File name:

SirHurt V5.rar

Full analysis: https://app.any.run/tasks/70a6c58d-b6d2-46a3-9cfd-e75e4e889802
Verdict: Malicious activity
Analysis date: January 30, 2025, 01:06:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
opendir
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5E5C8624B24808787BF0CDA399AFC608

SHA1:

C73C48D40C7BD2349CE72B3A99C6D697DD2078E7

SHA256:

59D4C0C86AB83476AAAFFAB20C1CC684394BE3B09424885A65B33DFF57346A30

SSDEEP:

98304:XVAFfjiC3NwIlu6SJyRLNdafiW86KgB0VfDqfJgL1M6lVrj0PvLGlftjiP9xykFF:3KuoIS69mLpAtqB+0EutGYcwBkT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4724)

  • SUSPICIOUS

    • Reads the BIOS version

      • sirhurt.exe (PID: 1580)
      • sirhurt.exe (PID: 2940)
      • sirhurt.exe (PID: 4308)

    • Executable content was dropped or overwritten

      • sirhurt.exe (PID: 1580)

    • Process drops legitimate windows executable

      • sirhurt.exe (PID: 1580)

    • Starts CMD.EXE for commands execution

      • sirhurt.exe (PID: 1580)
      • sirhurt.exe (PID: 4308)
      • sirhurt.exe (PID: 2940)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2940)
      • sirhurt.exe (PID: 1580)
      • cmd.exe (PID: 2512)
      • sirhurt.exe (PID: 2940)
      • cmd.exe (PID: 6196)

    • Adds/modifies Windows certificates

      • regedit.exe (PID: 556)
      • regedit.exe (PID: 6304)

    • Changes settings of the software policy

      • regedit.exe (PID: 556)
      • regedit.exe (PID: 6304)

    • Executing commands from a ".bat" file

      • sirhurt.exe (PID: 2940)
      • sirhurt.exe (PID: 4308)
      • sirhurt.exe (PID: 1580)

    • Hides command output

      • cmd.exe (PID: 2512)
      • cmd.exe (PID: 6196)
      • cmd.exe (PID: 2940)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 3664)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4724)

    • Process checks whether UAC notifications are on

      • sirhurt.exe (PID: 1580)
      • sirhurt.exe (PID: 4308)
      • sirhurt.exe (PID: 2940)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 4724)
      • sirhurt.exe (PID: 1580)

    • Checks supported languages

      • mode.com (PID: 3988)
      • sirhurt.exe (PID: 1580)
      • sirhurt.exe (PID: 2940)
      • sirhurt.exe (PID: 4308)
      • mode.com (PID: 6148)
      • mode.com (PID: 6248)
      • Certmgr.exe (PID: 6648)
      • ShellExperienceHost.exe (PID: 3664)

    • Manual execution by a user

      • sirhurt.exe (PID: 5300)
      • sirhurt.exe (PID: 1580)
      • sirhurt.exe (PID: 3260)
      • sirhurt.exe (PID: 2940)
      • sirhurt.exe (PID: 2572)
      • sirhurt.exe (PID: 4308)
      • firefox.exe (PID: 6876)
      • notepad.exe (PID: 6772)
      • rundll32.exe (PID: 6592)
      • Certmgr.exe (PID: 6648)

    • Reads the computer name

      • sirhurt.exe (PID: 1580)
      • sirhurt.exe (PID: 2940)
      • sirhurt.exe (PID: 4308)
      • Certmgr.exe (PID: 6648)
      • ShellExperienceHost.exe (PID: 3664)

    • Create files in a temporary directory

      • sirhurt.exe (PID: 1580)

    • Creates files in the program directory

      • sirhurt.exe (PID: 1580)
      • dllhost.exe (PID: 5560)

    • Reads the machine GUID from the registry

      • sirhurt.exe (PID: 1580)
      • sirhurt.exe (PID: 4308)
      • sirhurt.exe (PID: 2940)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 3988)
      • mode.com (PID: 6148)
      • mode.com (PID: 6248)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 6592)
      • notepad.exe (PID: 6772)
      • dllhost.exe (PID: 5560)
      • dllhost.exe (PID: 5828)

    • Reads the software policy settings

      • rundll32.exe (PID: 6592)

    • Application launched itself

      • firefox.exe (PID: 6896)
      • firefox.exe (PID: 6876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 1515037
UncompressedSize: 4970120
OperatingSystem: Win32
ArchivedFileName: sirhurt.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
44
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs sirhurt.exe no specs sirhurt.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs mode.com no specs regedit.exe regedit.exe no specs sirhurt.exe no specs sirhurt.exe conhost.exe no specs sirhurt.exe no specs sirhurt.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs mode.com no specs regedit.exe cmd.exe no specs conhost.exe no specs mode.com no specs regedit.exe regedit.exe no specs rundll32.exe no specs certmgr.exe no specs conhost.exe no specs notepad.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs Copy/Move/Rename/Delete/Link Object no specs Copy/Move/Rename/Delete/Link Object no specs shellexperiencehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sirhurt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
556regedit.exe /s "C:\Program Files (x86)\rsTrust\Scripts\CA-INSTALL.reg"C:\Windows\regedit.exe—sirhurt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1580"C:\Users\admin\Desktop\SirHurt V5\sirhurt.exe" C:\Users\admin\Desktop\SirHurt V5\sirhurt.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\sirhurt v5\sirhurt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sirhurt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2512cmd.exe /C "C:\Program Files (x86)\rsTrust\Scripts\CA-INSTALL.bat" >nul 2>&1C:\Windows\System32\cmd.exe—sirhurt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
2572"C:\Users\admin\Desktop\SirHurt V5\sirhurt.exe" C:\Users\admin\Desktop\SirHurt V5\sirhurt.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\sirhurt v5\sirhurt.exe
c:\windows\system32\ntdll.dll
2940cmd.exe /C "C:\Program Files (x86)\rsTrust\Scripts\CA-INSTALL.bat" >nul 2>&1C:\Windows\System32\cmd.exe—sirhurt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
2940"C:\Users\admin\Desktop\SirHurt V5\sirhurt.exe" C:\Users\admin\Desktop\SirHurt V5\sirhurt.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\sirhurt v5\sirhurt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2976"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4864 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 4944 -prefMapHandle 4860 -prefsLen 36588 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c27ccda4-64b4-4819-b1a3-d7d184ddac8c} 6896 "\\.\pipe\gecko-crash-server-pipe.6896" 2b39636b510 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
3260"C:\Users\admin\Desktop\SirHurt V5\sirhurt.exe" C:\Users\admin\Desktop\SirHurt V5\sirhurt.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\sirhurt v5\sirhurt.exe
c:\windows\system32\ntdll.dll
Total events
22 415
Read events
22 363
Write events
39
Delete events
13

Modification events

(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\SirHurt V5.rar
(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(4724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
9
Suspicious files
211
Text files
74
Unknown types
0

Dropped files

PID
Process
Filename
Type
4724WinRAR.exeC:\Users\admin\Desktop\SirHurt V5\bootstrapper.exeexecutable
MD5:36080AE944ECC9AC301C128E8CB696A4
SHA256:F8C112998BAE986FDF5DD33CB8FB819F963B50C0F5A3F406F5333B242124793A
4724WinRAR.exeC:\Users\admin\Desktop\SirHurt V5\sirhurt.exeexecutable
MD5:FD2EFF183BF443715AED9E08F67B367A
SHA256:397E1422413B38E64BAD8E150A57C923FD49F37B1F6F5A3E4BB1878DCD5F35E2
1580sirhurt.exeC:\Program Files (x86)\rsTrust\Scripts\2-Pikachu_Time_Sub_CA-G2.crltext
MD5:AEE260B1675E4E2C28EAA9D5BA8DAA53
SHA256:7373E065047C75F671FA75BAC5A65E78FAD71ECB59FF2CC7E1DE89D4C7207884
1580sirhurt.exeC:\Program Files (x86)\rsTrust\Scripts\0-Pikachu_Test_CA_RSA-G1.crltext
MD5:51F968C58DCD358393EA98DE5B0D340E
SHA256:1C83C4B49A985BA87BA0CD1BD0D65DB972F1F3FF5C4772744C16A093F7824EC5
4724WinRAR.exeC:\Users\admin\Desktop\SirHurt V5\SirHurt V5.exeexecutable
MD5:6A06AF324DAF89CE137F3959A4C4DA20
SHA256:BA9B5EE8F7DFDEF785D87A9884BED1AB10AEE870E415ED9263454143A227C557
1580sirhurt.exeC:\Program Files (x86)\rsTrust\Scripts\0-Pikachu_Test_CA_RSA-G2.crltext
MD5:D4A7EAE5025AB073E5E535B4A8BCAA2E
SHA256:36B8078C525B816A47A9F711AF22505C958DCD81786D93E67B5DB2CFD2F7C4A2
1580sirhurt.exeC:\Program Files (x86)\rsTrust\Scripts\2-Pikachu_Time_Sub_CA-G1.crltext
MD5:11193587D6C853AFD46DEE6835A55A6D
SHA256:7A5FEE4FA2CD2164250808DFB7B50CD8D8DAD491051C944CD4B6D0902F59BB02
4724WinRAR.exeC:\Users\admin\Desktop\SirHurt V5\READ ME Instructions.txttext
MD5:D5FB38B419BB1341F8E27C5DB9DC652E
SHA256:9A300887108503979322A703BE4A040AF1B17865CFFF2563A9C3A5707BFCD47D
4724WinRAR.exeC:\Users\admin\Desktop\SirHurt V5\zlib.dllexecutable
MD5:3E92F13E42188AE8C51861DF292B53AD
SHA256:4CE30751722EC8078DF18EAB0DDBA2A7EC6D7404BC86586D7996C2B254870186
4724WinRAR.exeC:\Users\admin\Desktop\SirHurt V5\VMProtectSDK64.dllexecutable
MD5:8952450F3D98016016682A6B0B716518
SHA256:A56239B26392A8EC49A47D27B0632B65A3F98A2735BF60DCE66139A71FF804FC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
107
DNS requests
135
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3416
svchost.exe
GET
200
95.101.78.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.78.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3416
svchost.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6364
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6364
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4704
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6896
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
95.101.78.42:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
3416
svchost.exe
95.101.78.42:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.209.214.100:80
www.microsoft.com
PT. Telekomunikasi Selular
ID
whitelisted
3416
svchost.exe
23.209.214.100:80
www.microsoft.com
PT. Telekomunikasi Selular
ID
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.21.65.132:443
www.bing.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 95.101.78.42
  • 95.101.78.32
whitelisted
google.com
  • 142.250.185.78
whitelisted
www.microsoft.com
  • 23.209.214.100
  • 2.23.246.101
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.21.65.132
  • 2.21.65.154
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.131
  • 40.126.31.67
  • 40.126.31.130
  • 20.190.159.130
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.68
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
www.sirhurt.net
  • 104.21.95.242
  • 172.67.149.166
unknown
sirhurt.net
  • 172.67.149.166
  • 104.21.95.242
unknown

Threats

No threats detected
Process
Message
regedit.exe
REGEDIT: CreateFile failed, GetLastError() = 2
regedit.exe
REGEDIT: CreateFile failed, GetLastError() = 2
regedit.exe
REGEDIT: CreateFile failed, GetLastError() = 2
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SirHurt V5.rar