File name:

1.exe

Full analysis: https://app.any.run/tasks/7f9f4aaa-3769-4c54-888c-dc3c8530e2a4
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 27, 2025, 16:50:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
telegram
exfiltration
stealer
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

8834E6173743672D28ED0A31625687A7

SHA1:

4127054409FF7060FD861A9158FF4BCAEE8F691C

SHA256:

5CE65BB2652A8039C866DB082256D9B8F4456BE5E1BE5A04F2A0D7272568BC05

SSDEEP:

12288:vIovlu0i+fBJPGWlIgUdW/AI1XWnx1BYYubNb01AC8ykaGLSsn/:zffPJlIrdWoI1Xcx1BYYUNb01AC8y2LF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Stealers network behavior

      • 1.exe (PID: 7460)

    • Attempting to use instant messaging service

      • 1.exe (PID: 7460)

    • Steals credentials from Web Browsers

      • 1.exe (PID: 7460)

    • Actions looks like stealing of personal data

      • 1.exe (PID: 7460)

  • SUSPICIOUS

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • 1.exe (PID: 7460)

    • The process connected to a server suspected of theft

      • 1.exe (PID: 7460)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 1.exe (PID: 7460)

  • INFO

    • Checks supported languages

      • 1.exe (PID: 7460)

    • Disables trace logs

      • 1.exe (PID: 7460)

    • Reads the machine GUID from the registry

      • 1.exe (PID: 7460)

    • Reads the computer name

      • 1.exe (PID: 7460)

    • Checks proxy server information

      • 1.exe (PID: 7460)

    • Create files in a temporary directory

      • 1.exe (PID: 7460)

    • Reads the software policy settings

      • 1.exe (PID: 7460)
      • slui.exe (PID: 7776)

    • Manual execution by a user

      • notepad.exe (PID: 8064)
      • notepad.exe (PID: 8148)
      • WINWORD.EXE (PID: 4112)
      • WINWORD.EXE (PID: 6768)
      • WINWORD.EXE (PID: 5216)
      • WINWORD.EXE (PID: 7988)
      • WINWORD.EXE (PID: 4224)
      • WINWORD.EXE (PID: 2316)
      • WINWORD.EXE (PID: 5720)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 8064)
      • notepad.exe (PID: 8148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:27 06:00:19+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 418304
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x681ae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: CelestialStealer
FileVersion: 1.0.0.0
InternalName: CelestialStealer.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: CelestialStealer.exe
ProductName: CelestialStealer
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
16
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1.exe conhost.exe no specs svchost.exe sppextcomobj.exe no specs slui.exe notepad.exe no specs notepad.exe no specs winword.exe winword.exe no specs ai.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2316"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\mexicolike.rtf /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2904C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4112"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\joineasy.rtf /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
4224"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\textpersons.rtf /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4608"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "BA805325-DFEC-46E5-9931-D0D8964E5A22" "17CA9BAD-1D15-442D-B24E-A2DDB8789F02" "4112"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
5216"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\republicreleases.rtf /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
5720"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\forwardpublished.rtf /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6768"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\lostcenter.rtf /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7460"C:\Users\admin\AppData\Local\Temp\1.exe" C:\Users\admin\AppData\Local\Temp\1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
CelestialStealer
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
23 373
Read events
22 692
Write events
632
Delete events
49

Modification events

(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7460) 1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\1_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
127
Text files
69
Unknown types
42

Dropped files

PID
Process
Filename
Type
74601.exeC:\Users\admin\AppData\Local\Temp\1172925sqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
74601.exeC:\Users\admin\AppData\Local\Temp\118795918\Grabber\DRIVE-C\Users\admin\Desktop\lostcenter.rtftext
MD5:A78BFB0477716C32367CB4629D2EDA7E
SHA256:F7255BD91C9B026BBB9537F37D07CC08691BBD07315AC35F2707C522B4FA0C6B
74601.exeC:\Users\admin\AppData\Local\Temp\118795918\Grabber\DRIVE-C\Users\admin\Documents\mexicolike.rtftext
MD5:2277E01E74C62C234667CC219AA06C3D
SHA256:7EB44B11581E78B8951527CA3F87F820DF043F3C5894A4AEEB705351403B7C8D
74601.exeC:\Users\admin\AppData\Local\Temp\118795918\Grabber\DRIVE-C\Users\admin\Desktop\messagesellers.pngimage
MD5:11EB0F5097B11DBDCEE1334865DCE04F
SHA256:77980FFAA262F11D32CF859C0F887E6279BAE51C97D6613A8141DF930AD7E536
74601.exeC:\Users\admin\AppData\Local\Temp\118795918\Grabber\DRIVE-C\Users\admin\Desktop\servicesshot.rtftext
MD5:1208F2D1786B5D0D01DF5F9C10FD3133
SHA256:C669B289F50573BF20FC048B09B3C3B51975788D56D13419C1A6A1E1C75AAEDF
74601.exeC:\Users\admin\AppData\Local\Temp\118795918\Grabber\DRIVE-C\Users\admin\Desktop\republicreleases.rtftext
MD5:6DCC836556E2A5E7E3CF4D7363915C99
SHA256:35B66D0501885E5148BA179ECCFA67B4E60175AA3E0E5A3251BA2A802589305B
74601.exeC:\Users\admin\AppData\Local\Temp\6007415sqlite
MD5:95FFD778940E6DF4846B0B12C8DD5821
SHA256:21A2DEBD389DB456465DFEFFDB15F0AF3FBC46F007CBA67513A13EB10D14E94F
74601.exeC:\Users\admin\AppData\Local\Temp\118795918\Grabber\DRIVE-C\Users\admin\Documents\textpersons.rtftext
MD5:7523407287C7FB8FB7896FCCC561780E
SHA256:458E675CA3FF5FA21BF4A543E7E83A624BDC236CD0261D2D2FB29122971B5AD9
74601.exeC:\Users\admin\AppData\Local\Temp\118795918\Grabber\DRIVE-C\Users\admin\Pictures\completemin.jpgimage
MD5:95750F7866D2EDFCC94158B790E844F3
SHA256:F34A23DD9652E321CF91B3FE178D14828C960717E916F10C8BF12E42DE6D3EDB
74601.exeC:\Users\admin\AppData\Local\Temp\118795918\Grabber\DRIVE-C\Users\admin\Downloads\proshop.pngimage
MD5:36188AB0A37E4FA96DC41FCC88490ADA
SHA256:92C293E418FA191858F66BB0A6B07AF93D0FE78B884DEE5B56BB8DFF54C51A38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
65
DNS requests
29
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7460
1.exe
GET
200
104.16.184.241:80
http://icanhazip.com/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7460
1.exe
GET
200
104.16.184.241:80
http://icanhazip.com/
unknown
—
—
whitelisted
6300
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4112
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6300
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4112
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
4112
WINWORD.EXE
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5796
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1196
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7460
1.exe
104.16.184.241:80
icanhazip.com
CLOUDFLARENET
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7460
1.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 2.16.253.202
  • 2.23.246.101
whitelisted
google.com
  • 216.58.206.46
whitelisted
icanhazip.com
  • 104.16.184.241
  • 104.16.185.241
whitelisted
api.telegram.org
  • 149.154.167.220
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.5
  • 20.190.160.4
  • 20.190.160.3
  • 40.126.32.140
  • 20.190.160.131
  • 20.190.160.22
  • 40.126.32.138
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted

Threats

PID
Process
Class
Message
7460
1.exe
Attempted Information Leak
ET INFO IP Check Domain (icanhazip. com in HTTP Host)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com)
7460
1.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
7460
1.exe
Attempted Information Leak
ET INFO IP Check Domain (icanhazip. com in HTTP Host)
7460
1.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
7460
1.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
7460
1.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Telegram
7460
1.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
No debug info