URL:

https://disk.yandex.ru/d/S9C3SgeOr2UD7g

Full analysis: https://app.any.run/tasks/85640fc2-c142-45e6-a9be-6d2c4684ec20
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 16:04:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autorun-download
sheetrat
rat
stealer
evasion
remote
arch-doc
Indicators:
MD5:

A652851FF0C9E832E907E22CE898BA17

SHA1:

23FDDE5F1409684FFF866A3990919BEC7F321B96

SHA256:

3725CBF1EE1C946A387256E4E56EFEDEBC2DF755B2E3A22A87D74D43B358F40A

SSDEEP:

3:N8U2cmEAsXLCn:2U2cPmn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SHEETRAT mutex has been found

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Actions looks like stealing of personal data

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Steals credentials from Web Browsers

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Connects to the CnC server

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 6416)
      • cmd.exe (PID: 732)
      • cmd.exe (PID: 552)
      • cmd.exe (PID: 4436)
      • cmd.exe (PID: 7688)
      • cmd.exe (PID: 7860)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 5596)
      • cmd.exe (PID: 2104)
      • cmd.exe (PID: 2896)
      • cmd.exe (PID: 4388)
      • cmd.exe (PID: 7656)
      • cmd.exe (PID: 7196)
      • cmd.exe (PID: 6316)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 7080)
      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 2260)
      • cmd.exe (PID: 2040)
      • cmd.exe (PID: 3828)
      • cmd.exe (PID: 3240)
      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 6068)
      • cmd.exe (PID: 5008)
      • cmd.exe (PID: 6340)
      • cmd.exe (PID: 6112)
      • cmd.exe (PID: 3156)
      • cmd.exe (PID: 3160)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2908)

    • Changes the login/logoff helper path in the registry

      • Duglass Minecraft.exe (PID: 8084)

    • Changes the AppInit_DLLs value (autorun option)

      • Duglass Minecraft.exe (PID: 8084)

    • Changes the autorun value in the registry

      • Duglass Minecraft.exe (PID: 8084)

    • SHEETRAT has been detected (SURICATA)

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Runs injected code in another process

      • Duglass Minecraft.exe (PID: 3364)

    • Application was injected by another process

      • csrss.exe (PID: 5824)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Duglass Minecraft.exe (PID: 8084)

    • Executable content was dropped or overwritten

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • The process checks if it is being run in the virtual environment

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 6080)
      • WmiApSrv.exe (PID: 2924)

    • Connects to unusual port

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Loads DLL from Mozilla Firefox

      • Duglass Minecraft.exe (PID: 8084)

    • Reads the date of Windows installation

      • Duglass Minecraft.exe (PID: 8084)

    • Starts CMD.EXE for commands execution

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 8044)

    • Starts process via Powershell

      • powershell.exe (PID: 2908)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Potential Corporate Privacy Violation

      • Duglass Minecraft.exe (PID: 8084)

    • Contacting a server suspected of hosting an CnC

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Application launched itself

      • Duglass Minecraft.exe (PID: 8084)

    • Creates file in the systems drive root

      • Duglass Minecraft.exe (PID: 3364)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 2432)

    • Autorun file from Downloads

      • chrome.exe (PID: 4452)
      • chrome.exe (PID: 2432)

    • Reads the computer name

      • Duglass Minecraft.exe (PID: 8084)
      • SearchApp.exe (PID: 776)
      • Duglass Minecraft.exe (PID: 3364)

    • Manual execution by a user

      • Duglass Minecraft.exe (PID: 8084)
      • WinRAR.exe (PID: 5384)
      • WinRAR.exe (PID: 5352)

    • The sample compiled with english language support

      • chrome.exe (PID: 7728)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5384)
      • chrome.exe (PID: 7728)

    • Creates files or folders in the user directory

      • Duglass Minecraft.exe (PID: 8084)

    • Reads the time zone

      • Duglass Minecraft.exe (PID: 8084)

    • Reads CPU info

      • Duglass Minecraft.exe (PID: 8084)

    • Reads the machine GUID from the registry

      • Duglass Minecraft.exe (PID: 8084)
      • SearchApp.exe (PID: 776)

    • Create files in a temporary directory

      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Checks proxy server information

      • Duglass Minecraft.exe (PID: 8084)
      • slui.exe (PID: 4436)

    • Process checks computer location settings

      • SearchApp.exe (PID: 776)
      • Duglass Minecraft.exe (PID: 8084)

    • Checks supported languages

      • SearchApp.exe (PID: 776)
      • Duglass Minecraft.exe (PID: 8084)
      • Duglass Minecraft.exe (PID: 3364)

    • Reads Environment values

      • Duglass Minecraft.exe (PID: 8084)
      • SearchApp.exe (PID: 776)

    • Disables trace logs

      • Duglass Minecraft.exe (PID: 8084)

    • Autorun file from Task Scheduler

      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 6416)
      • cmd.exe (PID: 732)
      • cmd.exe (PID: 4436)
      • cmd.exe (PID: 7688)
      • cmd.exe (PID: 552)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 2104)
      • cmd.exe (PID: 5596)
      • cmd.exe (PID: 4388)
      • cmd.exe (PID: 7196)
      • cmd.exe (PID: 2896)
      • cmd.exe (PID: 6316)
      • cmd.exe (PID: 7656)
      • cmd.exe (PID: 7080)
      • cmd.exe (PID: 7860)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 2040)
      • cmd.exe (PID: 2260)
      • cmd.exe (PID: 3828)
      • cmd.exe (PID: 6112)
      • cmd.exe (PID: 3248)
      • cmd.exe (PID: 3156)
      • cmd.exe (PID: 3240)
      • cmd.exe (PID: 6068)
      • cmd.exe (PID: 6340)
      • cmd.exe (PID: 5008)
      • cmd.exe (PID: 3160)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2908)

    • Reads the software policy settings

      • SearchApp.exe (PID: 776)
      • slui.exe (PID: 4436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
276
Monitored processes
127
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs rundll32.exe no specs winrar.exe slui.exe chrome.exe #SHEETRAT duglass minecraft.exe chrome.exe no specs wmiapsrv.exe no specs searchapp.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs powershell.exe no specs svchost.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #SHEETRAT duglass minecraft.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs wmiapsrv.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs winrar.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chrome.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs csrss.exe

Process information

PID
CMD
Path
Indicators
Parent process
552"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Audacity" /tr "C:\Microsoft Host.exe" /RL HIGHEST & exitC:\Windows\System32\cmd.exe—Duglass Minecraft.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
660SchTaSKs /create /f /sc minute /mo -1 /tn "Audacity" /tr "C:\Microsoft Host.exe" /RL HIGHEST C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
732"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Audacity" /tr "C:\Microsoft Host.exe" /RL HIGHEST & exitC:\Windows\System32\cmd.exe—Duglass Minecraft.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
776"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1008SchTaSKs /create /f /sc minute /mo -1 /tn "Audacity" /tr "C:\Microsoft Host.exe" /RL HIGHEST C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
37 050
Read events
36 872
Write events
168
Delete events
10

Modification events

(PID) Process:(2432) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2432) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2432) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2432) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2432) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(4452) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
01000000000000003D6D1E70D69CDB01
(PID) Process:(5384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\Duglass cheat + CFG.rar
Executable files
17
Suspicious files
562
Text files
286
Unknown types
1

Dropped files

PID
Process
Filename
Type
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10c323.TMP —
MD5:—
SHA256:—
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10c323.TMP —
MD5:—
SHA256:—
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10c323.TMP —
MD5:—
SHA256:—
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10c323.TMP —
MD5:—
SHA256:—
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10c323.TMP —
MD5:—
SHA256:—
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
2432chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
204
DNS requests
152
Threats
39

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7740
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1272
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1272
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1072
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
1072
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
1072
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
1072
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2432
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
7348
chrome.exe
87.250.250.50:443
disk.yandex.ru
YANDEX LLC
RU
whitelisted
7348
chrome.exe
64.233.184.84:443
accounts.google.com
GOOGLE
US
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7348
chrome.exe
178.154.131.217:443
yastatic.net
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
disk.yandex.ru
  • 87.250.250.50
whitelisted
accounts.google.com
  • 64.233.184.84
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
yastatic.net
  • 178.154.131.217
  • 178.154.131.215
whitelisted
mc.yandex.ru
  • 87.250.251.119
  • 77.88.21.119
  • 87.250.250.119
whitelisted
docviewer.yandex.ru
  • 77.88.21.148
whitelisted
dr.yandex.net
  • 93.158.134.242
whitelisted

Threats

PID
Process
Class
Message
8084
Duglass Minecraft.exe
A Network Trojan was detected
ET MALWARE Sheet RAT CnC Checkin
8084
Duglass Minecraft.exe
Attempted Information Leak
ET INFO IP Check Domain (icanhazip. com in HTTP Host)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com)
8084
Duglass Minecraft.exe
Attempted Information Leak
ET INFO IP Check Domain (icanhazip. com in HTTP Host)
8084
Duglass Minecraft.exe
A Network Trojan was detected
ET MALWARE Sheet RAT CnC Checkin
8084
Duglass Minecraft.exe
Potential Corporate Privacy Violation
ET GAMES MINECRAFT Server response inbound
8084
Duglass Minecraft.exe
Potential Corporate Privacy Violation
ET GAMES MINECRAFT Server response inbound
8084
Duglass Minecraft.exe
Potential Corporate Privacy Violation
ET GAMES MINECRAFT Server response inbound
8084
Duglass Minecraft.exe
A Network Trojan was detected
ET MALWARE Sheet RAT CnC Checkin
8084
Duglass Minecraft.exe
A Network Trojan was detected
ET MALWARE Sheet RAT CnC Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://disk.yandex.ru/d/S9C3SgeOr2UD7g