URL:

itopvpn.com

Full analysis: https://app.any.run/tasks/b28015df-7207-4183-a628-f21833989c44
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 29, 2025, 16:40:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
delphi
stealer
rust
Indicators:
MD5:

2C801779B8B93332E5ADF2DF7AC18214

SHA1:

891CD71B36F1F5F08395470D0D5BCA2B0921A25B

SHA256:

1AB638A763EC9949A3F1831300EDBB6804C925DE17ABE30113667684493D142A

SSDEEP:

3:QESn:QH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 4772)

    • Runs injected code in another process

      • icop64.exe (PID: 7268)
      • iEasyDesk.exe (PID: 4800)

    • Steals credentials from Web Browsers

      • iTopVPN.exe (PID: 4808)

    • Actions looks like stealing of personal data

      • iTopVPN.exe (PID: 4808)

    • Registers / Runs the DLL via REGSVR32.EXE

      • IEDSetup.tmp (PID: 2464)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iTopVPN_setup_Free.exe (PID: 7684)
      • iTopVPN_setup_Free.exe (PID: 7868)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.exe (PID: 8180)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • IEDSetup.tmp (PID: 2464)
      • IEDSetup.exe (PID: 4836)

    • Reads security settings of Internet Explorer

      • iTopVPN_setup_Free.tmp (PID: 7804)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • Setup.exe (PID: 4372)
      • iTopVPN.exe (PID: 4808)
      • iTopDownloader.exe (PID: 1212)
      • IEDSetup.tmp (PID: 2464)
      • iEasyDesk.exe (PID: 4800)
      • IEDManager.exe (PID: 728)

    • Process drops legitimate windows executable

      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • IEDSetup.tmp (PID: 2464)

    • Reads the Windows owner or organization settings

      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • IEDSetup.tmp (PID: 2464)

    • Checks for external IP

      • Setup.exe (PID: 4372)
      • svchost.exe (PID: 2200)
      • ugin.exe (PID: 7924)
      • unpr.exe (PID: 4832)

    • Uses TASKKILL.EXE to kill process

      • iTopVPN_setup_Free.tmp (PID: 7404)

    • Drops a system driver (possible attempt to evade defenses)

      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • IEDSetup.tmp (PID: 2464)

    • Process drops SQLite DLL files

      • iTopVPN_setup_Free.tmp (PID: 7404)
      • IEDSetup.tmp (PID: 2464)

    • Stops a currently running service

      • sc.exe (PID: 6344)
      • sc.exe (PID: 7668)
      • sc.exe (PID: 7096)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7316)
      • sc.exe (PID: 5780)
      • sc.exe (PID: 1324)
      • sc.exe (PID: 1200)
      • sc.exe (PID: 3864)
      • sc.exe (PID: 6172)
      • sc.exe (PID: 7840)

    • Application launched itself

      • ugin.exe (PID: 7208)

    • Starts CMD.EXE for commands execution

      • ugin.exe (PID: 7208)
      • iTopVPN.exe (PID: 4808)
      • IEDSetup.tmp (PID: 2464)

    • Connects to unusual port

      • iTopVPN.exe (PID: 4808)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 516)
      • cmd.exe (PID: 1352)

    • Searches for installed software

      • iTopVPN.exe (PID: 4808)
      • iTopDownloader.exe (PID: 1212)
      • IEDDW.exe (PID: 6520)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 7880)
      • cmd.exe (PID: 6812)
      • cmd.exe (PID: 2080)
      • cmd.exe (PID: 7764)

    • The process verifies whether the antivirus software is installed

      • iTopVPN.exe (PID: 4808)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 6016)

    • Creates a new Windows service

      • sc.exe (PID: 2368)

    • Executes as Windows Service

      • IEDService.exe (PID: 7980)

    • Creates or modifies Windows services

      • IEDService.exe (PID: 7980)

    • Reads the date of Windows installation

      • iEasyDesk.exe (PID: 4800)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 4500)
      • firefox.exe (PID: 2044)
      • firefox.exe (PID: 7212)
      • firefox.exe (PID: 7296)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 4500)
      • firefox.exe (PID: 7212)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 4500)
      • firefox.exe (PID: 7212)

    • Launching a file from the Downloads directory

      • firefox.exe (PID: 4500)

    • Checks supported languages

      • iTopVPN_setup_Free.exe (PID: 7684)
      • iTopVPN_setup_Free.tmp (PID: 7804)
      • iTopVPN_setup_Free.exe (PID: 7868)
      • Setup.exe (PID: 4372)
      • ugin.exe (PID: 7924)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • iTopVPN_setup_Free.exe (PID: 8180)
      • ugin.exe (PID: 1760)
      • ugin.exe (PID: 7724)
      • ugin.exe (PID: 7504)
      • ullc.exe (PID: 5252)
      • iTopVPN.exe (PID: 7200)
      • ugin.exe (PID: 7208)
      • icop64.exe (PID: 7268)
      • ugin.exe (PID: 2632)
      • unpr.exe (PID: 4832)
      • ugin.exe (PID: 3400)
      • ugin.exe (PID: 888)
      • iTopDownloader.exe (PID: 1212)
      • iTopVPN.exe (PID: 4808)
      • atud.exe (PID: 1160)
      • aud.exe (PID: 7936)
      • aud.exe (PID: 1164)
      • iTopVPNMini.exe (PID: 5244)
      • IEDSetup.tmp (PID: 2464)
      • IEDInit.exe (PID: 8100)
      • IEDSetup.exe (PID: 4836)
      • wstr.exe (PID: 7556)
      • aud.exe (PID: 1800)
      • LocalLang.exe (PID: 7084)
      • IEDInit.exe (PID: 188)
      • IEDManager.exe (PID: 6036)
      • UninstallInfo.exe (PID: 2072)
      • AutoUpdate.exe (PID: 7220)
      • IEDService.exe (PID: 7980)
      • IEDSearch.exe (PID: 1100)
      • iEasyDesk.exe (PID: 4800)
      • IEDDW.exe (PID: 6520)
      • IEDLoading.exe (PID: 2160)
      • IEDManager.exe (PID: 728)
      • aud.exe (PID: 7920)
      • ugin.exe (PID: 424)

    • Reads the computer name

      • iTopVPN_setup_Free.tmp (PID: 7804)
      • ugin.exe (PID: 7924)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • Setup.exe (PID: 4372)
      • ugin.exe (PID: 7724)
      • ugin.exe (PID: 7504)
      • ugin.exe (PID: 7208)
      • ugin.exe (PID: 1760)
      • iTopVPN.exe (PID: 7200)
      • ugin.exe (PID: 2632)
      • ugin.exe (PID: 888)
      • unpr.exe (PID: 4832)
      • ugin.exe (PID: 3400)
      • iTopDownloader.exe (PID: 1212)
      • iTopVPN.exe (PID: 4808)
      • aud.exe (PID: 7936)
      • aud.exe (PID: 1164)
      • atud.exe (PID: 1160)
      • iTopVPNMini.exe (PID: 5244)
      • IEDSetup.tmp (PID: 2464)
      • IEDInit.exe (PID: 8100)
      • wstr.exe (PID: 7556)
      • aud.exe (PID: 1800)
      • IEDInit.exe (PID: 188)
      • IEDManager.exe (PID: 6036)
      • AutoUpdate.exe (PID: 7220)
      • IEDService.exe (PID: 7980)
      • UninstallInfo.exe (PID: 2072)
      • iEasyDesk.exe (PID: 4800)
      • IEDSearch.exe (PID: 1100)
      • IEDLoading.exe (PID: 2160)
      • IEDManager.exe (PID: 728)
      • IEDDW.exe (PID: 6520)
      • ugin.exe (PID: 424)
      • aud.exe (PID: 7920)

    • Process checks computer location settings

      • iTopVPN_setup_Free.tmp (PID: 7804)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • Setup.exe (PID: 4372)
      • iTopVPN.exe (PID: 4808)
      • IEDSetup.tmp (PID: 2464)
      • iTopDownloader.exe (PID: 1212)
      • iEasyDesk.exe (PID: 4800)
      • IEDManager.exe (PID: 728)

    • Create files in a temporary directory

      • iTopVPN_setup_Free.exe (PID: 7684)
      • iTopVPN_setup_Free.exe (PID: 7868)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.exe (PID: 8180)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • Setup.exe (PID: 4372)
      • explorer.exe (PID: 4772)
      • IEDSetup.tmp (PID: 2464)
      • IEDSetup.exe (PID: 4836)
      • SecEdit.exe (PID: 3820)
      • SecEdit.exe (PID: 7252)
      • iTopVPN.exe (PID: 4808)
      • IEDManager.exe (PID: 6036)

    • The sample compiled with english language support

      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • IEDSetup.tmp (PID: 2464)

    • Creates files in the program directory

      • ugin.exe (PID: 7924)
      • Setup.exe (PID: 4372)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • iTopVPN.exe (PID: 7200)
      • ugin.exe (PID: 7208)
      • unpr.exe (PID: 4832)
      • ugin.exe (PID: 3400)
      • ugin.exe (PID: 2632)
      • iTopDownloader.exe (PID: 1212)
      • atud.exe (PID: 1160)
      • iTopVPN.exe (PID: 4808)
      • IEDSetup.tmp (PID: 2464)
      • LocalLang.exe (PID: 7084)
      • AutoUpdate.exe (PID: 7220)
      • UninstallInfo.exe (PID: 2072)
      • IEDManager.exe (PID: 6036)
      • IEDService.exe (PID: 7980)
      • IEDSearch.exe (PID: 1100)
      • iEasyDesk.exe (PID: 4800)

    • Creates files or folders in the user directory

      • ugin.exe (PID: 7924)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • iTopVPN.exe (PID: 7200)
      • explorer.exe (PID: 4772)
      • iTopVPN.exe (PID: 4808)
      • atud.exe (PID: 1160)
      • iTopVPNMini.exe (PID: 5244)
      • IEDInit.exe (PID: 8100)
      • IEDManager.exe (PID: 6036)
      • AutoUpdate.exe (PID: 7220)
      • iEasyDesk.exe (PID: 4800)
      • IEDSearch.exe (PID: 1100)
      • IEDDW.exe (PID: 6520)

    • Reads the machine GUID from the registry

      • ugin.exe (PID: 7924)
      • Setup.exe (PID: 4372)
      • ugin.exe (PID: 7208)
      • ugin.exe (PID: 2632)
      • unpr.exe (PID: 4832)
      • iTopDownloader.exe (PID: 1212)
      • iTopVPN.exe (PID: 4808)
      • aud.exe (PID: 7936)
      • atud.exe (PID: 1160)
      • aud.exe (PID: 1164)
      • iTopVPNMini.exe (PID: 5244)
      • IEDInit.exe (PID: 8100)
      • aud.exe (PID: 1800)
      • IEDManager.exe (PID: 6036)
      • AutoUpdate.exe (PID: 7220)
      • UninstallInfo.exe (PID: 2072)
      • iEasyDesk.exe (PID: 4800)
      • IEDManager.exe (PID: 728)
      • ugin.exe (PID: 424)

    • Compiled with Borland Delphi (YARA)

      • Setup.exe (PID: 4372)
      • slui.exe (PID: 952)
      • iTopDownloader.exe (PID: 1212)
      • iTopVPN.exe (PID: 4808)
      • IEDService.exe (PID: 7980)
      • wstr.exe (PID: 7556)
      • iEasyDesk.exe (PID: 4800)
      • IEDSearch.exe (PID: 1100)
      • iTopVPNMini.exe (PID: 5244)
      • IEDManager.exe (PID: 728)

    • Creates a software uninstall entry

      • iTopVPN_setup_Free.tmp (PID: 7404)
      • IEDSetup.tmp (PID: 2464)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4772)

    • Disables trace logs

      • netsh.exe (PID: 4680)
      • netsh.exe (PID: 7372)

    • Manual execution by a user

      • firefox.exe (PID: 7296)

    • Application based on Rust

      • iTopVPN.exe (PID: 4808)

    • Process checks whether UAC notifications are on

      • iTopVPN.exe (PID: 4808)

    • Checks proxy server information

      • slui.exe (PID: 952)

    • Reads the software policy settings

      • slui.exe (PID: 952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
289
Monitored processes
138
Malicious processes
11
Suspicious processes
3

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs itopvpn_setup_free.exe itopvpn_setup_free.tmp no specs itopvpn_setup_free.exe itopvpn_setup_free.tmp ugin.exe setup.exe itopvpn_setup_free.exe itopvpn_setup_free.tmp ugin.exe no specs taskkill.exe no specs conhost.exe no specs ugin.exe no specs ugin.exe no specs ullc.exe conhost.exe no specs itopvpn.exe ugin.exe cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs icop64.exe conhost.exe no specs ugin.exe ugin.exe no specs unpr.exe ugin.exe no specs slui.exe itopdownloader.exe itopvpn.exe atud.exe aud.exe aud.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs itopvpnmini.exe iedsetup.exe iedsetup.tmp cmd.exe no specs conhost.exe no specs sc.exe no specs iedinit.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs wstr.exe no specs aud.exe cmd.exe no specs conhost.exe no specs ping.exe no specs secedit.exe no specs conhost.exe no specs secedit.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs firefox.exe no specs conhost.exe no specs firefox.exe no specs sc.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs firefox.exe no specs locallang.exe conhost.exe no specs iedinit.exe regsvr32.exe no specs iedmanager.exe regsvr32.exe no specs uninstallinfo.exe autoupdate.exe cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs iedservice.exe ieasydesk.exe iedsearch.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs iedloading.exe iedmanager.exe ieddw.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs aud.exe no specs ipconfig.exe no specs ugin.exe svchost.exe explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\iTop Easy Desktop\IEDInit.exe" /SetupFile="C:\ProgramData\iTop VPN\Downloader\vpn6\IEDSetup.exe" /reinstall=0 /insur=itopf_in /OldVersion=C:\Program Files (x86)\iTop Easy Desktop\IEDInit.exe
IEDSetup.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop Easy Desktop Init
Exit code:
0
Version:
3.0.0.161
Modules
Images
c:\program files (x86)\itop easy desktop\iedinit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
304\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
316"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 39015 -prefMapHandle 5244 -prefMapSize 272997 -jsInitHandle 5248 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5196 -initialChannelId {ec4006bc-87f3-4d14-8740-72d2c81fbae2} -parentPid 7212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
424"C:\Program Files (x86)\iTop VPN\ugin.exe" /postbnstC:\Program Files (x86)\iTop VPN\ugin.exe
iTopVPN.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop VPN
Version:
6.0.0.6166
Modules
Images
c:\program files (x86)\itop vpn\ugin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
432"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3952 -prefsLen 39015 -prefMapHandle 2852 -prefMapSize 272997 -jsInitHandle 2860 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 2332 -initialChannelId {5e350c8d-89c7-4a97-9b45-928b24b744b4} -parentPid 7212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
516cmd.exe /c netsh interface ipv4 set interface "Connection" mtu=1500C:\Windows\SysWOW64\cmd.exe—iTopVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
728"C:\Program Files (x86)\iTop Easy Desktop\IEDManager.exe" /RefreshC:\Program Files (x86)\iTop Easy Desktop\IEDManager.exe
iEasyDesk.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
MEDIUM
Description:
iTop Easy Desktop
Version:
1.0.0.229
Modules
Images
c:\program files (x86)\itop easy desktop\iedmanager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
888"C:\Program Files (x86)\iTop VPN\ugin.exe" /setlan "English"C:\Program Files (x86)\iTop VPN\ugin.exe—iTopVPN_setup_Free.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop VPN
Exit code:
0
Version:
6.0.0.6166
Modules
Images
c:\program files (x86)\itop vpn\ugin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
952C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
66 353
Read events
66 083
Write events
216
Delete events
54

Modification events

(PID) Process:(4500) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated
Operation:writeName:308046B0AF4A39CB
Value:
29
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000901FE
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4500) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000602DC
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000006033C
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000901FE
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000006025A
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000006025A
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000007025A
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
Executable files
194
Suspicious files
618
Text files
2 275
Unknown types
0

Dropped files

PID
Process
Filename
Type
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\protections.sqlite-journalbinary
MD5:2F6C677B7187F86E16363FE83C62C710
SHA256:8010B1BBE04079F1AF0B2CBE557DF7A3BFFCF59BECDE8F9C507474FE6FC4983E
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.tmpbinary
MD5:B83B5E168B2FA2C3E4691069606540B3
SHA256:F426B7858ACE862FA123FAE606D4DE796B78AD6C153F70ED26696546EB9F4E85
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:AB5894C55115C85A21CA8C97ED190B8A
SHA256:70A3EEEA19EAE03CF87ED4474255BCD27B270AFC0B622FF169352029355FE7D5
4500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\activity-stream.contile.json.tmpbinary
MD5:5D3049DA8BFD06D11200BD7C5F94F6C3
SHA256:F6CD6BB94800E2DD56EDC30DD2E3AEAAEE88A2B52E7908DB4B22FDCCFC52C325
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:2FD670934FEF0C60E2119BD874AAF470
SHA256:771A7C83CA015BDBC6AB86A7BD9B1D54E40062E28942D311A9178A0FE6433CF2
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.binbinary
MD5:2A1167F93A6CBB3D145808E5AA2C3B00
SHA256:EA2F6A730444802552A60A33E3E983B6771C631AA4E490B8468DACC0030859F6
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\places.sqlite-walbinary
MD5:9380AFDDDBD5EC1B30D8AD42639825DD
SHA256:CA17A3E5B3361F606209FEE1815789DBE6F6ED64A9F8B54F89B2E3E8E8B67AF6
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\safebrowsing-updating\ads-track-digest256.sbstore —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
648
DNS requests
156
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4500
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
4500
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/s/wr3/k58
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
18.245.65.219:80
http://ocsp.r2m02.amazontrust.com/
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
18.245.65.219:80
http://ocsp.r2m02.amazontrust.com/
unknown
—
—
whitelisted
4500
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
18.245.65.219:80
http://ocsp.r2m03.amazontrust.com/
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4816
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4500
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
whitelisted
4500
firefox.exe
3.222.106.67:443
itopvpn.com
AMAZON-AES
US
malicious
4500
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
4500
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted
4500
firefox.exe
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
whitelisted
4500
firefox.exe
142.250.184.195:80
o.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
content-signature-2.cdn.mozilla.net
  • 34.160.144.191
whitelisted
content-signature-chains.prod.autograph.services.mozaws.net
  • 34.160.144.191
  • 2600:1901:0:92a9::
whitelisted
itopvpn.com
  • 3.222.106.67
  • 54.227.184.113
malicious
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted
spocs.getpocket.com
  • 34.36.137.203
whitelisted
mc.prod.ads.prod.webservices.mozgcp.net
  • 34.36.137.203
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2200
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
7924
ugin.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7924
ugin.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
2200
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
4372
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
4372
Setup.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
Setup.exe
time1
Setup.exe
doFinshedEvent_Freeware 0
Setup.exe
time3
Setup.exe
CheckLicense
Setup.exe
CheckUninstallVersion appver:3.0.1.92 Chk_reg_unver:HKEY_LOCAL_MACHINE;SOFTWARE\iTop Easy Desktop;Version
Setup.exe
CheckMalware
Setup.exe
ProductVersion: 6.5.0.6176
Setup.exe
chk_uiid
Setup.exe
Success
Setup.exe
CheckSameVerList
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
itopvpn.com