File name:

0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe

Full analysis: https://app.any.run/tasks/699e4b81-1ab3-41b9-a5b3-7e63d48e97b2
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 00:01:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
guloader
snake
keylogger
evasion
stealer
telegram
autorun-download
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

D0074EDAB5CEE4B432BF2E9F075E6301

SHA1:

71A829B476596AD54566C823499B1BFDFA86AE3E

SHA256:

0FF51F1BFCEF0CABF76AF8A2C9BB5C01AEF4940A97C9B5CEBE83CDDF62D5BE77

SSDEEP:

24576:9G3VZ4D6o/QBl6tmlUc/TqCWIgA1QLQjzt:E3VZ4D6o/QBl6tmlUc/TqCWIgA1QLQjx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GULOADER has been found (auto)

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6044)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Steals credentials from Web Browsers

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Actions looks like stealing of personal data

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • HTTPDebuggerSvc.exe (PID: 4880)
      • certutil.exe (PID: 8444)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6044)
      • msiexec.exe (PID: 8764)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6300)

    • Reads security settings of Internet Explorer

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • msiexec.exe (PID: 8808)
      • HTTPDebuggerUI.exe (PID: 9124)
      • ShellExperienceHost.exe (PID: 8244)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Executable content was dropped or overwritten

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6044)
      • HTTPDebuggerSvc.exe (PID: 4880)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6300)

    • Application launched itself

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6044)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6300)

    • Checks for external IP

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • svchost.exe (PID: 2196)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • There is functionality for taking screenshot (YARA)

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • The process verifies whether the antivirus software is installed

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Detects AdvancedInstaller (YARA)

      • msiexec.exe (PID: 8716)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 8764)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 8764)
      • HTTPDebuggerSvc.exe (PID: 4880)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 8676)

    • Executes as Windows Service

      • VSSVC.exe (PID: 8928)
      • HTTPDebuggerSvc.exe (PID: 4880)

    • Creates files in the driver directory

      • HTTPDebuggerSvc.exe (PID: 4880)

    • Reads Microsoft Outlook installation path

      • HTTPDebuggerUI.exe (PID: 9124)

    • Reads Internet Explorer settings

      • HTTPDebuggerUI.exe (PID: 9124)

    • Adds/modifies Windows certificates

      • HTTPDebuggerSvc.exe (PID: 4880)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6044)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6300)

  • INFO

    • Creates files or folders in the user directory

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6044)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • BackgroundTransferHost.exe (PID: 2420)

    • Checks supported languages

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6044)
      • identity_helper.exe (PID: 7764)
      • msiexec.exe (PID: 8808)
      • msiexec.exe (PID: 8764)
      • msiexec.exe (PID: 7652)
      • HTTPDebuggerSvc.exe (PID: 4880)
      • HTTPDebuggerUI.exe (PID: 9124)
      • HTTPDebuggerSvc.exe (PID: 924)
      • ShellExperienceHost.exe (PID: 8244)
      • certutil.exe (PID: 8444)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6300)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Create files in a temporary directory

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6044)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6300)

    • Reads the computer name

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6044)
      • identity_helper.exe (PID: 7764)
      • msiexec.exe (PID: 8764)
      • msiexec.exe (PID: 8808)
      • msiexec.exe (PID: 7652)
      • HTTPDebuggerSvc.exe (PID: 924)
      • HTTPDebuggerSvc.exe (PID: 4880)
      • ShellExperienceHost.exe (PID: 8244)
      • HTTPDebuggerUI.exe (PID: 9124)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6300)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • certutil.exe (PID: 8444)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Reads the software policy settings

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • BackgroundTransferHost.exe (PID: 2420)
      • msiexec.exe (PID: 8716)
      • msiexec.exe (PID: 8764)
      • HTTPDebuggerUI.exe (PID: 9124)
      • slui.exe (PID: 4812)
      • slui.exe (PID: 9112)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 2420)
      • BackgroundTransferHost.exe (PID: 1272)
      • BackgroundTransferHost.exe (PID: 3100)
      • BackgroundTransferHost.exe (PID: 7508)
      • BackgroundTransferHost.exe (PID: 8096)
      • msiexec.exe (PID: 8716)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 2420)
      • HTTPDebuggerUI.exe (PID: 9124)
      • slui.exe (PID: 9112)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Disables trace logs

      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Manual execution by a user

      • msedge.exe (PID: 6132)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 6300)

    • Application launched itself

      • msedge.exe (PID: 6132)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6132)

    • Reads Environment values

      • identity_helper.exe (PID: 7764)

    • Autorun file from Downloads

      • msedge.exe (PID: 8600)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 8716)
      • msiexec.exe (PID: 8764)

    • The sample compiled with english language support

      • msiexec.exe (PID: 8716)
      • msiexec.exe (PID: 8764)
      • HTTPDebuggerSvc.exe (PID: 4880)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 8764)
      • HTTPDebuggerSvc.exe (PID: 4880)
      • HTTPDebuggerSvc.exe (PID: 924)
      • HTTPDebuggerUI.exe (PID: 9124)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 2980)
      • 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe (PID: 4040)

    • Manages system restore points

      • SrTasks.exe (PID: 8628)

    • Creates files in the program directory

      • HTTPDebuggerSvc.exe (PID: 4880)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 8764)

    • Process checks computer location settings

      • msiexec.exe (PID: 8808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:12:27 06:26:07+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25600
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x32a0
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
227
Monitored processes
84
Malicious processes
8
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe sppextcomobj.exe no specs slui.exe #SNAKEKEYLOGGER 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs backgroundtransferhost.exe no specs msedge.exe no specs msedge.exe no specs backgroundtransferhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs httpdebuggersvc.exe httpdebuggersvc.exe no specs httpdebuggerui.exe slui.exe shellexperiencehost.exe no specs certutil.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe msedge.exe no specs #SNAKEKEYLOGGER 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
924"C:\Program Files (x86)\HTTPDebuggerPro\HTTPDebuggerSvc.exe" /installC:\Program Files (x86)\HTTPDebuggerPro\HTTPDebuggerSvc.exe—msiexec.exe
User:
admin
Company:
HttpDebugger.com
Integrity Level:
MEDIUM
Description:
HTTP Debugger Windows Service
Exit code:
0
Version:
9.0.0.12
Modules
Images
c:\program files (x86)\httpdebuggerpro\httpdebuggersvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
1272"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2420"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2420"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2580 --field-trial-handle=2556,i,4864323995299725705,17095505902595797698,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2980"C:\Users\admin\AppData\Local\Temp\0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe" C:\Users\admin\AppData\Local\Temp\0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3100"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
3268"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x300,0x304,0x308,0x2f8,0x310,0x7ffc89905fd8,0x7ffc89905fe4,0x7ffc89905ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5708 --field-trial-handle=2556,i,4864323995299725705,17095505902595797698,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4040"C:\Users\admin\AppData\Local\Temp\0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe" C:\Users\admin\AppData\Local\Temp\0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
Total events
38 237
Read events
37 813
Write events
406
Delete events
18

Modification events

(PID) Process:(6044) 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5
(PID) Process:(6044) 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::SetFilePointer(i r5, i 13101 , i 0,i 0)
(PID) Process:(6044) 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::VirtualAlloc(i 0,i 48783360, i 0x3000, i 0x40)p.r2
(PID) Process:(6044) 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::ReadFile(i r5, i r2, i 48783360,*i 0, i 0)
(PID) Process:(6044) 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
user32::EnumWindows(i r2 ,i 0)
(PID) Process:(6044) 0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLI\Start
Operation:writeName:CLI start
Value:
2
(PID) Process:(1272) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1272) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1272) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2420) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
76
Suspicious files
797
Text files
110
Unknown types
1

Dropped files

PID
Process
Filename
Type
2420BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\7774ba60-4fab-4ddc-97e0-c01ef38be83f.down_data —
MD5:—
SHA256:—
60440ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Beclamor\Riprap43.gawbinary
MD5:39C9A5F767D8C170B5CE38EA8D5734D4
SHA256:87A7017021050071DBE5726BF9AC505763CD923E2BDE93336CA0905802CD8D49
60440ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnkbinary
MD5:BF9CC6B5857258FEA4B48BB766A90893
SHA256:94774DC897B368347052D00311D80A00D2620757C25A9B1BF426CFA4083B2109
60440ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Beclamor\fyldebtten.soibinary
MD5:AEF78D8D561E8802286A78AAC6C73ED6
SHA256:45F24543C01C9A11CC2246A9B27569AF433EEF61C877A4E191B683315D3566BE
29800ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:C9BE626E9715952E9B70F92F912B9787
SHA256:C13E8D22800C200915F87F71C31185053E4E60CA25DE2E41E160E09CD2D815D4
29800ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E62DD75009A293E0AF9565AE544F23E_6465F3778A77E94C1A0900A28FE8CBDEbinary
MD5:5A18FB8A82D60D7A0053C4EBE9A101B4
SHA256:36C6DA66510C0371D943B4D6E221BBD3B062F773EA6B4DB9A39E3CF0432DDF73
60440ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Beclamor\wildwestfilm.stobinary
MD5:BFEA15C03AB295424981A73637A19491
SHA256:83E9CE74259889DCABD39D41131F286882B224698DCDEB8D0B4074069AAA687B
60440ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeC:\Users\admin\AppData\Local\Temp\nspB52A.tmp\System.dllexecutable
MD5:EE260C45E97B62A5E42F17460D406068
SHA256:E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
60440ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Beclamor\forskansningens.txttext
MD5:AE69FE0F4D1E1115BC470031E661785C
SHA256:6B18768503395C809263568D3A8858810404C2B7D49DC7CB6CE5F717F5D6C7DE
60440ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Beclamor\antihemolytic.armbinary
MD5:F0886B66577ED608412D985493DF3928
SHA256:72AB5BB7924FDD333AF20EF25AA0F3AC5CEB0DBEBE70694CB1F8128FD57DA1A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
217
DNS requests
198
Threats
24

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6112
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
GET
200
142.250.74.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
GET
200
142.250.74.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
GET
200
142.250.186.99:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEG%2BorlfPZWf5CeqNw%2Flf3jE%3D
unknown
—
—
whitelisted
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
GET
200
142.250.186.99:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEEMozOhYl9J2Ctz332xAY9c%3D
unknown
—
—
whitelisted
2420
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6112
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6112
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.142
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.120
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.3
  • 20.190.160.65
  • 40.126.32.140
  • 20.190.160.66
  • 20.190.160.67
  • 40.126.32.138
  • 20.190.160.131
  • 20.190.160.5
  • 40.126.31.69
  • 20.190.159.73
  • 40.126.31.129
  • 20.190.159.75
  • 40.126.31.3
  • 20.190.159.64
  • 40.126.31.1
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
drive.google.com
  • 142.250.185.78
whitelisted
c.pki.goog
  • 142.250.74.195
whitelisted
o.pki.goog
  • 142.250.186.99
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
2980
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
2420
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2420
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
2420
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0ff51f1bfcef0cabf76af8a2c9bb5c01aef4940a97c9b5cebe83cddf62d5be77.exe