File name:

unban.exe

Full analysis: https://app.any.run/tasks/a5629308-265d-4888-81bc-5a81ca5438f5
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: April 10, 2025, 14:53:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
xworm
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

726B432E7D30F25D6BE8C64F550F404C

SHA1:

D8D9840FB4320A5A33F0725ABE523AD026500B2E

SHA256:

B0E1A23205FC1B4D5B9B90BAE679DD88975A85D3456B2591E53F37F289003D31

SSDEEP:

1536:DjifUvqm2V9tDY9fXiDj1cuImxs9nCsvTHf67f/IvBQEezOOtrR3YAjM5w:zvA9O9faDKZbmL73Y9K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Runtime Broker.exe (PID: 7772)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8060)
      • powershell.exe (PID: 660)
      • powershell.exe (PID: 6004)
      • powershell.exe (PID: 4040)

    • Changes Windows Defender settings

      • Runtime Broker.exe (PID: 7772)

    • Changes powershell execution policy (Bypass)

      • Runtime Broker.exe (PID: 7772)

    • Adds process to the Windows Defender exclusion list

      • Runtime Broker.exe (PID: 7772)

    • Uses Task Scheduler to run other applications

      • Runtime Broker.exe (PID: 7772)

    • Changes the autorun value in the registry

      • Runtime Broker.exe (PID: 7772)

    • XWORM has been detected

      • Runtime Broker.exe (PID: 7772)

    • XWORM has been detected (SURICATA)

      • Runtime Broker.exe (PID: 7772)

    • Create files in the Startup directory

      • Runtime Broker.exe (PID: 7772)

  • SUSPICIOUS

    • Writes data into a file (POWERSHELL)

      • unban.exe (PID: 7224)

    • Reads security settings of Internet Explorer

      • unban.exe (PID: 7224)
      • Runtime Broker.exe (PID: 7772)

    • Uses base64 encoding (POWERSHELL)

      • unban.exe (PID: 7224)

    • Executable content was dropped or overwritten

      • unban.exe (PID: 7224)
      • Runtime Broker.exe (PID: 7772)

    • Reads the date of Windows installation

      • unban.exe (PID: 7224)
      • Runtime Broker.exe (PID: 7772)

    • Script adds exclusion path to Windows Defender

      • Runtime Broker.exe (PID: 7772)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Runtime Broker.exe (PID: 7772)

    • Starts POWERSHELL.EXE for commands execution

      • Runtime Broker.exe (PID: 7772)

    • Script adds exclusion process to Windows Defender

      • Runtime Broker.exe (PID: 7772)

    • Connects to unusual port

      • Runtime Broker.exe (PID: 7772)

    • The process executes via Task Scheduler

      • svchost.exe (PID: 7288)

    • Contacting a server suspected of hosting an CnC

      • Runtime Broker.exe (PID: 7772)

  • INFO

    • Reads the software policy settings

      • unban.exe (PID: 7224)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • unban.exe (PID: 7224)
      • powershell.exe (PID: 8060)
      • powershell.exe (PID: 660)
      • powershell.exe (PID: 4040)
      • powershell.exe (PID: 6004)

    • Reads the machine GUID from the registry

      • unban.exe (PID: 7224)
      • Runtime Broker.exe (PID: 7772)
      • svchost.exe (PID: 7288)

    • Create files in a temporary directory

      • unban.exe (PID: 7224)

    • Reads Environment values

      • Runtime Broker.exe (PID: 7772)

    • Process checks computer location settings

      • unban.exe (PID: 7224)
      • Runtime Broker.exe (PID: 7772)

    • Checks supported languages

      • Runtime Broker.exe (PID: 7772)
      • unban.exe (PID: 7224)
      • svchost.exe (PID: 7288)

    • Reads the computer name

      • Runtime Broker.exe (PID: 7772)
      • unban.exe (PID: 7224)
      • svchost.exe (PID: 7288)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8060)
      • powershell.exe (PID: 660)
      • powershell.exe (PID: 6004)
      • powershell.exe (PID: 4040)

    • Creates files or folders in the user directory

      • Runtime Broker.exe (PID: 7772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:08 15:15:02+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 87040
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x1725e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: output.exe
LegalCopyright:
OriginalFileName: output.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
18
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start unban.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe #XWORM runtime broker.exe svchost.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs svchost.exe no specs unban.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Runtime Broker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1228\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2284"C:\Users\admin\AppData\Local\Temp\unban.exe" C:\Users\admin\AppData\Local\Temp\unban.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221226540
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\unban.exe
c:\windows\system32\ntdll.dll
4024\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4040"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Runtime Broker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
5428\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6004"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Runtime Broker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7224"C:\Users\admin\AppData\Local\Temp\unban.exe" C:\Users\admin\AppData\Local\Temp\unban.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\unban.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—unban.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
29 250
Read events
29 235
Write events
15
Delete events
0

Modification events

(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7772) Runtime Broker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Runtime Broker_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
2
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
7224unban.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_h5ixcpgw.z0b.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7772Runtime Broker.exeC:\ProgramData\svchost.exeexecutable
MD5:2AE2C5B2EE04C1C3B7FA61490E2511EB
SHA256:620A22589A9FDE47DBF65E5C8E9E1A19DC9F6C87E3C52736BD9275BBA84480B0
8060powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xtopokjh.fvz.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4040powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_gegmijpu.23y.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4040powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_gbkwgac0.dwm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7772Runtime Broker.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnkbinary
MD5:051B52FCEA47E1940A8C52C68BF17015
SHA256:992923E5416893ADA6D6970CEDEE3F94B6D67E9EF404502BF7662A4314947BC3
6004powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wxxq2msy.0tl.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7224unban.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tb4xmhqk.pls.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6004powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wva5zsgm.35g.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8060powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_w4in5kwv.0ez.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
15
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7432
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7772
Runtime Broker.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7432
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4380
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.14
  • 20.190.160.3
  • 20.190.160.4
  • 20.190.160.2
  • 20.190.160.130
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7772
Runtime Broker.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7772
Runtime Broker.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
7772
Runtime Broker.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
unban.exe