File name:

a306099f591e00acd2e06f25b6807a91.exe

Full analysis: https://app.any.run/tasks/f06cd049-9e8b-47fd-ae92-8fd01f0d45cc
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 04:09:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
xworm
crypto-regex
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

A306099F591E00ACD2E06F25B6807A91

SHA1:

42E830BFE94B30D81F20A36F05BA4B4827A79AEB

SHA256:

22FF9ACC75F58F92A99DD89392AC62A096F735DE2E9A2AAC48327864530CD7C1

SSDEEP:

1536:GVw0ohI39Yi/5YqF6ME/zk9+Xv9fbdUFEn3BhO1Oe/jOIbf0rJQE6tapF:GVQhq5h8MErkEXVfbdWC3q11OysCyF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • Create files in the Startup directory

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • XWORM has been detected (YARA)

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • XWORM has been detected (SURICATA)

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • Checks for external IP

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)
      • svchost.exe (PID: 2196)

    • Found regular expressions for crypto-addresses (YARA)

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • Connects to unusual port

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • Contacting a server suspected of hosting an CnC

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 7280)

  • INFO

    • Reads Environment values

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • Reads the machine GUID from the registry

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • Reads the computer name

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)
      • ShellExperienceHost.exe (PID: 7280)

    • Checks supported languages

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)
      • ShellExperienceHost.exe (PID: 7280)

    • Disables trace logs

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • Checks proxy server information

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)
      • BackgroundTransferHost.exe (PID: 7840)

    • Creates files or folders in the user directory

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)
      • BackgroundTransferHost.exe (PID: 7840)

    • Autorun file from Startup directory

      • a306099f591e00acd2e06f25b6807a91.exe (PID: 4428)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7624)
      • BackgroundTransferHost.exe (PID: 7840)
      • BackgroundTransferHost.exe (PID: 7172)
      • BackgroundTransferHost.exe (PID: 4448)
      • BackgroundTransferHost.exe (PID: 8004)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7840)
      • slui.exe (PID: 1660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:21 23:25:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 84992
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x16b5e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: heh.exe
LegalCopyright:
OriginalFileName: heh.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
11
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XWORM a306099f591e00acd2e06f25b6807a91.exe sppextcomobj.exe no specs slui.exe svchost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs shellexperiencehost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
960C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1660"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4428"C:\Users\admin\AppData\Local\Temp\a306099f591e00acd2e06f25b6807a91.exe" C:\Users\admin\AppData\Local\Temp\a306099f591e00acd2e06f25b6807a91.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\a306099f591e00acd2e06f25b6807a91.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4448"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7172"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7196C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7280"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
7624"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7840"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
4 825
Read events
4 793
Write events
32
Delete events
0

Modification events

(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Client
Value:
C:\Users\admin\AppData\Roaming\Client.exe
(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\a306099f591e00acd2e06f25b6807a91_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\a306099f591e00acd2e06f25b6807a91_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\a306099f591e00acd2e06f25b6807a91_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\a306099f591e00acd2e06f25b6807a91_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\a306099f591e00acd2e06f25b6807a91_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\a306099f591e00acd2e06f25b6807a91_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\a306099f591e00acd2e06f25b6807a91_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\a306099f591e00acd2e06f25b6807a91_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4428) a306099f591e00acd2e06f25b6807a91.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\a306099f591e00acd2e06f25b6807a91_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
1
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7840BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4158558e-726c-4b30-b1dd-66a5d49f934b.down_data —
MD5:—
SHA256:—
7840BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
4428a306099f591e00acd2e06f25b6807a91.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.lnkbinary
MD5:7E7A7A73B19EFAE3135B71635F9282E4
SHA256:BD26CC18CD5E318AB500A5B87BF8F57D4BC2279E87A95DA15B26D2C73B15EEDD
4428a306099f591e00acd2e06f25b6807a91.exeC:\Users\admin\AppData\Roaming\Client.exeexecutable
MD5:A306099F591E00ACD2E06F25B6807A91
SHA256:22FF9ACC75F58F92A99DD89392AC62A096F735DE2E9A2AAC48327864530CD7C1
7840BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4158558e-726c-4b30-b1dd-66a5d49f934b.e0634324-3a93-4a1e-8bae-583d922396f5.down_metabinary
MD5:8C4BC3162F133BEB5C1A7C278A729C38
SHA256:11BDF5F64F25FE0138A26B59C2CD9DFF57CA96A5D04DA656B17FE04B2307A928
7840BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:D046B17BE0989BBE4EEE38FB78DF3CFA
SHA256:5E84DA591DA84845D6C33DD22BBEF38CDF905782E55DD8DFA314C9FBA333898F
7840BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9c96e21a-1bb9-4cd7-8002-b18bced39bcd.e0634324-3a93-4a1e-8bae-583d922396f5.down_metabinary
MD5:8C4BC3162F133BEB5C1A7C278A729C38
SHA256:11BDF5F64F25FE0138A26B59C2CD9DFF57CA96A5D04DA656B17FE04B2307A928
7840BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9c96e21a-1bb9-4cd7-8002-b18bced39bcd.up_meta_securebinary
MD5:E9EC17143B119407F1F6A70824E45D01
SHA256:12B22E0DEEDC1FF90ED88FD38CD53A4E877A86B249D28085B821F157AF55B711
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
17
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4428
a306099f591e00acd2e06f25b6807a91.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7840
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5528
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7724
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7724
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4428
a306099f591e00acd2e06f25b6807a91.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
google.com
  • 142.250.184.238
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.74
  • 20.190.160.3
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.64
  • 20.190.160.66
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.19.122.12
  • 2.19.122.26
  • 2.19.122.30
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
4428
a306099f591e00acd2e06f25b6807a91.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
4428
a306099f591e00acd2e06f25b6807a91.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
4428
a306099f591e00acd2e06f25b6807a91.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
a306099f591e00acd2e06f25b6807a91.exe