File name:

43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8

Full analysis: https://app.any.run/tasks/1d2d732d-f6d8-47a3-8900-50575fd2a8af
Verdict: Malicious activity
Threats:

Glupteba is a loader with information-stealing and traffic routing functionality. It is designed primarily to install other viruses on infected PCs but can do much more than that. In addition, it is being constantly updated, making this virus one to watch out for.

Malware Trends Tracker     >>>
Analysis date: April 22, 2025, 05:17:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
uac
antivm
golang
trojan
glupteba
discord
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

0391BB0E33FDFD666972B1770667AAF7

SHA1:

E79556C496C58440A97F0D47F01B2FDF462E769A

SHA256:

43B9D6403174ACA0DDD8EF49CD6F7C7570940FBC1B2A1F543FF772174AAD67A8

SSDEEP:

98304:IkjHfew03++HY1Wna9/3bP1BxdLYGm42Tb3F2LdKgKBxk4nsjPC9UHcFnhqo4hEL:GShOzaLCV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass User Account Control (Modify registry)

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)

    • Bypass User Account Control (fodhelper)

      • fodhelper.exe (PID: 680)

    • Executing a file with an untrusted certificate

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • Modifies exclusions in Windows Defender

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)

    • Changes the autorun value in the registry

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • Glupteba is detected

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)

    • Uses Task Scheduler to autorun other applications

      • csrss.exe (PID: 4212)

  • SUSPICIOUS

    • Changes default file association

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)

    • Starts CMD.EXE for commands execution

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • Starts POWERSHELL.EXE for commands execution

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • The process hides Powershell's copyright startup banner

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • The process bypasses the loading of PowerShell profile settings

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • There is functionality for VM detection VMWare (YARA)

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)

    • Application launched itself

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)

    • There is functionality for VM detection Parallels (YARA)

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)

    • There is functionality for VM detection VirtualPC (YARA)

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)

    • There is functionality for VM detection VirtualBox (YARA)

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 1132)

    • The process creates files with name similar to system file names

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)

    • Executable content was dropped or overwritten

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • Starts itself from another location

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 7616)

    • Creates a software uninstall entry

      • csrss.exe (PID: 4212)

    • Drops a system driver (possible attempt to evade defenses)

      • csrss.exe (PID: 4212)

    • Creates files in the driver directory

      • csrss.exe (PID: 4212)

    • Windows service management via SC.EXE

      • sc.exe (PID: 5588)
      • sc.exe (PID: 7556)
      • sc.exe (PID: 7756)

  • INFO

    • Reads the computer name

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • Checks supported languages

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • Reads security settings of Internet Explorer

      • cmd.exe (PID: 4400)
      • fodhelper.exe (PID: 680)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2420)
      • csrss.exe (PID: 4212)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 5968)
      • powershell.exe (PID: 4188)
      • powershell.exe (PID: 2960)
      • powershell.exe (PID: 2552)
      • powershell.exe (PID: 2800)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7504)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5968)
      • powershell.exe (PID: 4188)
      • powershell.exe (PID: 2960)
      • powershell.exe (PID: 2552)
      • powershell.exe (PID: 2800)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7504)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5968)
      • powershell.exe (PID: 4188)
      • powershell.exe (PID: 2960)
      • powershell.exe (PID: 2552)
      • powershell.exe (PID: 2800)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7504)

    • Detects GO elliptic curve encryption (YARA)

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)

    • Application based on Golang

      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 2504)
      • 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe (PID: 6040)

    • Application launched itself

      • firefox.exe (PID: 2552)
      • firefox.exe (PID: 6656)

    • Manual execution by a user

      • firefox.exe (PID: 2552)

    • The sample compiled with english language support

      • csrss.exe (PID: 4212)

    • Process checks computer location settings

      • csrss.exe (PID: 4212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:12:22 14:08:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 4237824
InitializedDataSize: 5111808
UninitializedDataSize: -
EntryPoint: 0x758f
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 18.0.0.0
ProductVersionNumber: 8.0.0.0
FileFlagsMask: 0x183a
FileFlags: (none)
FileOS: Unknown (0x20461)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Faeroese
CharacterSet: Unknown (31F6)
LegalCopyright: Copyright (C) 2023, parking
OriginalFileName: bigthing.exe
ProductsVersion: 36.47.26.15
ProductName: SolarOmir
ProductionVersion: 1.24.17.52
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
59
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe no specs cmd.exe no specs conhost.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe no specs sppextcomobj.exe no specs slui.exe no specs powershell.exe no specs conhost.exe no specs #GLUPTEBA 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs csrss.exe powershell.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs powershell.exe no specs conhost.exe no specs mountvol.exe no specs conhost.exe no specs mountvol.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs schtasks.exe no specs conhost.exe no specs firefox.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\WINDOWS\system32\fodhelper.exe" C:\Windows\System32\fodhelper.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Features On Demand Helper
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\fodhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132C:\WINDOWS\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\WINDOWS\rss\csrss.exe" enable=yes"C:\Windows\System32\cmd.exe—43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1280C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2148netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\WINDOWS\rss\csrss.exe" enable=yesC:\Windows\System32\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2344"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2168 -parentBuildID 20240213221259 -prefsHandle 2156 -prefMapHandle 2144 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {925977ca-47bb-4784-8132-5e61ac452243} 6656 "\\.\pipe\gecko-crash-server-pipe.6656" 1d471780110 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2420"C:\Users\admin\AppData\Local\Temp\43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe"C:\Users\admin\AppData\Local\Temp\43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe
43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\users\admin\appdata\local\temp\43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\gdi32.dll
c:\windows\syswow64\win32u.dll
2504"C:\Users\admin\AppData\Local\Temp\43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe" C:\Users\admin\AppData\Local\Temp\43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
2552powershell -nologo -noprofileC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
Total events
51 736
Read events
51 694
Write events
40
Delete events
2

Modification events

(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:Servers
Value:
https://окрф.рф
(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:UUID
Value:
(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:FirstInstallDate
Value:
8026076800000000
(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:ServiceVersion
Value:
(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:PGDSE
Value:
0000000000000000
(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:ServersVersion
Value:
C300000000000000
(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:OSCaption
Value:
Microsoft Windows 10 Pro
(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:OSArchitecture
Value:
64-bit
(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:IsAdmin
Value:
1
(PID) Process:(2504) 43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:AV
Value:
Executable files
4
Suspicious files
132
Text files
46
Unknown types
0

Dropped files

PID
Process
Filename
Type
4188powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_i4x5ctkq.0re.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2552powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_ukb4cjre.wj2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2552powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_x0rhipnx.qib.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4188powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_ybsxxdub.lvr.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2552powershell.exeC:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactivebinary
MD5:A5929777B5B1794924FF7968068F6C37
SHA256:712DDD0A211611258DA83FEB2285D76C412C035F5DC0C743647201106118A3D3
2552powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_gsurjykz.5nd.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6656firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
5968powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kctcm3wu.ugv.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5968powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactivebinary
MD5:08541B6326616C2978C79BD4F25A7F2A
SHA256:1DF3078DE9DCB18A621833D3EE8501CC9767FD6E4F0B5B03FA3B9F12B5AAA2D4
5968powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4yufojve.3ep.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
80
DNS requests
110
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
668
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
668
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6656
firefox.exe
POST
200
2.16.168.113:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
6656
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
6656
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
6656
firefox.exe
POST
200
142.250.185.163:80
http://o.pki.goog/s/wr3/cgo
unknown
—
—
whitelisted
6656
firefox.exe
POST
—
142.250.185.163:80
http://o.pki.goog/s/wr3/UTA
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 2.23.246.101
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.2
  • 40.126.31.71
  • 40.126.31.2
  • 40.126.31.129
  • 40.126.31.3
  • 40.126.31.0
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
c1761ce5-a623-4195-b636-a63888545a2d.uuid.xn--j1ahhq.xn--p1ai
  • —
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
4212
csrss.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
43b9d6403174aca0ddd8ef49cd6f7c7570940fbc1b2a1f543ff772174aad67a8