URL:

itopvpn.com

Full analysis: https://app.any.run/tasks/b28015df-7207-4183-a628-f21833989c44
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 29, 2025, 16:40:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
delphi
stealer
rust
Indicators:
MD5:

2C801779B8B93332E5ADF2DF7AC18214

SHA1:

891CD71B36F1F5F08395470D0D5BCA2B0921A25B

SHA256:

1AB638A763EC9949A3F1831300EDBB6804C925DE17ABE30113667684493D142A

SSDEEP:

3:QESn:QH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs injected code in another process

      • icop64.exe (PID: 7268)
      • iEasyDesk.exe (PID: 4800)

    • Application was injected by another process

      • explorer.exe (PID: 4772)

    • Steals credentials from Web Browsers

      • iTopVPN.exe (PID: 4808)

    • Actions looks like stealing of personal data

      • iTopVPN.exe (PID: 4808)

    • Registers / Runs the DLL via REGSVR32.EXE

      • IEDSetup.tmp (PID: 2464)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iTopVPN_setup_Free.exe (PID: 7684)
      • iTopVPN_setup_Free.exe (PID: 7868)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.exe (PID: 8180)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • IEDSetup.exe (PID: 4836)
      • IEDSetup.tmp (PID: 2464)

    • Reads security settings of Internet Explorer

      • iTopVPN_setup_Free.tmp (PID: 7804)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • Setup.exe (PID: 4372)
      • iTopVPN.exe (PID: 4808)
      • iTopDownloader.exe (PID: 1212)
      • IEDSetup.tmp (PID: 2464)
      • iEasyDesk.exe (PID: 4800)
      • IEDManager.exe (PID: 728)

    • Reads the Windows owner or organization settings

      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • IEDSetup.tmp (PID: 2464)

    • Process drops legitimate windows executable

      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • IEDSetup.tmp (PID: 2464)

    • Checks for external IP

      • svchost.exe (PID: 2200)
      • ugin.exe (PID: 7924)
      • Setup.exe (PID: 4372)
      • unpr.exe (PID: 4832)

    • Uses TASKKILL.EXE to kill process

      • iTopVPN_setup_Free.tmp (PID: 7404)

    • Process drops SQLite DLL files

      • iTopVPN_setup_Free.tmp (PID: 7404)
      • IEDSetup.tmp (PID: 2464)

    • Drops a system driver (possible attempt to evade defenses)

      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • IEDSetup.tmp (PID: 2464)

    • Starts CMD.EXE for commands execution

      • ugin.exe (PID: 7208)
      • iTopVPN.exe (PID: 4808)
      • IEDSetup.tmp (PID: 2464)

    • Stops a currently running service

      • sc.exe (PID: 6344)
      • sc.exe (PID: 7668)
      • sc.exe (PID: 7096)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7316)
      • sc.exe (PID: 5780)
      • sc.exe (PID: 1200)
      • sc.exe (PID: 3864)
      • sc.exe (PID: 1324)
      • sc.exe (PID: 6172)
      • sc.exe (PID: 7840)

    • Application launched itself

      • ugin.exe (PID: 7208)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 516)
      • cmd.exe (PID: 1352)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 7880)
      • cmd.exe (PID: 6812)
      • cmd.exe (PID: 2080)
      • cmd.exe (PID: 7764)

    • Searches for installed software

      • iTopVPN.exe (PID: 4808)
      • iTopDownloader.exe (PID: 1212)
      • IEDDW.exe (PID: 6520)

    • Connects to unusual port

      • iTopVPN.exe (PID: 4808)

    • The process verifies whether the antivirus software is installed

      • iTopVPN.exe (PID: 4808)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 6016)

    • Executes as Windows Service

      • IEDService.exe (PID: 7980)

    • Creates or modifies Windows services

      • IEDService.exe (PID: 7980)

    • Creates a new Windows service

      • sc.exe (PID: 2368)

    • Reads the date of Windows installation

      • iEasyDesk.exe (PID: 4800)

  • INFO

    • Launching a file from the Downloads directory

      • firefox.exe (PID: 4500)

    • Application launched itself

      • firefox.exe (PID: 2044)
      • firefox.exe (PID: 4500)
      • firefox.exe (PID: 7296)
      • firefox.exe (PID: 7212)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 4500)
      • firefox.exe (PID: 7212)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 4500)
      • firefox.exe (PID: 7212)

    • Checks supported languages

      • iTopVPN_setup_Free.tmp (PID: 7804)
      • iTopVPN_setup_Free.exe (PID: 7684)
      • iTopVPN_setup_Free.exe (PID: 7868)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • ugin.exe (PID: 7924)
      • Setup.exe (PID: 4372)
      • iTopVPN_setup_Free.exe (PID: 8180)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7724)
      • ugin.exe (PID: 7504)
      • ugin.exe (PID: 1760)
      • ugin.exe (PID: 7208)
      • ullc.exe (PID: 5252)
      • icop64.exe (PID: 7268)
      • ugin.exe (PID: 2632)
      • ugin.exe (PID: 888)
      • unpr.exe (PID: 4832)
      • ugin.exe (PID: 3400)
      • iTopDownloader.exe (PID: 1212)
      • iTopVPN.exe (PID: 4808)
      • atud.exe (PID: 1160)
      • aud.exe (PID: 7936)
      • aud.exe (PID: 1164)
      • iTopVPN.exe (PID: 7200)
      • iTopVPNMini.exe (PID: 5244)
      • IEDSetup.tmp (PID: 2464)
      • IEDInit.exe (PID: 8100)
      • wstr.exe (PID: 7556)
      • IEDSetup.exe (PID: 4836)
      • aud.exe (PID: 1800)
      • LocalLang.exe (PID: 7084)
      • IEDInit.exe (PID: 188)
      • IEDManager.exe (PID: 6036)
      • IEDService.exe (PID: 7980)
      • iEasyDesk.exe (PID: 4800)
      • IEDSearch.exe (PID: 1100)
      • UninstallInfo.exe (PID: 2072)
      • AutoUpdate.exe (PID: 7220)
      • IEDLoading.exe (PID: 2160)
      • IEDDW.exe (PID: 6520)
      • aud.exe (PID: 7920)
      • ugin.exe (PID: 424)
      • IEDManager.exe (PID: 728)

    • Create files in a temporary directory

      • iTopVPN_setup_Free.exe (PID: 7684)
      • iTopVPN_setup_Free.exe (PID: 7868)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • Setup.exe (PID: 4372)
      • iTopVPN_setup_Free.exe (PID: 8180)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • explorer.exe (PID: 4772)
      • IEDSetup.exe (PID: 4836)
      • IEDSetup.tmp (PID: 2464)
      • SecEdit.exe (PID: 3820)
      • SecEdit.exe (PID: 7252)
      • iTopVPN.exe (PID: 4808)
      • IEDManager.exe (PID: 6036)

    • Reads the computer name

      • iTopVPN_setup_Free.tmp (PID: 7804)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • ugin.exe (PID: 7924)
      • Setup.exe (PID: 4372)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7724)
      • ugin.exe (PID: 7504)
      • ugin.exe (PID: 1760)
      • ugin.exe (PID: 7208)
      • iTopVPN.exe (PID: 7200)
      • ugin.exe (PID: 2632)
      • ugin.exe (PID: 888)
      • unpr.exe (PID: 4832)
      • ugin.exe (PID: 3400)
      • iTopDownloader.exe (PID: 1212)
      • iTopVPN.exe (PID: 4808)
      • aud.exe (PID: 7936)
      • aud.exe (PID: 1164)
      • atud.exe (PID: 1160)
      • iTopVPNMini.exe (PID: 5244)
      • IEDSetup.tmp (PID: 2464)
      • IEDInit.exe (PID: 8100)
      • aud.exe (PID: 1800)
      • wstr.exe (PID: 7556)
      • IEDInit.exe (PID: 188)
      • IEDManager.exe (PID: 6036)
      • AutoUpdate.exe (PID: 7220)
      • IEDService.exe (PID: 7980)
      • UninstallInfo.exe (PID: 2072)
      • IEDLoading.exe (PID: 2160)
      • iEasyDesk.exe (PID: 4800)
      • IEDSearch.exe (PID: 1100)
      • IEDManager.exe (PID: 728)
      • IEDDW.exe (PID: 6520)
      • aud.exe (PID: 7920)
      • ugin.exe (PID: 424)

    • Process checks computer location settings

      • iTopVPN_setup_Free.tmp (PID: 7804)
      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • Setup.exe (PID: 4372)
      • iTopVPN.exe (PID: 4808)
      • iTopDownloader.exe (PID: 1212)
      • IEDSetup.tmp (PID: 2464)
      • iEasyDesk.exe (PID: 4800)
      • IEDManager.exe (PID: 728)

    • The sample compiled with english language support

      • iTopVPN_setup_Free.tmp (PID: 7876)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • ugin.exe (PID: 7208)
      • IEDSetup.tmp (PID: 2464)

    • Creates files in the program directory

      • ugin.exe (PID: 7924)
      • Setup.exe (PID: 4372)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • iTopVPN.exe (PID: 7200)
      • ugin.exe (PID: 7208)
      • unpr.exe (PID: 4832)
      • ugin.exe (PID: 2632)
      • ugin.exe (PID: 3400)
      • iTopDownloader.exe (PID: 1212)
      • atud.exe (PID: 1160)
      • iTopVPN.exe (PID: 4808)
      • IEDSetup.tmp (PID: 2464)
      • IEDManager.exe (PID: 6036)
      • LocalLang.exe (PID: 7084)
      • IEDService.exe (PID: 7980)
      • UninstallInfo.exe (PID: 2072)
      • AutoUpdate.exe (PID: 7220)
      • IEDSearch.exe (PID: 1100)
      • iEasyDesk.exe (PID: 4800)

    • Creates files or folders in the user directory

      • ugin.exe (PID: 7924)
      • iTopVPN_setup_Free.tmp (PID: 7404)
      • iTopVPN.exe (PID: 7200)
      • explorer.exe (PID: 4772)
      • iTopVPN.exe (PID: 4808)
      • atud.exe (PID: 1160)
      • iTopVPNMini.exe (PID: 5244)
      • IEDInit.exe (PID: 8100)
      • IEDManager.exe (PID: 6036)
      • AutoUpdate.exe (PID: 7220)
      • iEasyDesk.exe (PID: 4800)
      • IEDSearch.exe (PID: 1100)
      • IEDDW.exe (PID: 6520)

    • Reads the machine GUID from the registry

      • ugin.exe (PID: 7924)
      • Setup.exe (PID: 4372)
      • ugin.exe (PID: 7208)
      • ugin.exe (PID: 2632)
      • unpr.exe (PID: 4832)
      • iTopDownloader.exe (PID: 1212)
      • iTopVPN.exe (PID: 4808)
      • aud.exe (PID: 7936)
      • atud.exe (PID: 1160)
      • aud.exe (PID: 1164)
      • iTopVPNMini.exe (PID: 5244)
      • IEDInit.exe (PID: 8100)
      • aud.exe (PID: 1800)
      • IEDManager.exe (PID: 6036)
      • AutoUpdate.exe (PID: 7220)
      • UninstallInfo.exe (PID: 2072)
      • iEasyDesk.exe (PID: 4800)
      • IEDManager.exe (PID: 728)
      • ugin.exe (PID: 424)

    • Compiled with Borland Delphi (YARA)

      • Setup.exe (PID: 4372)
      • slui.exe (PID: 952)
      • iTopDownloader.exe (PID: 1212)
      • iTopVPN.exe (PID: 4808)
      • iTopVPNMini.exe (PID: 5244)
      • wstr.exe (PID: 7556)
      • IEDService.exe (PID: 7980)
      • iEasyDesk.exe (PID: 4800)
      • IEDSearch.exe (PID: 1100)
      • IEDManager.exe (PID: 728)

    • Creates a software uninstall entry

      • iTopVPN_setup_Free.tmp (PID: 7404)
      • IEDSetup.tmp (PID: 2464)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4772)

    • Disables trace logs

      • netsh.exe (PID: 4680)
      • netsh.exe (PID: 7372)

    • Manual execution by a user

      • firefox.exe (PID: 7296)

    • Process checks whether UAC notifications are on

      • iTopVPN.exe (PID: 4808)

    • Application based on Rust

      • iTopVPN.exe (PID: 4808)

    • Checks proxy server information

      • slui.exe (PID: 952)

    • Reads the software policy settings

      • slui.exe (PID: 952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
289
Monitored processes
138
Malicious processes
11
Suspicious processes
3

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs itopvpn_setup_free.exe itopvpn_setup_free.tmp no specs itopvpn_setup_free.exe itopvpn_setup_free.tmp ugin.exe setup.exe itopvpn_setup_free.exe itopvpn_setup_free.tmp ugin.exe no specs taskkill.exe no specs conhost.exe no specs ugin.exe no specs ugin.exe no specs ullc.exe conhost.exe no specs itopvpn.exe ugin.exe cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs icop64.exe conhost.exe no specs ugin.exe ugin.exe no specs unpr.exe ugin.exe no specs slui.exe itopdownloader.exe itopvpn.exe atud.exe aud.exe aud.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs itopvpnmini.exe iedsetup.exe iedsetup.tmp cmd.exe no specs conhost.exe no specs sc.exe no specs iedinit.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs wstr.exe no specs aud.exe cmd.exe no specs conhost.exe no specs ping.exe no specs secedit.exe no specs conhost.exe no specs secedit.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs firefox.exe no specs conhost.exe no specs firefox.exe no specs sc.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs firefox.exe no specs locallang.exe conhost.exe no specs iedinit.exe regsvr32.exe no specs iedmanager.exe regsvr32.exe no specs uninstallinfo.exe autoupdate.exe cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs iedservice.exe ieasydesk.exe iedsearch.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs iedloading.exe iedmanager.exe ieddw.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs aud.exe no specs ipconfig.exe no specs ugin.exe svchost.exe explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\iTop Easy Desktop\IEDInit.exe" /SetupFile="C:\ProgramData\iTop VPN\Downloader\vpn6\IEDSetup.exe" /reinstall=0 /insur=itopf_in /OldVersion=C:\Program Files (x86)\iTop Easy Desktop\IEDInit.exe
IEDSetup.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop Easy Desktop Init
Exit code:
0
Version:
3.0.0.161
Modules
Images
c:\program files (x86)\itop easy desktop\iedinit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
304\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
316"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 39015 -prefMapHandle 5244 -prefMapSize 272997 -jsInitHandle 5248 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5196 -initialChannelId {ec4006bc-87f3-4d14-8740-72d2c81fbae2} -parentPid 7212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
424"C:\Program Files (x86)\iTop VPN\ugin.exe" /postbnstC:\Program Files (x86)\iTop VPN\ugin.exe
iTopVPN.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop VPN
Version:
6.0.0.6166
Modules
Images
c:\program files (x86)\itop vpn\ugin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
432"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3952 -prefsLen 39015 -prefMapHandle 2852 -prefMapSize 272997 -jsInitHandle 2860 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 2332 -initialChannelId {5e350c8d-89c7-4a97-9b45-928b24b744b4} -parentPid 7212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
516cmd.exe /c netsh interface ipv4 set interface "Connection" mtu=1500C:\Windows\SysWOW64\cmd.exe—iTopVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
728"C:\Program Files (x86)\iTop Easy Desktop\IEDManager.exe" /RefreshC:\Program Files (x86)\iTop Easy Desktop\IEDManager.exe
iEasyDesk.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
MEDIUM
Description:
iTop Easy Desktop
Version:
1.0.0.229
Modules
Images
c:\program files (x86)\itop easy desktop\iedmanager.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
888"C:\Program Files (x86)\iTop VPN\ugin.exe" /setlan "English"C:\Program Files (x86)\iTop VPN\ugin.exe—iTopVPN_setup_Free.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop VPN
Exit code:
0
Version:
6.0.0.6166
Modules
Images
c:\program files (x86)\itop vpn\ugin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
952C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
66 353
Read events
66 083
Write events
216
Delete events
54

Modification events

(PID) Process:(4500) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated
Operation:writeName:308046B0AF4A39CB
Value:
29
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000901FE
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4500) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000602DC
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000006033C
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000901FE
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000006025A
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000006025A
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000007025A
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
Executable files
194
Suspicious files
618
Text files
2 275
Unknown types
0

Dropped files

PID
Process
Filename
Type
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
4500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:3134ED3F12E4F4F8643DB90043B0FD7B
SHA256:26E4F122034D7A03F6DA0E707799B09CBEEBDAF8D7A3133A1F7BD894AC72EEA1
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:2FD670934FEF0C60E2119BD874AAF470
SHA256:771A7C83CA015BDBC6AB86A7BD9B1D54E40062E28942D311A9178A0FE6433CF2
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:2FD670934FEF0C60E2119BD874AAF470
SHA256:771A7C83CA015BDBC6AB86A7BD9B1D54E40062E28942D311A9178A0FE6433CF2
4772explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
4500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\safebrowsing-updating\ads-track-digest256.sbstore —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
648
DNS requests
156
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4500
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
4500
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/s/wr3/k58
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
18.245.65.219:80
http://ocsp.r2m02.amazontrust.com/
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
18.245.65.219:80
http://ocsp.r2m02.amazontrust.com/
unknown
—
—
whitelisted
4500
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
18.245.65.219:80
http://ocsp.r2m03.amazontrust.com/
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
4500
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4816
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4500
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
whitelisted
4500
firefox.exe
3.222.106.67:443
itopvpn.com
AMAZON-AES
US
malicious
4500
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
4500
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted
4500
firefox.exe
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
whitelisted
4500
firefox.exe
142.250.184.195:80
o.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
content-signature-2.cdn.mozilla.net
  • 34.160.144.191
whitelisted
content-signature-chains.prod.autograph.services.mozaws.net
  • 34.160.144.191
  • 2600:1901:0:92a9::
whitelisted
itopvpn.com
  • 3.222.106.67
  • 54.227.184.113
malicious
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted
spocs.getpocket.com
  • 34.36.137.203
whitelisted
mc.prod.ads.prod.webservices.mozgcp.net
  • 34.36.137.203
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—
—
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
Setup.exe
time1
Setup.exe
doFinshedEvent_Freeware 0
Setup.exe
time3
Setup.exe
Order: ied
Setup.exe
ProductVersion: 6.5.0.6176
Setup.exe
Chk_ver_min
Setup.exe
Chk_ver_max
Setup.exe
CheckSameVerList
Setup.exe
CheckLicense
Setup.exe
chk_os_ver 110;100;63;62;61
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
itopvpn.com