File name:

Beta.exe

Full analysis: https://app.any.run/tasks/f1801631-8ad0-4118-b289-f4ca8a589732
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 26, 2025, 14:38:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
ms-smartcard
upx
susp-powershell
salatstealer
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

94903D0143A4864862AB01C45844E72E

SHA1:

0F38B91879F979E5E0234CDB0915A4483439CFFB

SHA256:

6D416ECD3BD039366A95754FB3743A6A2B4B5C53625EF8EA3E9C483D87190EB1

SSDEEP:

98304:AH80Ih0M3NG/YMPJVFspL0iDW0+oUqGvBryNqCt3NSlHKdKBSOoM2naBiunyzAps:0MQDYkj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • uhssvc.exe (PID: 2648)

    • Steals credentials from Web Browsers

      • uhssvc.exe (PID: 2648)

    • UAC/LUA settings modification

      • powershell.exe (PID: 1964)

    • SALATSTEALER has been detected (YARA)

      • uhssvc.exe (PID: 2648)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Beta.exe (PID: 4232)
      • ShellExperienceHost.exe (PID: 5400)

    • Application launched itself

      • Beta.exe (PID: 4232)

    • Reads the date of Windows installation

      • Beta.exe (PID: 4232)

    • Executable content was dropped or overwritten

      • Beta.exe (PID: 6260)
      • uhssvc.exe (PID: 2648)

    • Starts itself from another location

      • Beta.exe (PID: 6260)
      • uhssvc.exe (PID: 2648)

    • Starts POWERSHELL.EXE for commands execution

      • uhssvc.exe (PID: 2648)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 1964)

    • There is functionality for taking screenshot (YARA)

      • uhssvc.exe (PID: 2648)

    • Multiple wallet extension IDs have been found

      • uhssvc.exe (PID: 2648)

  • INFO

    • Reads the computer name

      • Beta.exe (PID: 4232)
      • Beta.exe (PID: 6260)
      • uhssvc.exe (PID: 2648)
      • uhssvc.exe (PID: 6668)
      • uhssvc.exe (PID: 6664)
      • ShellExperienceHost.exe (PID: 5400)

    • Reads the machine GUID from the registry

      • Beta.exe (PID: 4232)
      • Beta.exe (PID: 6260)
      • uhssvc.exe (PID: 2648)
      • uhssvc.exe (PID: 6664)
      • uhssvc.exe (PID: 6668)

    • Checks supported languages

      • Beta.exe (PID: 4232)
      • Beta.exe (PID: 6260)
      • uhssvc.exe (PID: 2648)
      • uhssvc.exe (PID: 6664)
      • uhssvc.exe (PID: 6668)
      • ShellExperienceHost.exe (PID: 5400)

    • Process checks computer location settings

      • Beta.exe (PID: 4232)

    • Creates files in the program directory

      • Beta.exe (PID: 6260)
      • uhssvc.exe (PID: 2648)

    • Creates files or folders in the user directory

      • Beta.exe (PID: 6260)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • uhssvc.exe (PID: 2648)

    • Create files in a temporary directory

      • uhssvc.exe (PID: 2648)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 1964)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1964)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1964)

    • UPX packer has been detected

      • uhssvc.exe (PID: 2648)

    • Application based on Golang

      • uhssvc.exe (PID: 2648)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • uhssvc.exe (PID: 2648)

    • Detects GO elliptic curve encryption (YARA)

      • uhssvc.exe (PID: 2648)

    • Found Base64 encoded access to environment variables via PowerShell (YARA)

      • uhssvc.exe (PID: 2648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 3
CodeSize: 3280896
InitializedDataSize: 4096
UninitializedDataSize: 8769536
EntryPoint: 0xb7d4d0
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start beta.exe no specs beta.exe #SALATSTEALER uhssvc.exe powershell.exe no specs conhost.exe no specs uhssvc.exe no specs uhssvc.exe no specs shellexperiencehost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1964powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—uhssvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2648C:\Users\admin\AppData\Local\Packages\uhssvc.exeC:\Users\admin\AppData\Local\Packages\uhssvc.exe
Beta.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\packages\uhssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll
3388C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4232"C:\Users\admin\AppData\Local\Temp\Beta.exe" C:\Users\admin\AppData\Local\Temp\Beta.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\beta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll
5400"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
5444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6260"C:\Users\admin\AppData\Local\Temp\Beta.exe" C:\Users\admin\AppData\Local\Temp\Beta.exe
Beta.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\beta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll
6664"C:\Program Files\Google\Chrome\Application\uhssvc.exe" -C:\Program Files\Google\Chrome\Application\uhssvc.exe—uhssvc.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\google\chrome\application\uhssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll
6668"C:\Program Files (x86)\Microsoft\Edge\Application\uhssvc.exe" -C:\Program Files (x86)\Microsoft\Edge\Application\uhssvc.exe—uhssvc.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\microsoft\edge\application\uhssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll
Total events
14 149
Read events
14 138
Write events
11
Delete events
0

Modification events

(PID) Process:(4232) Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4232) Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4232) Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4232) Beta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1964) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(5400) ShellExperienceHost.exeKey:\REGISTRY\A\{3a3fb621-e8af-85f7-03e6-98dba2d789f4}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D000000567ED6FDA7E6DB01
Executable files
4
Suspicious files
1
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1964powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ccys55bs.1cx.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2648uhssvc.exeC:\Program Files\Google\Chrome\Application\uhssvc.exeexecutable
MD5:94903D0143A4864862AB01C45844E72E
SHA256:6D416ECD3BD039366A95754FB3743A6A2B4B5C53625EF8EA3E9C483D87190EB1
1964powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_20j5kibm.lh2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1964powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_roh55t0f.1ok.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2648uhssvc.exeC:\Program Files (x86)\Microsoft\Edge\Application\uhssvc.exeexecutable
MD5:94903D0143A4864862AB01C45844E72E
SHA256:6D416ECD3BD039366A95754FB3743A6A2B4B5C53625EF8EA3E9C483D87190EB1
6260Beta.exeC:\Program Files (x86)\Google\firefox.exeexecutable
MD5:94903D0143A4864862AB01C45844E72E
SHA256:6D416ECD3BD039366A95754FB3743A6A2B4B5C53625EF8EA3E9C483D87190EB1
6260Beta.exeC:\Users\admin\AppData\Local\Packages\uhssvc.exeexecutable
MD5:94903D0143A4864862AB01C45844E72E
SHA256:6D416ECD3BD039366A95754FB3743A6A2B4B5C53625EF8EA3E9C483D87190EB1
1964powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lam42aih.nab.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1964powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactivebinary
MD5:94F32499528C080835686CDFABEEAFF6
SHA256:2CAF85579F594EE7E34EB321294BBA3396C897B9196CFDC3936D18EF6404D843
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
35
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6876
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1044
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1044
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7136
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6260
Beta.exe
1.1.1.1:443
—
—
—
whitelisted
6260
Beta.exe
188.114.96.3:443
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2648
uhssvc.exe
1.1.1.1:443
—
—
—
whitelisted
2648
uhssvc.exe
188.114.96.3:443
—
—
—
unknown
1268
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.131
  • 20.190.160.22
  • 20.190.160.4
  • 20.190.160.132
  • 20.190.160.130
  • 20.190.160.3
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Beta.exe