
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2025:02:07 01:15:42
ZipCRC: 0xfe3830ba
ZipCompressedSize: 129205
ZipUncompressedSize: 190528
ZipFileName: DOCUMENTO PDF CON LA INFORMACION DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
11
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe documento pdf con la información de la audiencia programada 20 de agosto de 2025.exe conhost.exe no specs #XWORM addinprocess32.exe documento pdf con la información de la audiencia programada 20 de agosto de 2025.exe conhost.exe no specs addinprocess32.exe no specs slui.exe documento pdf con la información de la audiencia programada 20 de agosto de 2025.exe conhost.exe no specs addinprocess32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440"C:\Users\admin\AppData\Local\Temp\Rar$EXb3148.46564\DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3148.46564\DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Express Worker Process
Exit code:
4294967295
Version:
10.0.26013.1000 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3148.46564\documento pdf con la información de la audiencia programada 20 de agosto de 2025.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
536C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1488"C:\Users\admin\AppData\Local\Temp\Rar$EXb3148.4269\DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3148.4269\DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Express Worker Process
Exit code:
4294967295
Version:
10.0.26013.1000 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3148.4269\documento pdf con la información de la audiencia programada 20 de agosto de 2025.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2628\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3148"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\DOCUMENTO PDF CON LA INFORMACIO_N DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3980\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4884"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
XWorm
(PID) Process(4884) AddInProcess32.exe
C2213.209.150.144:2483
Keys
AES<666666>
Options
Splitter<Xwormmm>
Sleep time1
USB drop name1008554884
MutexVtEVkTI3knul8lGs
5400"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe—DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInProcess.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\addinprocess32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6488"C:\Users\admin\AppData\Local\Temp\Rar$EXb3148.49076\DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3148.49076\DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Express Worker Process
Exit code:
4294967295
Version:
10.0.26013.1000 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3148.49076\documento pdf con la información de la audiencia programada 20 de agosto de 2025.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
6 815
Read events
6 795
Write events
20
Delete events
0

Modification events

(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\DOCUMENTO PDF CON LA INFORMACIO_N DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.zip
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
20
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3148.46564\IISEXPRESSHELPER.dllexecutable
MD5:28E63EEDE0FF9401E868882E28D95592
SHA256:7D0E515957ED60771CA017985AE0C43A9262247DE789F40EAC84EA00F4C0D3C2
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3148.46564\IISUTIL2.dllexecutable
MD5:7746FE4D290DB237DB88260B3F550B63
SHA256:A23DFD32AED17E8423589A74E48453442678D972D1FD3D4CDAA1EA41EB35D76F
440DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exeC:\Users\admin\getTitleGetRuntimeMethodsStringToHGlobalAuto\IISEXPRESSHELPER.dllexecutable
MD5:28E63EEDE0FF9401E868882E28D95592
SHA256:7D0E515957ED60771CA017985AE0C43A9262247DE789F40EAC84EA00F4C0D3C2
440DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exeC:\Users\admin\getTitleGetRuntimeMethodsStringToHGlobalAuto\rtinfo.dllexecutable
MD5:B69B0513774A58E805AA15C03EA82B25
SHA256:825C20AA5036605CB9C96870D81E1B052D1AB54ADF6595BF604EBC2B400EE08B
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3148.49076\DOCUMENTO PDF CON LA INFORMACIÓN DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.exeexecutable
MD5:B0D39CE242699383FBE4CF1F16B53719
SHA256:01FCAFF363713CECD482D9ECF99814FC83870871B82A62BF11AB43D8844A8281
4884AddInProcess32.exeC:\Users\admin\AppData\Local\Temp\Log.tmptext
MD5:093330741218F376298C6F967A6A5C61
SHA256:D053A1CB90D3C340E8F0E606BCB808A05A1DA2A80384411192B45529172DECE7
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3148.49076\IISEXPRESSHELPER.dllexecutable
MD5:28E63EEDE0FF9401E868882E28D95592
SHA256:7D0E515957ED60771CA017985AE0C43A9262247DE789F40EAC84EA00F4C0D3C2
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3148.49076\nativrd2.dllexecutable
MD5:8AE813C940BB9EA0E1031E229822DDA6
SHA256:794686BA1B4F568E281B95814BEB31B12E205C8CB49853D831D650B528A6DB56
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3148.49076\rtinfo.dllexecutable
MD5:B69B0513774A58E805AA15C03EA82B25
SHA256:825C20AA5036605CB9C96870D81E1B052D1AB54ADF6595BF604EBC2B400EE08B
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb3148.3348\IISUTIL2.dllexecutable
MD5:7746FE4D290DB237DB88260B3F550B63
SHA256:A23DFD32AED17E8423589A74E48453442678D972D1FD3D4CDAA1EA41EB35D76F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
20
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6540
svchost.exe
GET
200
23.203.176.221:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.197.202.231:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5188
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5188
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2992
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6540
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6540
svchost.exe
23.203.176.221:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1268
svchost.exe
23.197.202.231:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 172.217.23.110
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.130
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.131
  • 20.190.159.71
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 23.203.176.221
whitelisted
crl.microsoft.com
  • 23.197.202.231
  • 23.197.202.246
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
self.events.data.microsoft.com
  • 13.69.239.68
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted

Threats

PID
Process
Class
Message
4884
AddInProcess32.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 61
4884
AddInProcess32.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DOCUMENTO PDF CON LA INFORMACIO_N DE LA AUDIENCIA PROGRAMADA 20 DE AGOSTO DE 2025.zip