File name:

UnamBinder.rar

Full analysis: https://app.any.run/tasks/48d052a0-9e32-4b90-9c0f-30f2c891e13e
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: August 14, 2024, 15:13:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
xworm
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

AAB24D1586850A4D148EAFEDD2FA7A27

SHA1:

BDC8D522BA4ABBDBDB63F45B6EBD98DD300013B8

SHA256:

DBF2CB7DA5398A29CAF5D636A76C716801D6562646EDC694B2C9F2AE6289642C

SSDEEP:

98304:ZiBqT/u99DKmqxHPorRRVTshbmk+ou7M4PiKovQfNI+IcyiGlHZlZqnkTspgYrCD:q4827GqLZM1e2fRlDYV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • crack.exe (PID: 6272)

    • Uses Task Scheduler to run other applications

      • crack.exe (PID: 6272)

    • Create files in the Startup directory

      • crack.exe (PID: 6272)

    • Changes powershell execution policy (Bypass)

      • UnamBinder V2.0.exe (PID: 6196)

    • Adds path to the Windows Defender exclusion list

      • UnamBinder V2.0.exe (PID: 6196)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2424)

    • XWORM has been detected (YARA)

      • crack.exe (PID: 6272)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • crack.exe (PID: 6272)
      • Windows Driver Fondation.exe (PID: 7076)

    • Reads the date of Windows installation

      • UnamBinder.exe (PID: 6252)
      • crack.exe (PID: 6272)
      • UnamBinder V2.0.exe (PID: 6352)
      • UnamBinder V2.0.exe (PID: 6196)

    • Executable content was dropped or overwritten

      • UnamBinder.exe (PID: 6252)
      • crack.exe (PID: 6272)
      • UnamBinder V2.0.exe (PID: 6196)

    • Process drops legitimate windows executable

      • UnamBinder.exe (PID: 6252)
      • crack.exe (PID: 6272)
      • UnamBinder V2.0.exe (PID: 6196)

    • Drops the executable file immediately after the start

      • UnamBinder.exe (PID: 6252)
      • UnamBinder V2.0.exe (PID: 6196)
      • crack.exe (PID: 6272)

    • Reads security settings of Internet Explorer

      • UnamBinder.exe (PID: 6252)
      • crack.exe (PID: 6272)
      • UnamBinder V2.0.exe (PID: 6352)
      • UnamBinder V2.0.exe (PID: 6196)

    • Connects to unusual port

      • crack.exe (PID: 6272)

    • Application launched itself

      • UnamBinder V2.0.exe (PID: 6352)

    • Script adds exclusion path to Windows Defender

      • UnamBinder V2.0.exe (PID: 6196)

    • Starts POWERSHELL.EXE for commands execution

      • UnamBinder V2.0.exe (PID: 6196)

  • INFO

    • Process checks computer location settings

      • UnamBinder.exe (PID: 6252)
      • crack.exe (PID: 6272)
      • UnamBinder V2.0.exe (PID: 6352)
      • UnamBinder V2.0.exe (PID: 6196)

    • Checks supported languages

      • crack.exe (PID: 6272)
      • UnamBinder.exe (PID: 6252)
      • UnamBinder V2.0.exe (PID: 6352)
      • UnamBinder V2.0.exe (PID: 6196)
      • Windows Driver Fondation.exe (PID: 7076)
      • UnamBinder.exe (PID: 6428)

    • Reads the computer name

      • UnamBinder.exe (PID: 6252)
      • crack.exe (PID: 6272)
      • UnamBinder V2.0.exe (PID: 6352)
      • UnamBinder V2.0.exe (PID: 6196)
      • Windows Driver Fondation.exe (PID: 7076)
      • UnamBinder.exe (PID: 6428)

    • Manual execution by a user

      • UnamBinder.exe (PID: 6252)
      • UnamBinder V2.0.exe (PID: 6352)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6452)

    • Reads the machine GUID from the registry

      • crack.exe (PID: 6272)
      • UnamBinder V2.0.exe (PID: 6196)
      • Windows Driver Fondation.exe (PID: 7076)
      • UnamBinder.exe (PID: 6428)

    • Create files in a temporary directory

      • crack.exe (PID: 6272)
      • UnamBinder V2.0.exe (PID: 6196)

    • Creates files or folders in the user directory

      • crack.exe (PID: 6272)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2424)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6272) crack.exe
C2jajaovh.duckdns.org:1605
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.0
MutexULGFpUS9mj98magF
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2424"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Local\Temp\Windows Driver Fondation.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—UnamBinder V2.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2480"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Windows Driver Fondation" /tr "C:\Users\admin\AppData\Local\Temp\Windows Driver Fondation"C:\Windows\System32\schtasks.exe—crack.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3176C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4576\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5152\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6196"C:\Users\admin\Desktop\UnamBinder\UnamBinder\UnamBinder V2.0.exe" C:\Users\admin\Desktop\UnamBinder\UnamBinder\UnamBinder V2.0.exe
UnamBinder V2.0.exe
User:
admin
Integrity Level:
HIGH
Description:
UnamBinder
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\unambinder\unambinder\unambinder v2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6252"C:\Users\admin\Desktop\UnamBinder\UnamBinder\UnamBinder.exe" C:\Users\admin\Desktop\UnamBinder\UnamBinder\UnamBinder.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\unambinder\unambinder\unambinder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6272"C:\Users\admin\Desktop\UnamBinder\UnamBinder\crack.exe" C:\Users\admin\Desktop\UnamBinder\UnamBinder\crack.exe
UnamBinder.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Visual C++ 2008 Redistributable Setup
Version:
9.0.30729.5677
Modules
Images
c:\users\admin\desktop\unambinder\unambinder\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
XWorm
(PID) Process(6272) crack.exe
C2jajaovh.duckdns.org:1605
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.0
MutexULGFpUS9mj98magF
6352"C:\Users\admin\Desktop\UnamBinder\UnamBinder\UnamBinder V2.0.exe" C:\Users\admin\Desktop\UnamBinder\UnamBinder\UnamBinder V2.0.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
UnamBinder
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\unambinder\unambinder\unambinder v2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
19 589
Read events
19 547
Write events
42
Delete events
0

Modification events

(PID) Process:(6452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\UnamBinder.rar
(PID) Process:(6452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6452) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6252) UnamBinder.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
6
Suspicious files
1
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
6272crack.exeC:\Users\admin\AppData\Local\Temp\Windows Driver Fondationexecutable
MD5:6BBA70ECF767C84AFF30E2F51E3F74EC
SHA256:010B8DB19EAD1BA157738C6DA0D1E5AE38F611AAC56DE325E872E1DC61229CF2
2424powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0ku3muyu.2fk.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6252UnamBinder.exeC:\Users\admin\Desktop\UnamBinder\UnamBinder\crack.exeexecutable
MD5:6BBA70ECF767C84AFF30E2F51E3F74EC
SHA256:010B8DB19EAD1BA157738C6DA0D1E5AE38F611AAC56DE325E872E1DC61229CF2
6452WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6452.26304\UnamBinder\UnamBinder\UnamBinder.exeexecutable
MD5:E28B353CDD171BEBC92BFBA22DF84E55
SHA256:9540580E625097FAC1E7F290EF3672D37E30DC27CA5349A2F525BA2DA4980531
6252UnamBinder.exeC:\Users\admin\Desktop\UnamBinder\UnamBinder\README.txttext
MD5:E5C9AA021D1B344F9EE1575DC90F834B
SHA256:888837FD33A8BCB6E5E15F2017B66B69C3041A6C1718E8DA527DF05544B47922
6272crack.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Driver Fondation.lnklnk
MD5:3D42676F9AA3D37F2143CE6E7CBCA063
SHA256:2E0BD5B988DECCCFABE0739FFA8BFDAC8C53086612477FB6BF4678AF0358DF4B
6252UnamBinder.exeC:\Users\admin\Desktop\UnamBinder\UnamBinder\UnamBinder V2.0.exeexecutable
MD5:A6886FBA3A6A16A2F59412DCDBD2AE1C
SHA256:A9D75135B88E4506DE39D75EFB6756B0334E450CF0091E4A9272DA05C4778159
2424powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e5k1bu0n.5qj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6196UnamBinder V2.0.exeC:\Users\admin\AppData\Local\Temp\Windows Driver Fondation.exeexecutable
MD5:6BBA70ECF767C84AFF30E2F51E3F74EC
SHA256:010B8DB19EAD1BA157738C6DA0D1E5AE38F611AAC56DE325E872E1DC61229CF2
2424powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:449BA96A3A1C2379331844F085CF42AB
SHA256:AE40B0EA3C56B9CF1C5E1C1E3B01E49A8E75EF8F106F779409474C6F94D1EFCD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
44
DNS requests
21
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6808
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
2608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
313 b
whitelisted
2608
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
6860
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5028
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1164
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5028
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
2.23.209.156:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2608
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.23.209.156
  • 2.23.209.158
  • 2.23.209.154
  • 2.23.209.141
  • 2.23.209.143
  • 2.23.209.162
  • 2.23.209.149
  • 2.23.209.160
  • 2.23.209.150
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.138
  • 40.126.32.76
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.22
  • 40.126.32.136
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
th.bing.com
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.186
  • 2.23.209.189
  • 2.23.209.187
  • 2.23.209.183
  • 2.23.209.185
  • 2.23.209.133
  • 2.23.209.131
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2256
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2256
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2256
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2256
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2256
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UnamBinder.rar