File name:

Umbral Стил.exe

Full analysis: https://app.any.run/tasks/dea0d6ad-bb76-4840-bad6-83af5f4f2295
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 22:32:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
stealer
umbralstealer
discord
exfiltration
discordgrabber
generic
ims-api
divulgestealer
umbral
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

82722F02FDC1097FE50D2269E6D66AB4

SHA1:

5488A769F9236C121161447AF257B3C31171A7E9

SHA256:

48CEB97639197C21CDFCAFC97E02D3CA76CF20055CA74CCC3F1A19DE725FDB4D

SSDEEP:

3072:W1zJQhGjtQmzAvpehGfSdcRCG28C1ZQkhmE/w7Wx5qw24QxY8e11sUIsuE6cAqUE:bpSdcXzkRw7Wx5n2a8e1mxPRH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Umbral Стил.exe (PID: 7336)

    • Changes Windows Defender settings

      • Umbral Стил.exe (PID: 7336)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 8072)

    • Changes settings for real-time protection

      • powershell.exe (PID: 8072)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 8072)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 8072)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 8072)

    • Steals credentials from Web Browsers

      • Umbral Стил.exe (PID: 7336)

    • Actions looks like stealing of personal data

      • Umbral Стил.exe (PID: 7336)

    • DISCORDGRABBER has been detected (YARA)

      • Umbral Стил.exe (PID: 7336)

    • UMBRALSTEALER has been detected (YARA)

      • Umbral Стил.exe (PID: 7336)

    • UMBRAL has been detected (YARA)

      • Umbral Стил.exe (PID: 7336)

    • DIVULGESTEALER has been detected (YARA)

      • Umbral Стил.exe (PID: 7336)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 8072)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 8072)

    • UMBRALSTEALER has been detected (SURICATA)

      • Umbral Стил.exe (PID: 7336)

    • Starts CMD.EXE for self-deleting

      • Umbral Стил.exe (PID: 7336)

  • SUSPICIOUS

    • Uses WMIC.EXE to obtain Windows Installer data

      • Umbral Стил.exe (PID: 4380)
      • Umbral Стил.exe (PID: 7336)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 4880)
      • WMIC.exe (PID: 7432)
      • WMIC.exe (PID: 7504)

    • Reads security settings of Internet Explorer

      • Umbral Стил.exe (PID: 4380)

    • Reads the date of Windows installation

      • Umbral Стил.exe (PID: 4380)

    • Application launched itself

      • Umbral Стил.exe (PID: 4380)

    • Uses ATTRIB.EXE to modify file attributes

      • Umbral Стил.exe (PID: 7336)

    • Script adds exclusion path to Windows Defender

      • Umbral Стил.exe (PID: 7336)

    • Starts POWERSHELL.EXE for commands execution

      • Umbral Стил.exe (PID: 7336)

    • Checks for external IP

      • Umbral Стил.exe (PID: 4380)
      • Umbral Стил.exe (PID: 7336)
      • svchost.exe (PID: 2196)

    • Script disables Windows Defender's real-time protection

      • Umbral Стил.exe (PID: 7336)

    • Modifies hosts file to alter network resolution

      • Umbral Стил.exe (PID: 7336)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Umbral Стил.exe (PID: 7336)

    • Uses WMIC.EXE to obtain operating system information

      • Umbral Стил.exe (PID: 7336)

    • Script disables Windows Defender's IPS

      • Umbral Стил.exe (PID: 7336)

    • Uses WMIC.EXE to obtain computer system information

      • Umbral Стил.exe (PID: 7336)

    • Uses WMIC.EXE to obtain a list of video controllers

      • Umbral Стил.exe (PID: 7336)

    • The process connected to a server suspected of theft

      • Umbral Стил.exe (PID: 7336)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 7516)

    • Starts CMD.EXE for commands execution

      • Umbral Стил.exe (PID: 7336)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 7324)

  • INFO

    • Reads the machine GUID from the registry

      • Umbral Стил.exe (PID: 4380)
      • Umbral Стил.exe (PID: 7336)

    • Checks supported languages

      • Umbral Стил.exe (PID: 4380)
      • Umbral Стил.exe (PID: 7336)

    • Reads the computer name

      • Umbral Стил.exe (PID: 4380)
      • Umbral Стил.exe (PID: 7336)

    • Disables trace logs

      • Umbral Стил.exe (PID: 4380)
      • Umbral Стил.exe (PID: 7336)

    • Checks proxy server information

      • Umbral Стил.exe (PID: 4380)
      • Umbral Стил.exe (PID: 7336)

    • Reads Environment values

      • Umbral Стил.exe (PID: 4380)
      • Umbral Стил.exe (PID: 7336)

    • Reads the software policy settings

      • Umbral Стил.exe (PID: 4380)
      • Umbral Стил.exe (PID: 7336)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 4880)
      • WMIC.exe (PID: 7432)
      • WMIC.exe (PID: 7324)
      • WMIC.exe (PID: 1764)
      • WMIC.exe (PID: 7504)
      • WMIC.exe (PID: 7516)

    • Process checks computer location settings

      • Umbral Стил.exe (PID: 4380)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7660)
      • powershell.exe (PID: 4448)
      • powershell.exe (PID: 8072)
      • powershell.exe (PID: 1660)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7660)

    • Create files in a temporary directory

      • Umbral Стил.exe (PID: 7336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(7336) Umbral Стил.exe
Discord-Webhook-Tokens (1)1366728724770328669/i4YtfPdGl-xg84MHy8XKR3oIlOOCKzWGcOsxP_pUu3t2GhZ40e7evH7lq1ApJF4Ov-NH
Discord-Info-Links
1366728724770328669/i4YtfPdGl-xg84MHy8XKR3oIlOOCKzWGcOsxP_pUu3t2GhZ40e7evH7lq1ApJF4Ov-NH
Get Webhook Infohttps://discord.com/api/webhooks/1366728724770328669/i4YtfPdGl-xg84MHy8XKR3oIlOOCKzWGcOsxP_pUu3t2GhZ40e7evH7lq1ApJF4Ov-NH
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2053:02:19 18:54:36+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 233984
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x3b11e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Payload for Umbral Stealer
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
32
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start umbral стил.exe wmic.exe no specs conhost.exe no specs svchost.exe #UMBRALSTEALER umbral стил.exe wmic.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs attrib.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1660"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITYC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Umbral Стил.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
1764"wmic.exe" computersystem get totalphysicalmemoryC:\Windows\System32\wbem\WMIC.exe—Umbral Стил.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4380"C:\Users\admin\Desktop\Umbral Стил.exe" C:\Users\admin\Desktop\Umbral Стил.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\umbral стил.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4448"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITYC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Umbral Стил.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4880"wmic.exe" csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—Umbral Стил.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
5324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6048\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
24 912
Read events
24 898
Write events
14
Delete events
0

Modification events

(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4380) Umbral Стил.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Umbral ????_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
7
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
8072powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qsntw3lj.tsk.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7660powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:EAB092F6CB9A7166E53D32CEA7875E5B
SHA256:24425C5D9B938EA618E64EDC34318198C5F01199186A7F4E5CA58F60551644CB
7660powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pvvzx4cr.ce5.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8072powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_laffphac.gmp.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7660powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hjto4xxu.cjc.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7336Umbral Стил.exeC:\Users\admin\AppData\Local\Temp\W9OyJi4rNz6M6qdbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
7336Umbral Стил.exeC:\Users\admin\AppData\Local\Temp\1vQHk2x8gW19Lzpbinary
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
7336Umbral Стил.exeC:\Users\admin\AppData\Local\Temp\rKuTW9geX35rfnKbinary
MD5:46D9FCA6032297F8AEE08D73418312BA
SHA256:865856FA4C33C4AEE52E15FBB370B6611468FE947E76E197F0E50D0AD62CB1B4
7336Umbral Стил.exeC:\Windows\System32\drivers\etc\hoststext
MD5:2992FEB95030E84DE4A6D2F432E17E5F
SHA256:5E9F7AAADDAD64848ADC44BD44DE1FFE3E69DFCCDEFF29B58067A7F313EABD2D
4448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_t2frex3o.mz2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
26
DNS requests
16
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4380
Umbral Стил.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7336
Umbral Стил.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7336
Umbral Стил.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/?fields=225545
unknown
—
—
whitelisted
7800
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7800
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4380
Umbral Стил.exe
172.217.16.195:443
gstatic.com
GOOGLE
US
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4380
Umbral Стил.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
7336
Umbral Стил.exe
172.217.16.195:443
gstatic.com
GOOGLE
US
whitelisted
7336
Umbral Стил.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.52.120.96
whitelisted
gstatic.com
  • 172.217.16.195
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.74
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.68
  • 20.190.160.132
  • 20.190.160.17
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
discord.com
  • 162.159.135.232
  • 162.159.136.232
  • 162.159.137.232
  • 162.159.128.233
  • 162.159.138.232
whitelisted

Threats

PID
Process
Class
Message
—
—
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
—
—
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
—
—
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
A Network Trojan was detected
STEALER [ANY.RUN] UmbralStealer Generic External IP Check
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Umbral Стил.exe