| File name: | proofcore.exe |
| Full analysis: | https://app.any.run/tasks/5cc74a19-03a1-40cc-936a-1ac6e6642d65 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | July 08, 2025, 00:56:03 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | C98FA551D2FF2461FCD0BE5F58E8C6F1 |
| SHA1: | 059478BA6B708D595693626E206E2A3331379B8B |
| SHA256: | 0278837BA5CA7AACB24FCDEF77D59D2BB8EB772E4D887F9D2ED907B2993525C8 |
| SSDEEP: | 98304:IY2rBeBmj92mg2g9DL1qZdwijE8NdM/fqOqqYqPQbT+0qISKIiS0RJfdw6BsPe2f:I6Rq5VWeD |
MALICIOUS
Connects to the CnC server
- proofcore.exe (PID: 2604)
SUSPICIOUS
Reads the date of Windows installation
- proofcore.exe (PID: 316)
Reads security settings of Internet Explorer
- proofcore.exe (PID: 316)
Application launched itself
- proofcore.exe (PID: 316)
Checks for external IP
- proofcore.exe (PID: 2604)
- svchost.exe (PID: 2200)
The process connected to a server suspected of theft
- proofcore.exe (PID: 2604)
Contacting a server suspected of hosting an CnC
- proofcore.exe (PID: 2604)
Executes as Windows Service
- WmiApSrv.exe (PID: 640)
The process checks if it is being run in the virtual environment
- proofcore.exe (PID: 2604)
INFO
Checks supported languages
- proofcore.exe (PID: 316)
- proofcore.exe (PID: 2604)
- identity_helper.exe (PID: 7216)
Process checks computer location settings
- proofcore.exe (PID: 316)
Disables trace logs
- proofcore.exe (PID: 2604)
Reads the machine GUID from the registry
- proofcore.exe (PID: 2604)
Reads the computer name
- proofcore.exe (PID: 316)
- proofcore.exe (PID: 2604)
- identity_helper.exe (PID: 7216)
Reads Environment values
- proofcore.exe (PID: 2604)
- identity_helper.exe (PID: 7216)
Checks proxy server information
- proofcore.exe (PID: 2604)
Manual execution by a user
- msedge.exe (PID: 3392)
Reads product name
- proofcore.exe (PID: 2604)
Reads CPU info
- proofcore.exe (PID: 2604)
Reads the time zone
- proofcore.exe (PID: 2604)
Reads the software policy settings
- proofcore.exe (PID: 2604)
Application launched itself
- msedge.exe (PID: 3392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win16/32 Executable Delphi generic (34.1) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (32.9) |
| .exe | | | DOS Executable Generic (32.9) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2021:11:25 15:08:35+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 48 |
| CodeSize: | 86528 |
| InitializedDataSize: | 3884544 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x0000 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 4.4.2.2 |
| ProductVersionNumber: | 4.4.2.2 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | Pseudomethodist |
| CompanyName: | Daggerproof Preconcern |
| FileDescription: | Jupiterbeard Emberizidae |
| FileVersion: | 4.4.2.2 |
| InternalName: | Remarriages |
| LegalCopyright: | Copyright (C) 2000-2021 Nonconsumable |
| LegalTrademarks: | Dimgleaming Ninthmentioned |
| OriginalFileName: | Thiobismuthite |
| ProductName: | Organelles Grecopersian |
| ProductVersion: | 4.4.2.2 |
| AssemblyVersion: | 4.4.2.2 |
| Title: | Zygotactic Windflowing |
Total processes
156
Monitored processes
18
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 316 | "C:\Users\admin\AppData\Local\Temp\proofcore.exe" | C:\Users\admin\AppData\Local\Temp\proofcore.exe | — | explorer.exe | |||||||||||
User: admin Company: Daggerproof Preconcern Integrity Level: MEDIUM Description: Jupiterbeard Emberizidae Exit code: 0 Version: 4.4.2.2 Modules
| |||||||||||||||
| 640 | C:\WINDOWS\system32\wbem\WmiApSrv.exe | C:\Windows\System32\wbem\WmiApSrv.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Performance Reverse Adapter Exit code: 0 Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1564 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3620,i,18386937563210821089,1622281194982545198,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 1688 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5532,i,18386937563210821089,1622281194982545198,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2072 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2236,i,18386937563210821089,1622281194982545198,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2604 | "C:\Users\admin\AppData\Local\Temp\proofcore.exe" | C:\Users\admin\AppData\Local\Temp\proofcore.exe | proofcore.exe | ||||||||||||
User: admin Company: Daggerproof Preconcern Integrity Level: HIGH Description: Jupiterbeard Emberizidae Exit code: 0 Version: 4.4.2.2 Modules
| |||||||||||||||
| 3392 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3460 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5688,i,18386937563210821089,1622281194982545198,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3648 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5500,i,18386937563210821089,1622281194982545198,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
Total events
7 972
Read events
7 933
Write events
39
Delete events
0
Modification events
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (2604) proofcore.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\proofcore_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
0
Suspicious files
275
Text files
104
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF17c61e.TMP | — | |
MD5:— | SHA256:— | |||
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF17c61e.TMP | — | |
MD5:— | SHA256:— | |||
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF17c65d.TMP | — | |
MD5:— | SHA256:— | |||
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF17c65d.TMP | — | |
MD5:— | SHA256:— | |||
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF17c65d.TMP | — | |
MD5:— | SHA256:— | |||
| 3392 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
55
DNS requests
49
Threats
16
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2604 | proofcore.exe | GET | 200 | 142.250.185.196:80 | http://www.google.com/ | unknown | — | — | malicious |
1268 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5444 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2604 | proofcore.exe | GET | 200 | 142.250.185.196:80 | http://www.google.com/ | unknown | — | — | whitelisted |
3876 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
3876 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
2072 | msedge.exe | GET | 200 | 150.171.27.11:80 | http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:ddrQeqI4QoU44lpiOuNSKsB-2GX_rKlEuoZaGVT6B-E&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5944 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6756 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2604 | proofcore.exe | 142.250.185.196:80 | www.google.com | GOOGLE | US | malicious |
1268 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
www.google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2604 | proofcore.exe | A Network Trojan was detected | ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check |
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
2604 | proofcore.exe | A Network Trojan was detected | ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check |
2604 | proofcore.exe | Device Retrieving External IP Address Detected | ET INFO Observed External IP Lookup Domain (icanhazip .com in TLS SNI) |
2200 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (icanhazip .com) |
2200 | svchost.exe | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
2604 | proofcore.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
2604 | proofcore.exe | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |
2604 | proofcore.exe | Misc activity | ET INFO Observed Discord Service Domain (discord .com) in TLS SNI |
2200 | svchost.exe | Misc activity | ET INFO Discord Chat Service Domain in DNS Lookup (discord .com) |