File name:

Xerin_v3.0.0.29.7z

Full analysis: https://app.any.run/tasks/3084db23-1c8a-4677-bcd7-40b40856b57e
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: October 27, 2024, 21:23:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
telegram
arch-html
xworm
crypto-regex
ims-api
generic
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.3
MD5:

B846C33B708467B801FC13D9399BB1FC

SHA1:

2AF4AC5D34992776E2AE85A9ED85A6DF3DE6DE6D

SHA256:

E3792B98AD7CEA8046AC568CD01786AB6C784F254A3FD08FE34063498AF1FBDB

SSDEEP:

98304:fmSnjNpx04BFlyYEuWmnpkiqM0vKDpSzdITktzWZCAt9HQAzVUXcDDEWenWJNpDA:fYY4xh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6132)

    • Create files in the Startup directory

      • svchost.exe (PID: 7060)
      • msedgewebview2.exe (PID: 6316)

    • Adds path to the Windows Defender exclusion list

      • msedgewebview2.exe (PID: 6316)

    • XWORM has been detected (YARA)

      • svchost.exe (PID: 7060)

    • Uses Task Scheduler to run other applications

      • msedgewebview2.exe (PID: 6316)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • XerinFuscator G3‌‌.exe (PID: 1576)

    • Reads security settings of Internet Explorer

      • XerinFuscator G3‌‌.exe (PID: 1576)
      • msedgewebview2.exe (PID: 6316)

    • Reads the date of Windows installation

      • XerinFuscator G3‌‌.exe (PID: 1576)
      • msedgewebview2.exe (PID: 6316)

    • The process creates files with name similar to system file names

      • XerinFuscator G3‌‌.exe (PID: 1576)

    • Process drops legitimate windows executable

      • XerinFuscator G3‌‌.exe (PID: 1576)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • svchost.exe (PID: 7060)

    • Connects to unusual port

      • svchost.exe (PID: 7060)

    • Starts POWERSHELL.EXE for commands execution

      • msedgewebview2.exe (PID: 6316)

    • Script adds exclusion path to Windows Defender

      • msedgewebview2.exe (PID: 6316)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 7060)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • svchost.exe (PID: 7060)

    • Starts itself from another location

      • msedgewebview2.exe (PID: 6316)

    • Executing commands from ".cmd" file

      • msedgewebview2.exe (PID: 6316)

    • Starts CMD.EXE for commands execution

      • msedgewebview2.exe (PID: 6316)

    • There is functionality for taking screenshot (YARA)

      • XerinFuscator G3.exe (PID: 6228)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7748)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6132)
      • XerinFuscator G3‌‌.exe (PID: 1576)
      • msedgewebview2.exe (PID: 6316)

    • Checks supported languages

      • XerinFuscator G3‌‌.exe (PID: 1576)
      • XerinFuscator G3.exe (PID: 6228)
      • svchost.exe (PID: 7060)
      • msedgewebview2.exe (PID: 6316)
      • msedgewebview2.exe (PID: 7732)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6132)

    • Manual execution by a user

      • XerinFuscator G3‌‌.exe (PID: 1576)

    • Reads the computer name

      • XerinFuscator G3‌‌.exe (PID: 1576)
      • svchost.exe (PID: 7060)
      • XerinFuscator G3.exe (PID: 6228)
      • msedgewebview2.exe (PID: 6316)
      • msedgewebview2.exe (PID: 7732)

    • Reads the machine GUID from the registry

      • XerinFuscator G3‌‌.exe (PID: 1576)
      • svchost.exe (PID: 7060)
      • XerinFuscator G3.exe (PID: 6228)
      • msedgewebview2.exe (PID: 7732)

    • Process checks computer location settings

      • XerinFuscator G3‌‌.exe (PID: 1576)
      • msedgewebview2.exe (PID: 6316)

    • Creates files or folders in the user directory

      • XerinFuscator G3‌‌.exe (PID: 1576)
      • svchost.exe (PID: 7060)
      • msedgewebview2.exe (PID: 6316)

    • Reads Environment values

      • svchost.exe (PID: 7060)

    • Creates files in the program directory

      • XerinFuscator G3‌‌.exe (PID: 1576)

    • Disables trace logs

      • svchost.exe (PID: 7060)

    • Checks proxy server information

      • svchost.exe (PID: 7060)

    • Reads the software policy settings

      • svchost.exe (PID: 7060)
      • slui.exe (PID: 7996)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 7060)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1748)

    • Create files in a temporary directory

      • msedgewebview2.exe (PID: 6316)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (gen) (100)

EXIF

ZIP

FileVersion: 7z v0.03
ModifyDate: 2024:09:30 13:03:24+00:00
ArchivedFileName: Xerin_v3.0.0.29/Confuser.Core.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs xerinfuscator g3‌‌.exe THREAT xerinfuscator g3.exe no specs THREAT svchost.exe msedgewebview2.exe powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs msedgewebview2.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1576"C:\Users\admin\Desktop\Xerin_v3.0.0.29\XerinFuscator G3‌‌.exe" C:\Users\admin\Desktop\Xerin_v3.0.0.29\XerinFuscator G3‌‌.exe
explorer.exe
User:
admin
Company:
Inx
Integrity Level:
MEDIUM
Description:
XerinFuscator G3
Exit code:
0
Version:
3.0.0.29
Modules
Images
c:\users\admin\desktop\xerin_v3.0.0.29\xerinfuscator g3‌‌.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1748"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Local\msedgewebview2' C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2864C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3676\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5100C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6132"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Xerin_v3.0.0.29.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6228"C:\Users\admin\Desktop\Xerin_v3.0.0.29\XerinFuscator G3.exe" C:\Users\admin\Desktop\Xerin_v3.0.0.29\XerinFuscator G3.exe
XerinFuscator G3‌‌.exe
User:
admin
Company:
Inx
Integrity Level:
MEDIUM
Description:
XerinFuscator G3
Exit code:
0
Version:
3.0.0.29
Modules
Images
c:\users\admin\desktop\xerin_v3.0.0.29\xerinfuscator g3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6316"C:\ProgramData\msedgewebview2.exe" C:\ProgramData\msedgewebview2.exe
XerinFuscator G3‌‌.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
128.0.2739.79
Modules
Images
c:\programdata\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6772"schtasks.exe" /create /tn msedgewebview2 /tr "C:\Users\admin\AppData\Local\msedgewebview2\msedgewebview2.exe" /st 21:28 /du 23:59 /sc daily /ri 1 /fC:\Windows\System32\schtasks.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
10 421
Read events
10 405
Write events
16
Delete events
0

Modification events

(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Xerin_v3.0.0.29.7z
(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
Executable files
15
Suspicious files
3
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1576XerinFuscator G3‌‌.exeC:\ProgramData\msedgewebview2.exe —
MD5:—
SHA256:—
6132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6132.2240\Xerin_v3.0.0.29\Xerin.Core.dllexecutable
MD5:3BD157760C0B4FE65CD09A253B6B6776
SHA256:3DDEA908DA6421E5CD5D56C45E9E297F4982AC8571970BA5C9E901A3AE1E3C06
6316msedgewebview2.exeC:\Users\admin\AppData\Local\msedgewebview2\msedgewebview2.exe —
MD5:—
SHA256:—
6132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6132.2240\Xerin_v3.0.0.29\Xerin.Protections.dllexecutable
MD5:71AA971AF308ECCC853AC8231F2A3E66
SHA256:5A1A9F8EBCBA57B53D872EF8F83D4B353FDF4E74A36A6B094A3689D9B05D289D
6132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6132.2240\Xerin_v3.0.0.29\Guna.UI2.dllexecutable
MD5:278752062981DB6FE27BA55F5099B8AE
SHA256:538E6CA6001D609E251F88243409A2CBC9BC0517751843E76485A2C335E7829B
6132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6132.2240\Xerin_v3.0.0.29\Renamer\Confuser.Renamer.dllexecutable
MD5:AE45442BFFBE39F3F894D49DC6AB3078
SHA256:57625B7F136B683CBC343040935581F774D2A0FECDA85DA942603AB1285CA0B6
6132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6132.2240\Xerin_v3.0.0.29\Renamer\Confuser.Core.dllexecutable
MD5:924C09AD9F409B6FD5068C5F62E9BE9F
SHA256:145BFB825A224BD09D3EEB2F5BBEBBDA0B0A627AC35E6BC5ADFEF9537D46210C
6132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6132.2240\Xerin_v3.0.0.29\Xerin.Runtime.dllexecutable
MD5:4423CB3F265CDBBF8D9EB85885D50C22
SHA256:1D552C42BC1078E2D3FD35FDE974A12DBD8C54D96C64948C1D79E11922F6EBE4
6132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6132.2240\Xerin_v3.0.0.29\XVM.Core.dllexecutable
MD5:5023CC358B95E6593584093107ABB8BA
SHA256:257BE95DD0695CC93D2B617D97EDF92C023A275123677A7F868B916959F6C681
6132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6132.2240\Xerin_v3.0.0.29\Renamer\dnlib.dllexecutable
MD5:D5192B93E33685E3099FA23689EB5E9D
SHA256:2562089CAAFBA02FFFE74207EA2FB2BA049C58852F3AC4749DC820950C1F6798
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
47
DNS requests
24
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4004
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6996
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6996
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2280
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1248
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6944
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7060
svchost.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
shared
4360
SearchApp.exe
2.23.209.189:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
api.telegram.org
  • 149.154.167.220
shared
www.bing.com
  • 2.23.209.189
  • 2.23.209.187
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.182
  • 2.23.209.179
  • 2.23.209.130
  • 2.23.209.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.68
  • 20.190.159.0
  • 40.126.31.71
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.71
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
th.bing.com
  • 2.23.209.133
  • 2.23.209.130
  • 2.23.209.149
  • 2.23.209.179
  • 2.23.209.140
  • 2.23.209.189
  • 2.23.209.182
  • 2.23.209.187
whitelisted

Threats

PID
Process
Class
Message
7060
svchost.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
2172
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
7060
svchost.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Xerin_v3.0.0.29.7z