File name:

pure_cryptor_for_Bild.exe

Full analysis: https://app.any.run/tasks/e5dbfdc3-86b6-4cab-83a6-27082c4d9ae4
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 17:35:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
telegram
evasion
stealer
ims-api
generic
rustystealer
upx
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 3 sections
MD5:

849EB7B18D410813F0AA9A2C421147B2

SHA1:

9682FFD7E48876F6920DED3D08DE38C161C6A452

SHA256:

0E71730B97C33AE14F83446E7B2F3BB761FB975AFFABE1DC2DD6E3C26A1BB4CA

SSDEEP:

49152:C+8LQeXj6CpIGHUhEVrkq3vpeQKYB+H32S7EWpTwvzVWcCoJ3Jm+JUOGfsn8Ut3j:PkQeT6oIaUTqxekB+X2S7MvzsjoBJm+t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • RUSTYSTEALER has been detected (YARA)

      • pure_cryptor_for_Bild.exe (PID: 7176)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • The process hides Powershell's copyright startup banner

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • The process hide an interactive prompt from the user

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • The process bypasses the loading of PowerShell profile settings

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • Checks for external IP

      • svchost.exe (PID: 2196)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • There is functionality for taking screenshot (YARA)

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • pure_cryptor_for_Bild.exe (PID: 7176)

  • INFO

    • Checks proxy server information

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • The sample compiled with english language support

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • Create files in a temporary directory

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • Checks supported languages

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2196)
      • pure_cryptor_for_Bild.exe (PID: 7176)

    • Reads the software policy settings

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • Reads the computer name

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • Creates files or folders in the user directory

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • Application based on Rust

      • pure_cryptor_for_Bild.exe (PID: 7176)

    • UPX packer has been detected

      • pure_cryptor_for_Bild.exe (PID: 7176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(7176) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 83.136.82.90 Country: Germany City: Düsseldorf Postal: 40213 ISP: WIIT AG - A24961 Timezone: 02:00 - PC Info - OS: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz GPU: - Microsoft Basic Display Adapter (1280, 720) HWID: Unknown Current Language: Englis...
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 83.136.82.90 Country: Germany City: D
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 83.136.82.90 Country: Germany City: Düsseldorf Postal: 40213 ISP: WIIT AG - A24961 Timezone: 02:00 - PC Info - OS: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz GPU: - Microsoft Basic Display Adapter (1280, 720) HWID: Unknown Current Language: Englis...
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 83.136.82.90 Country: Germany City: D
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true

RustyStealer

(PID) Process(7176) pure_cryptor_for_Bild.exe
URLhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
No Malware configuration.

TRiD

.exe | Clipper DOS Executable (33.3)
.exe | Generic Win/DOS Executable (33)
.exe | DOS Executable Generic (33)
.vxd | VXD Driver (0.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:15 10:18:01+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 1572864
InitializedDataSize: 4096
UninitializedDataSize: 1708032
EntryPoint: 0x320fc0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.13.741.4882
ProductVersionNumber: 4.13.741.4882
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Accessible Tool Inc.
FileDescription: Application for Deliver Specification
FileVersion: 5.01.488.4000
ProductName: MakeList
LegalCopyright: © 2025 Accessible Tool Inc.
InternalName: Trans
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #RUSTYSTEALER pure_cryptor_for_bild.exe svchost.exe powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7176"C:\Users\admin\AppData\Local\Temp\pure_cryptor_for_Bild.exe" C:\Users\admin\AppData\Local\Temp\pure_cryptor_for_Bild.exe
explorer.exe
User:
admin
Company:
Accessible Tool Inc.
Integrity Level:
MEDIUM
Description:
Application for Deliver Specification
Exit code:
0
Version:
5.01.488.4000
Modules
Images
c:\users\admin\appdata\local\temp\pure_cryptor_for_bild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
ims-api
(PID) Process(7176) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 83.136.82.90 Country: Germany City: Düsseldorf Postal: 40213 ISP: WIIT AG - A24961 Timezone: 02:00 - PC Info - OS: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz GPU: - Microsoft Basic Display Adapter (1280, 720) HWID: Unknown Current Language: Englis...
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 83.136.82.90 Country: Germany City: D
(PID) Process(7176) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
(PID) Process(7176) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 83.136.82.90 Country: Germany City: Düsseldorf Postal: 40213 ISP: WIIT AG - A24961 Timezone: 02:00 - PC Info - OS: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz GPU: - Microsoft Basic Display Adapter (1280, 720) HWID: Unknown Current Language: Englis...
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 83.136.82.90 Country: Germany City: D
(PID) Process(7176) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
RustyStealer
(PID) Process(7176) pure_cryptor_for_Bild.exe
URLhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
7308"powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pure_cryptor_for_Bild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7464C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7496"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 923
Read events
4 923
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
86
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7176pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\7tOGhRnUKZ9SVouyP4KpE8HJ5GcOsW\cookies_microsoft_default.txttext
MD5:B5A9D2CC171B0CC7D9529973A1CE735D
SHA256:A42BC2451AEF123E7B5E0E25E2E48F8C72F1B9CF31F89A3593AA01F9054B2E03
7176pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\chromium_network_cookiesbinary
MD5:46D9FCA6032297F8AEE08D73418312BA
SHA256:865856FA4C33C4AEE52E15FBB370B6611468FE947E76E197F0E50D0AD62CB1B4
7176pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\opera stable_default_login_databinary
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
7308powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_loufftfi.mul.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7176pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\opera stable_default_webdatabinary
MD5:95FFD778940E6DF4846B0B12C8DD5821
SHA256:21A2DEBD389DB456465DFEFFDB15F0AF3FBC46F007CBA67513A13EB10D14E94F
7176pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\chromium_default_webdatabinary
MD5:95FFD778940E6DF4846B0B12C8DD5821
SHA256:21A2DEBD389DB456465DFEFFDB15F0AF3FBC46F007CBA67513A13EB10D14E94F
7176pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\vivaldi_network_cookiesbinary
MD5:46D9FCA6032297F8AEE08D73418312BA
SHA256:865856FA4C33C4AEE52E15FBB370B6611468FE947E76E197F0E50D0AD62CB1B4
7176pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\vivaldi_default_webdatabinary
MD5:95FFD778940E6DF4846B0B12C8DD5821
SHA256:21A2DEBD389DB456465DFEFFDB15F0AF3FBC46F007CBA67513A13EB10D14E94F
7176pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\opera stable_network_cookiesbinary
MD5:46D9FCA6032297F8AEE08D73418312BA
SHA256:865856FA4C33C4AEE52E15FBB370B6611468FE947E76E197F0E50D0AD62CB1B4
7176pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\vivaldi_default_login_databinary
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
25
DNS requests
18
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5024
RUXIMICS.exe
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5024
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
—
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
unknown
—
—
whitelisted
8152
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8152
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5024
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5024
RUXIMICS.exe
23.48.23.168:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.168:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5024
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
7176
pure_cryptor_for_Bild.exe
195.201.57.90:443
ipwho.is
Hetzner Online GmbH
DE
malicious
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.168
  • 23.48.23.183
  • 23.48.23.188
  • 23.48.23.181
  • 23.48.23.166
  • 23.48.23.174
  • 23.48.23.177
  • 23.48.23.173
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
ipwho.is
  • 195.201.57.90
malicious
client.wns.windows.com
  • 172.211.123.248
whitelisted
api.telegram.org
  • 149.154.167.220
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.71
  • 40.126.31.131
  • 20.190.159.128
  • 20.190.159.64
  • 20.190.159.4
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl3.digicert.com
  • 2.17.190.73
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
7176
pure_cryptor_for_Bild.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
7176
pure_cryptor_for_Bild.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pure_cryptor_for_Bild.exe