File name:

Siriciuos Protector.rar

Full analysis: https://app.any.run/tasks/6c7d921d-73b6-4187-8e96-d7788b321702
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: August 04, 2024, 22:21:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
telegram
sheetrat
rat
ip-check
wmi-base64
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

8E4F4810E653B7C6ABEAE16033F0BCE3

SHA1:

050A873F90AD985408062660B8BB522D96BE9D22

SHA256:

0B676772A37C09B439E13F94851BB77C02CEFA2732C622FDC56B5328186887A6

SSDEEP:

98304:6mMrqjKTz/zF6jgo3uS7rTYBSZzsWSekSHVMzNJrTMPkSS7wzlkvBrk7JmU1PSYS:zis8wo8IRZqgjV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SHEETRAT has been detected (YARA)

      • Siriciuos Protectorcrck.exe (PID: 1964)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6480)

    • Reads the BIOS version

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • Reads security settings of Internet Explorer

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • The process checks if it is being run in the virtual environment

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • Read disk information to detect sandboxing environments

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • There is functionality for capture public ip (YARA)

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • There is functionality for taking screenshot (YARA)

      • Siriciuos Protectorcrck.exe (PID: 1964)

  • INFO

    • Checks supported languages

      • Siriciuos Protectorcrck.exe (PID: 1964)
      • identity_helper.exe (PID: 7800)

    • Reads the computer name

      • Siriciuos Protectorcrck.exe (PID: 1964)
      • identity_helper.exe (PID: 7800)

    • Reads Microsoft Office registry keys

      • Siriciuos Protectorcrck.exe (PID: 1964)
      • msedge.exe (PID: 4160)

    • Reads the machine GUID from the registry

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6480)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6480)

    • Manual execution by a user

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • Reads Environment values

      • identity_helper.exe (PID: 7800)

    • Attempting to use instant messaging service

      • msedge.exe (PID: 2508)

    • Found Base64 encoded reference to WMI classes (YARA)

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • Application launched itself

      • msedge.exe (PID: 4160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
43
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs #SHEETRAT siriciuos protectorcrck.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1964"C:\Users\admin\Desktop\Siriciuos Protector\Siriciuos Protectorcrck.exe" C:\Users\admin\Desktop\Siriciuos Protector\Siriciuos Protectorcrck.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Siriciuos Protector
Version:
5.0.0.0
Modules
Images
c:\users\admin\desktop\siriciuos protector\siriciuos protectorcrck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2008"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5400 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2224"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4536 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2248"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6836 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2336"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2536 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2508"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2512 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2680"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5228 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2960"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3184"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4056 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
18 287
Read events
18 189
Write events
95
Delete events
3

Modification events

(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Siriciuos Protector.rar
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1964) Siriciuos Protectorcrck.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
13
Suspicious files
81
Text files
83
Unknown types
0

Dropped files

PID
Process
Filename
Type
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Guna.UI2.Extension.dllexecutable
MD5:38BAEAEF676C649D11C4A4E8FD080D03
SHA256:557CA5809AE04FB61AAAD6A6E5AF02F93B39BECDC8DA94849DBF796A3560ADBC
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\icon (4).icoimage
MD5:9C053BEF57C4A7B575A0726AF0E26DAE
SHA256:5BB21D6C04ED64A1368DACE8F44AFF855860E69F235492A5DC8B642A9EA88E41
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\icon (2).icoimage
MD5:F1463F4E1A6EF6CC6E290D46830D2DA1
SHA256:142B529799268A753F5214265C53A26A7A6F8833B31640C90A69A4FF94CEE5EC
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\SimpleObfuscator.dllexecutable
MD5:9967CC2531192B3A140053D86E1BFE22
SHA256:E2D7B0D79FA1FA65E5AD99BD80900048039F6442A6D6EF140515B9AF021932EB
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\icon (7).icoimage
MD5:7891C91D1761DC8A8846D362E6E31869
SHA256:29D38C75AF79AA0554F34CDFECB311F88F8DD02B02FACAA299B9700841806AB8
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\IconExtractor.dllexecutable
MD5:640D8FFA779C6DD5252A262E440C66C0
SHA256:440912D85D2F98BB4F508AB82847067C18E1E15BE0D8ECDCFF0CC19327527FC2
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\icon (10).icoimage
MD5:AD1740CB3317527AA1ACAE6E7440311E
SHA256:7A97547954AAAD629B0563CC78BCA75E3339E8408B70DA2ED67FA73B4935D878
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\telegram channel.txttext
MD5:4FFFF471D9B44057E1C39473C5F939B4
SHA256:9008E2D8C8DC3B318B04C248E4405E0E1CA3BA5F41CBF5DB7071386BFE866DE1
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\icon (3).icoimage
MD5:A512719EFC9E6ECC5E2375ABCEB1669A
SHA256:B2F7FB22CD5B935CF19A2F58F7FEF9DB99DB40772FF4BB331A73C345161C2574
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\outputs\telegram channel.txttext
MD5:4FFFF471D9B44057E1C39473C5F939B4
SHA256:9008E2D8C8DC3B318B04C248E4405E0E1CA3BA5F41CBF5DB7071386BFE866DE1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
67
DNS requests
57
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4920
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6856
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6816
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
8128
svchost.exe
HEAD
200
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0b8df384-7776-4d34-92b7-bfc968353145?P1=1723182532&P2=404&P3=2&P4=Abf0xGmdpDfOspwjMPQrbJe%2bNG%2bD1pEFuXWPpzznAsOWS1o94hNm8Z5qfNucNh58Zi2pd305IuZ3tmvn8u0kmg%3d%3d
unknown
—
—
whitelisted
8128
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0b8df384-7776-4d34-92b7-bfc968353145?P1=1723182532&P2=404&P3=2&P4=Abf0xGmdpDfOspwjMPQrbJe%2bNG%2bD1pEFuXWPpzznAsOWS1o94hNm8Z5qfNucNh58Zi2pd305IuZ3tmvn8u0kmg%3d%3d
unknown
—
—
whitelisted
8128
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0b8df384-7776-4d34-92b7-bfc968353145?P1=1723182532&P2=404&P3=2&P4=Abf0xGmdpDfOspwjMPQrbJe%2bNG%2bD1pEFuXWPpzznAsOWS1o94hNm8Z5qfNucNh58Zi2pd305IuZ3tmvn8u0kmg%3d%3d
unknown
—
—
whitelisted
8128
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0b8df384-7776-4d34-92b7-bfc968353145?P1=1723182532&P2=404&P3=2&P4=Abf0xGmdpDfOspwjMPQrbJe%2bNG%2bD1pEFuXWPpzznAsOWS1o94hNm8Z5qfNucNh58Zi2pd305IuZ3tmvn8u0kmg%3d%3d
unknown
—
—
whitelisted
8128
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0b8df384-7776-4d34-92b7-bfc968353145?P1=1723182532&P2=404&P3=2&P4=Abf0xGmdpDfOspwjMPQrbJe%2bNG%2bD1pEFuXWPpzznAsOWS1o94hNm8Z5qfNucNh58Zi2pd305IuZ3tmvn8u0kmg%3d%3d
unknown
—
—
whitelisted
8128
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0b8df384-7776-4d34-92b7-bfc968353145?P1=1723182532&P2=404&P3=2&P4=Abf0xGmdpDfOspwjMPQrbJe%2bNG%2bD1pEFuXWPpzznAsOWS1o94hNm8Z5qfNucNh58Zi2pd305IuZ3tmvn8u0kmg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4056
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1248
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5336
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4920
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.179
  • 2.23.209.189
  • 2.23.209.182
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.185
  • 2.23.209.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.2
whitelisted
th.bing.com
  • 2.23.209.140
  • 2.23.209.185
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.189
  • 2.23.209.149
  • 2.23.209.133
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2508
msedge.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Siriciuos Protector.rar