File name:

Nurik.exe

Full analysis: https://app.any.run/tasks/9a58fd07-9ce7-4e83-94e9-b1422f5c3c0e
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: April 05, 2025, 11:11:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
dcrat
rat
remote
darkcrystal
stealer
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

6285A4AC33D0CA8703E199AB387BC1A5

SHA1:

CA0542E5A066E1F4D4F871765ED6F0F0BA900D7B

SHA256:

6DE483569C96166C4830BC0AC256FB31975A43D9AF1443F0E3E31FF31BA89F30

SSDEEP:

24576:HZPrK87M5rSv0lvPZYEI1+eI3GMHFG2agd6a01Iaq/W6C:HFrKj5G0lvhYQv3x6a0aaq/W6C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6300)

    • DCRAT mutex has been found

      • upfc.exe (PID: 3268)

    • Actions looks like stealing of personal data

      • upfc.exe (PID: 3268)

    • DCRAT has been detected (YARA)

      • upfc.exe (PID: 3268)

    • DARKCRYSTAL has been detected (SURICATA)

      • upfc.exe (PID: 3268)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Nurik.exe (PID: 616)
      • bridgeserverBrowser.exe (PID: 5720)

    • Executable content was dropped or overwritten

      • Nurik.exe (PID: 616)
      • bridgeserverBrowser.exe (PID: 5720)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6300)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 6300)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 6300)

    • Executed via WMI

      • schtasks.exe (PID: 4896)
      • schtasks.exe (PID: 4008)
      • schtasks.exe (PID: 536)
      • schtasks.exe (PID: 744)
      • schtasks.exe (PID: 976)
      • schtasks.exe (PID: 6652)
      • schtasks.exe (PID: 6044)
      • schtasks.exe (PID: 2320)
      • schtasks.exe (PID: 2140)
      • schtasks.exe (PID: 5544)
      • schtasks.exe (PID: 4120)
      • schtasks.exe (PID: 732)
      • schtasks.exe (PID: 4988)
      • schtasks.exe (PID: 1056)
      • schtasks.exe (PID: 6476)
      • schtasks.exe (PID: 6712)
      • schtasks.exe (PID: 1184)
      • schtasks.exe (PID: 5384)
      • schtasks.exe (PID: 5984)
      • schtasks.exe (PID: 6676)
      • schtasks.exe (PID: 5400)
      • schtasks.exe (PID: 4464)
      • schtasks.exe (PID: 1012)
      • schtasks.exe (PID: 496)
      • schtasks.exe (PID: 6540)
      • schtasks.exe (PID: 1532)
      • schtasks.exe (PID: 5428)
      • schtasks.exe (PID: 5512)
      • schtasks.exe (PID: 2140)
      • schtasks.exe (PID: 5072)
      • schtasks.exe (PID: 6540)
      • schtasks.exe (PID: 5116)
      • schtasks.exe (PID: 5512)
      • schtasks.exe (PID: 6032)
      • schtasks.exe (PID: 1228)
      • schtasks.exe (PID: 1388)
      • schtasks.exe (PID: 4988)
      • schtasks.exe (PID: 5544)
      • schtasks.exe (PID: 536)
      • schtasks.exe (PID: 5384)
      • schtasks.exe (PID: 1600)
      • schtasks.exe (PID: 6752)
      • schtasks.exe (PID: 6240)
      • schtasks.exe (PID: 2984)
      • schtasks.exe (PID: 6652)
      • schtasks.exe (PID: 3240)
      • schtasks.exe (PID: 4776)
      • schtasks.exe (PID: 2384)
      • schtasks.exe (PID: 6644)
      • schtasks.exe (PID: 4120)
      • schtasks.exe (PID: 812)
      • schtasks.exe (PID: 6436)
      • schtasks.exe (PID: 1128)
      • schtasks.exe (PID: 1056)

    • The process creates files with name similar to system file names

      • bridgeserverBrowser.exe (PID: 5720)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 6540)
      • schtasks.exe (PID: 5116)
      • schtasks.exe (PID: 5072)

    • Starts itself from another location

      • bridgeserverBrowser.exe (PID: 5720)

    • Reads the date of Windows installation

      • bridgeserverBrowser.exe (PID: 5720)

    • There is functionality for taking screenshot (YARA)

      • upfc.exe (PID: 3268)

    • Potential Corporate Privacy Violation

      • upfc.exe (PID: 3268)

  • INFO

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • Nurik.exe (PID: 616)

    • The sample compiled with english language support

      • Nurik.exe (PID: 616)
      • bridgeserverBrowser.exe (PID: 5720)

    • Reads the computer name

      • Nurik.exe (PID: 616)
      • bridgeserverBrowser.exe (PID: 5720)
      • upfc.exe (PID: 3268)

    • Process checks computer location settings

      • Nurik.exe (PID: 616)
      • bridgeserverBrowser.exe (PID: 5720)

    • Checks supported languages

      • Nurik.exe (PID: 616)
      • bridgeserverBrowser.exe (PID: 5720)
      • upfc.exe (PID: 3268)

    • Reads Environment values

      • bridgeserverBrowser.exe (PID: 5720)
      • upfc.exe (PID: 3268)

    • Reads the machine GUID from the registry

      • bridgeserverBrowser.exe (PID: 5720)
      • upfc.exe (PID: 3268)

    • Failed to create an executable file in Windows directory

      • bridgeserverBrowser.exe (PID: 5720)

    • Disables trace logs

      • upfc.exe (PID: 3268)

    • Checks proxy server information

      • upfc.exe (PID: 3268)

    • .NET Reactor protector has been detected

      • upfc.exe (PID: 3268)

    • Reads the software policy settings

      • slui.exe (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(3268) upfc.exe
C2 (1)http://ilaila5b.beget.tech/L1nc0In
Options
MutexDCR_MUTEX-EgpZ1Nv8UOUGUnVM6cWq
searchpath%UsersFolder% - Fast
Targetals
C2 (1)http://ilaila5b.beget.tech/L1nc0In
Options
MutexDCR_MUTEX-EgpZ1Nv8UOUGUnVM6cWq
Debugfalse
ServerConfigReplacementTable
0_
5!
6(
9`
U^
E;
X&
W%
d@
L>
i-
J~
C#
G.
b$
k*
N|
Q)
h,
m<
I
PluginConfigReplacementTable
0(
6%
Q#
=-
M*
S&
l^
x,
I
c)
w.
e`
X~
p!
y_
f|
b<
i;
j>
D@
GetWebcamsfalse
SleepTimeout5
InactivityTimeout2
CacheStorageRegistry
AutoRunSmart
StealerConfig
searchpath%UsersFolder% - Fast
StealerEnabledfalse
StealerOptionsfalse
SelfDeletefalse
Version4.5.32
ServerTypeC#
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 18:00:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 255488
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
64
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start nurik.exe wscript.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs bridgeserverbrowser.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT upfc.exe slui.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
496schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Chainproviderhost\OfficeClickToRun.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
516C:\WINDOWS\system32\cmd.exe /c ""C:\Chainproviderhost\D1lhFc.bat" "C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
536schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Chainproviderhost\RuntimeBroker.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
536schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Chainproviderhost\upfc.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616"C:\Users\admin\AppData\Local\Temp\Nurik.exe" C:\Users\admin\AppData\Local\Temp\Nurik.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nurik.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_d954cb49e10154a6\gdiplus.dll
732schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Chainproviderhost\dwm.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Chainproviderhost\backgroundTaskHost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
812schtasks.exe /create /tn "bridgeserverBrowser" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\bridgeserverBrowser.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
976schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Chainproviderhost\backgroundTaskHost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\admin\3D Objects\conhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 154
Read events
5 137
Write events
17
Delete events
0

Modification events

(PID) Process:(616) Nurik.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(5720) bridgeserverBrowser.exeKey:HKEY_CURRENT_USER\SOFTWARE\3eeefbeda899c7772fa16b4834d96d3cdde52901
Operation:writeName:13b5c2b2b60dd962f3b78122db7efc526c6d9abd
Value:
WyJDOlxcQ2hhaW5wcm92aWRlcmhvc3RcXGJyaWRnZXNlcnZlckJyb3dzZXIuZXhlIiwiQzpcXENoYWlucHJvdmlkZXJob3N0XFx3aW5pbml0LmV4ZSIsIkM6XFxDaGFpbnByb3ZpZGVyaG9zdFxcUnVudGltZUJyb2tlci5leGUiLCJDOlxcQ2hhaW5wcm92aWRlcmhvc3RcXGJhY2tncm91bmRUYXNrSG9zdC5leGUiLCJDOlxcQ2hhaW5wcm92aWRlcmhvc3RcXGRsbGhvc3QuZXhlIiwiQzpcXENoYWlucHJvdmlkZXJob3N0XFxkd20uZXhlIiwiQzpcXENoYWlucHJvdmlkZXJob3N0XFxNdXNOb3RpZmljYXRpb24uZXhlIiwiQzpcXENoYWlucHJvdmlkZXJob3N0XFx0YXNraG9zdHcuZXhlIiwiQzpcXFVzZXJzXFxEZWZhdWx0XFxGYXZvcml0ZXNcXFN5c3RlbVNldHRpbmdzLmV4ZSIsIkM6XFxVc2Vyc1xcYWRtaW5cXDNEIE9iamVjdHNcXGNvbmhvc3QuZXhlIiwiQzpcXENoYWlucHJvdmlkZXJob3N0XFxPZmZpY2VDbGlja1RvUnVuLmV4ZSIsIkM6XFxVc2Vyc1xcUHVibGljXFxWaWRlb3NcXHNpaG9zdC5leGUiLCJDOlxcV2luZG93c1xcVGVtcFxcYXVkaW9kZy5leGUiLCJDOlxcQ2hhaW5wcm92aWRlcmhvc3RcXHVwZmMuZXhlIiwiQzpcXFVzZXJzXFxEZWZhdWx0XFxNdXNpY1xcY3RmbW9uLmV4ZSIsIkM6XFxDaGFpbnByb3ZpZGVyaG9zdFxcZHdtLmV4ZSIsIkM6XFxDaGFpbnByb3ZpZGVyaG9zdFxcU3RhcnRNZW51RXhwZXJpZW5jZUhvc3QuZXhlIiwiQzpcXFVzZXJzXFxEZWZhdWx0XFxTYXZlZCBHYW1lc1xcYnJpZGdlc2VydmVyQnJvd3Nlci5leGUiLCJDOlxcQ2hhaW5wcm92aWRlcmhvc3RcXGNzcnNzLmV4ZSJd
(PID) Process:(3268) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3268) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3268) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3268) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3268) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3268) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3268) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3268) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
18
Suspicious files
1
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
5720bridgeserverBrowser.exeC:\Chainproviderhost\backgroundTaskHost.exeexecutable
MD5:FAE90016E2E07804EA1198833B8767EB
SHA256:E9371712DF288B3A83C54EA65A2D1B7A5703FE03DAD77816F5E7B4324A2F92CF
5720bridgeserverBrowser.exeC:\Chainproviderhost\wininit.exeexecutable
MD5:FAE90016E2E07804EA1198833B8767EB
SHA256:E9371712DF288B3A83C54EA65A2D1B7A5703FE03DAD77816F5E7B4324A2F92CF
616Nurik.exeC:\Chainproviderhost\D1lhFc.battext
MD5:C8DE58F7423C160A925133CF4453B7A3
SHA256:288AB26FDF73DC60FB46AC2793B9201C712836595032759FE1DC0DF35582E430
5720bridgeserverBrowser.exeC:\Chainproviderhost\56085415360792text
MD5:73DDD74F91D1531FD3592E0B4B2B5A8B
SHA256:6FE5BE344811E031FDCB1F8DA17697A12E9D9338D8C3A6232ED530946195B0EC
5720bridgeserverBrowser.exeC:\Chainproviderhost\9e8d7a4ca61bd9text
MD5:BE340F07F527F50B5B74805D98E8821A
SHA256:72067B5506883ACEEDF6095CCA27D3885CCE77FD32C0D9ACC0080E62F772BCD9
5720bridgeserverBrowser.exeC:\Chainproviderhost\6cb0b6c459d5d3text
MD5:D363B25112A6A669ACDF6773C4F37D38
SHA256:C996F925F8AE3C4DF13D7C0F197C1D6AC090782A40502BA777610D83FE26D2CE
5720bridgeserverBrowser.exeC:\Chainproviderhost\RuntimeBroker.exeexecutable
MD5:FAE90016E2E07804EA1198833B8767EB
SHA256:E9371712DF288B3A83C54EA65A2D1B7A5703FE03DAD77816F5E7B4324A2F92CF
5720bridgeserverBrowser.exeC:\Chainproviderhost\eddb19405b7ce1text
MD5:89D071CF882FE04669D60D157945DF2A
SHA256:B41875A9C7634C43AEFA58444905485A20FB132F262800FC907425994308999F
5720bridgeserverBrowser.exeC:\Chainproviderhost\dllhost.exeexecutable
MD5:FAE90016E2E07804EA1198833B8767EB
SHA256:E9371712DF288B3A83C54EA65A2D1B7A5703FE03DAD77816F5E7B4324A2F92CF
616Nurik.exeC:\Chainproviderhost\44W6qETNWO8.vbebinary
MD5:4A1B870A1892429AE4FAFF6C096FB552
SHA256:64217936697CDBBE3FBD32A3EA3CF893CFB548EEC291F4EF38A24F5CEE8D3783
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
160
TCP/UDP connections
24
DNS requests
16
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3268
upfc.exe
GET
200
5.101.152.39:80
http://ilaila5b.beget.tech/L1nc0In.php?BPcuA4Zk5=6EZLwzcbqBk&NB8EPy5IE35CHIJ2pEG78sGMWXsf=5htpHCaw5olpwODIXEopkvm4m4f5vr&FZKIVLX9GtFuZfSLdDE9TE0XJ5zC=gfANwgPm&eb3e02aafb758aeb9a90c47bc15537b9=16a43f536c3fe0b2ac4d3b3192be64d2&88eb947e6952cd9a1c902d41737c10e1=QYhJmY0IDZ4UTZlVDOkdDZ3EmMzIDNlJzNkJGZjJDOzU2M5UGMxMmY&BPcuA4Zk5=6EZLwzcbqBk&NB8EPy5IE35CHIJ2pEG78sGMWXsf=5htpHCaw5olpwODIXEopkvm4m4f5vr&FZKIVLX9GtFuZfSLdDE9TE0XJ5zC=gfANwgPm
unknown
—
—
whitelisted
3268
upfc.exe
GET
200
5.101.152.39:80
http://ilaila5b.beget.tech/L1nc0In.php?s0jmCuWPDjuoWw=L9KRVr9BF389p62In&rPXXuGBe2qvgd2TXye=A1ttzdtDurTKbGGoh&xOEP1=TPiaGqRIYmnp8gh4BCQwjfUaWN&e44c84955770ba4dea01386fb157c5b8=ykTY5MzY5EDOlZWM3YDOiBTM3kTY1MzYyEWOiJGO1kDZzkDZ1YTYjhDN5gTNzADM1YTO5MjM&88eb947e6952cd9a1c902d41737c10e1=wNyMTNzYDZlZ2M1MTNhNWOlljM1cjYyEmZ2UmMyUGNlhDZxIDO5M2N&a4a6f298269db9e9972f8934db832b73=d1nIzgTZ4U2Y1ImZxkTYxYjNwMjNzQzNiRDZkJmZ5EjYwMTY3YjNwIDOzIiOiYzNmZWZ0YWOjRmZiRTZzYTO4YjZkFjMmRWZhRmZ2cjMiwiI5ETNyMGNjBDMjVjY3EzY4QWZhJ2NjZDN0UTZ4UDZ4IWYjBDZ5UWM5IiOikDOkNTO0QTY1YWN2YWMlBTYyQTN2MWY3MzM3kjM5ATZis3W&e82648b7e239fb037b863a234c855a0b=0VfiIiOiEDZjNjZzUzNzUTM2MzN4YzY3QDMhJTOyYTO4YmNmlTZiwiIzgTZ4U2Y1ImZxkTYxYjNwMjNzQzNiRDZkJmZ5EjYwMTY3YjNwIDOzIiOiYzNmZWZ0YWOjRmZiRTZzYTO4YjZkFjMmRWZhRmZ2cjMiwiI5ETNyMGNjBDMjVjY3EzY4QWZhJ2NjZDN0UTZ4UDZ4IWYjBDZ5UWM5IiOikDOkNTO0QTY1YWN2YWMlBTYyQTN2MWY3MzM3kjM5ATZisHL9JCMY5kNJNEZxkzVaRHbHZ1dWdlWz5EbJNXSTplMsdEZqZ0aJZTS5NWMShVWw4kVlBDbtRGcSNTWCp0QMlWSYplbG1mYoFTRJRnRtNmb502YRpUaPl2YzI2a1cVYYJVMRJkSDxUa0sWS2k0UihmTtlFbkFzYwp0QMl2aslkNJNlW1lzRhdXOtNmasdFV6xWbJNXSTtUdkNjY1RXbiZFaDlUdkNjY1RXbiZlSp9UaVdlYoVTVWFlTrl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUktWSzlUaUl2bqlUdsdlYrZEMjBnSDxUaJl2TpNWVRVlSDxUaRhVYDJ0QOJTQTples12Y3pEWaBTNXJ1ZBRVTn10MkZnUtJGckxWS2kUajxmWsJGckxWSzBjbJVnVyoFao1mYsJ0MiRUOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUaz12YoFTbixmUFlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJJzaq5UM0kWT4d3QONTWqxUMVpWS2kUeZZHetl0cJl3UFpUaPl2auNGM1cFZ25UbJNXSpJmdsJjWspkRJNnRHRGcChVWEpUaPlGNyIGckdlW5p0QMlGNXplbGdUY1Z1RjZnTrlkNJNVZwwmMZl2dpl0MZpGTzElaMpXQq1UdVR0Tp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS1x2VitmRtlkNJNlW0ZUbUlnVyMmVKNETpFVRUtEeFRFSwVFTRlTRWxkTWJVRKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEDZjNjZzUzNzUTM2MzN4YzY3QDMhJTOyYTO4YmNmlTZiwiIzkjN0czMxEDZmRmNyYmN5kjMjlDZihzMwMjZkVDMyEWZxETY1Q2N4IiOiYzNmZWZ0YWOjRmZiRTZzYTO4YjZkFjMmRWZhRmZ2cjMiwiI5ETNyMGNjBDMjVjY3EzY4QWZhJ2NjZDN0UTZ4UDZ4IWYjBDZ5UWM5IiOikDOkNTO0QTY1YWN2YWMlBTYyQTN2MWY3MzM3kjM5ATZis3W
unknown
—
—
whitelisted
3268
upfc.exe
GET
200
5.101.152.39:80
http://ilaila5b.beget.tech/L1nc0In.php?s0jmCuWPDjuoWw=L9KRVr9BF389p62In&rPXXuGBe2qvgd2TXye=A1ttzdtDurTKbGGoh&xOEP1=TPiaGqRIYmnp8gh4BCQwjfUaWN&e44c84955770ba4dea01386fb157c5b8=ykTY5MzY5EDOlZWM3YDOiBTM3kTY1MzYyEWOiJGO1kDZzkDZ1YTYjhDN5gTNzADM1YTO5MjM&88eb947e6952cd9a1c902d41737c10e1=wNyMTNzYDZlZ2M1MTNhNWOlljM1cjYyEmZ2UmMyUGNlhDZxIDO5M2N&e82648b7e239fb037b863a234c855a0b=0VfiIiOiEDZjNjZzUzNzUTM2MzN4YzY3QDMhJTOyYTO4YmNmlTZiwiIlVTYkVWOiRmYxMzYlBTOzI2M0MTMlljZ1U2YkJzM0EDOhRWYwIjNkJiOiYzNmZWZ0YWOjRmZiRTZzYTO4YjZkFjMmRWZhRmZ2cjMiwiI5ETNyMGNjBDMjVjY3EzY4QWZhJ2NjZDN0UTZ4UDZ4IWYjBDZ5UWM5IiOikDOkNTO0QTY1YWN2YWMlBTYyQTN2MWY3MzM3kjM5ATZis3W
unknown
—
—
whitelisted
3268
upfc.exe
GET
200
5.101.152.39:80
http://ilaila5b.beget.tech/L1nc0In.php?s0jmCuWPDjuoWw=L9KRVr9BF389p62In&rPXXuGBe2qvgd2TXye=A1ttzdtDurTKbGGoh&xOEP1=TPiaGqRIYmnp8gh4BCQwjfUaWN&e44c84955770ba4dea01386fb157c5b8=ykTY5MzY5EDOlZWM3YDOiBTM3kTY1MzYyEWOiJGO1kDZzkDZ1YTYjhDN5gTNzADM1YTO5MjM&88eb947e6952cd9a1c902d41737c10e1=wNyMTNzYDZlZ2M1MTNhNWOlljM1cjYyEmZ2UmMyUGNlhDZxIDO5M2N&d9da068033c99aa20cc01c6d3c438ff5=0VfikjSDRme5cUY5Z1RaBnWzIWeC5mYwZ0RhREeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS1R2MiVHdtJmVKl2TplEWapnVWJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTS5pVdGdEV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSvJFWZFVMXlFbSNTVpdXaJZHbHpVMGVUSzsmeKRkRFlkcWdEZzZ0VaNlQTxUenNUS1xWRJxWNXFWT1cEW5hnVkJkQ55UNjlXUCJUehxmUIJGaW1WVnBTaN9WQTpVd5cUY3lTbjpGbXRVavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEDZjNjZzUzNzUTM2MzN4YzY3QDMhJTOyYTO4YmNmlTZiwiIlVTYkVWOiRmYxMzYlBTOzI2M0MTMlljZ1U2YkJzM0EDOhRWYwIjNkJiOiYzNmZWZ0YWOjRmZiRTZzYTO4YjZkFjMmRWZhRmZ2cjMiwiI5ETNyMGNjBDMjVjY3EzY4QWZhJ2NjZDN0UTZ4UDZ4IWYjBDZ5UWM5IiOikDOkNTO0QTY1YWN2YWMlBTYyQTN2MWY3MzM3kjM5ATZis3W
unknown
—
—
whitelisted
3268
upfc.exe
GET
200
5.101.152.39:80
http://ilaila5b.beget.tech/L1nc0In.php?s0jmCuWPDjuoWw=L9KRVr9BF389p62In&rPXXuGBe2qvgd2TXye=A1ttzdtDurTKbGGoh&xOEP1=TPiaGqRIYmnp8gh4BCQwjfUaWN&e44c84955770ba4dea01386fb157c5b8=ykTY5MzY5EDOlZWM3YDOiBTM3kTY1MzYyEWOiJGO1kDZzkDZ1YTYjhDN5gTNzADM1YTO5MjM&88eb947e6952cd9a1c902d41737c10e1=wNyMTNzYDZlZ2M1MTNhNWOlljM1cjYyEmZ2UmMyUGNlhDZxIDO5M2N&e82648b7e239fb037b863a234c855a0b=d1nIVtGVQJFMJJiOiEDZjNjZzUzNzUTM2MzN4YzY3QDMhJTOyYTO4YmNmlTZiwiIiZWO3cTM5EDZxcTO3EmYkNWO3UGZmRmY3MDOjRTOkNDO2UTMlFzMjJiOiYzNmZWZ0YWOjRmZiRTZzYTO4YjZkFjMmRWZhRmZ2cjMiwiI5ETNyMGNjBDMjVjY3EzY4QWZhJ2NjZDN0UTZ4UDZ4IWYjBDZ5UWM5IiOikDOkNTO0QTY1YWN2YWMlBTYyQTN2MWY3MzM3kjM5ATZis3W
unknown
—
—
whitelisted
3268
upfc.exe
POST
200
5.101.152.39:80
http://ilaila5b.beget.tech/L1nc0In.php?s0jmCuWPDjuoWw=L9KRVr9BF389p62In&rPXXuGBe2qvgd2TXye=A1ttzdtDurTKbGGoh&xOEP1=TPiaGqRIYmnp8gh4BCQwjfUaWN&e44c84955770ba4dea01386fb157c5b8=ykTY5MzY5EDOlZWM3YDOiBTM3kTY1MzYyEWOiJGO1kDZzkDZ1YTYjhDN5gTNzADM1YTO5MjM&88eb947e6952cd9a1c902d41737c10e1=wNyMTNzYDZlZ2M1MTNhNWOlljM1cjYyEmZ2UmMyUGNlhDZxIDO5M2N
unknown
—
—
whitelisted
3268
upfc.exe
POST
200
5.101.152.39:80
http://ilaila5b.beget.tech/L1nc0In.php?s0jmCuWPDjuoWw=L9KRVr9BF389p62In&rPXXuGBe2qvgd2TXye=A1ttzdtDurTKbGGoh&xOEP1=TPiaGqRIYmnp8gh4BCQwjfUaWN&e44c84955770ba4dea01386fb157c5b8=ykTY5MzY5EDOlZWM3YDOiBTM3kTY1MzYyEWOiJGO1kDZzkDZ1YTYjhDN5gTNzADM1YTO5MjM&88eb947e6952cd9a1c902d41737c10e1=wNyMTNzYDZlZ2M1MTNhNWOlljM1cjYyEmZ2UmMyUGNlhDZxIDO5M2N
unknown
—
—
whitelisted
3268
upfc.exe
GET
200
5.101.152.39:80
http://ilaila5b.beget.tech/L1nc0In.php?s0jmCuWPDjuoWw=L9KRVr9BF389p62In&rPXXuGBe2qvgd2TXye=A1ttzdtDurTKbGGoh&xOEP1=TPiaGqRIYmnp8gh4BCQwjfUaWN&e44c84955770ba4dea01386fb157c5b8=ykTY5MzY5EDOlZWM3YDOiBTM3kTY1MzYyEWOiJGO1kDZzkDZ1YTYjhDN5gTNzADM1YTO5MjM&88eb947e6952cd9a1c902d41737c10e1=wNyMTNzYDZlZ2M1MTNhNWOlljM1cjYyEmZ2UmMyUGNlhDZxIDO5M2N&a4a6f298269db9e9972f8934db832b73=d1nIzgTZ4U2Y1ImZxkTYxYjNwMjNzQzNiRDZkJmZ5EjYwMTY3YjNwIDOzIiOiYzNmZWZ0YWOjRmZiRTZzYTO4YjZkFjMmRWZhRmZ2cjMiwiI5ETNyMGNjBDMjVjY3EzY4QWZhJ2NjZDN0UTZ4UDZ4IWYjBDZ5UWM5IiOikDOkNTO0QTY1YWN2YWMlBTYyQTN2MWY3MzM3kjM5ATZis3W&e82648b7e239fb037b863a234c855a0b=0VfiIiOiEDZjNjZzUzNzUTM2MzN4YzY3QDMhJTOyYTO4YmNmlTZiwiIzgTZ4U2Y1ImZxkTYxYjNwMjNzQzNiRDZkJmZ5EjYwMTY3YjNwIDOzIiOiYzNmZWZ0YWOjRmZiRTZzYTO4YjZkFjMmRWZhRmZ2cjMiwiI5ETNyMGNjBDMjVjY3EzY4QWZhJ2NjZDN0UTZ4UDZ4IWYjBDZ5UWM5IiOikDOkNTO0QTY1YWN2YWMlBTYyQTN2MWY3MzM3kjM5ATZisHL9JCMY5kNJNEZxkzVaRHbHZ1dWdlWz5EbJNXSTplMsdEZqZ0aJZTS5NWMShVWw4kVlBDbtRGcSNTWCp0QMlWSYplbG1mYoFTRJRnRtNmb502YRpUaPl2YzI2a1cVYYJVMRJkSDxUa0sWS2k0UihmTtlFbkFzYwp0QMl2aslkNJNlW1lzRhdXOtNmasdFV6xWbJNXSTtUdkNjY1RXbiZFaDlUdkNjY1RXbiZlSp9UaVdlYoVTVWFlTrl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUktWSzlUaUl2bqlUdsdlYrZEMjBnSDxUaJl2TpNWVRVlSDxUaRhVYDJ0QOJTQTples12Y3pEWaBTNXJ1ZBRVTn10MkZnUtJGckxWS2kUajxmWsJGckxWSzBjbJVnVyoFao1mYsJ0MiRUOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUaz12YoFTbixmUFlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJJzaq5UM0kWT4d3QONTWqxUMVpWS2kUeZZHetl0cJl3UFpUaPl2auNGM1cFZ25UbJNXSpJmdsJjWspkRJNnRHRGcChVWEpUaPlGNyIGckdlW5p0QMlGNXplbGdUY1Z1RjZnTrlkNJNVZwwmMZl2dpl0MZpGTzElaMpXQq1UdVR0Tp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS1x2VitmRtlkNJNlW0ZUbUlnVyMmVKNETpFVRUtEeFRFSwVFTRlTRWxkTWJVRKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEDZjNjZzUzNzUTM2MzN4YzY3QDMhJTOyYTO4YmNmlTZiwiIzkjN0czMxEDZmRmNyYmN5kjMjlDZihzMwMjZkVDMyEWZxETY1Q2N4IiOiYzNmZWZ0YWOjRmZiRTZzYTO4YjZkFjMmRWZhRmZ2cjMiwiI5ETNyMGNjBDMjVjY3EzY4QWZhJ2NjZDN0UTZ4UDZ4IWYjBDZ5UWM5IiOikDOkNTO0QTY1YWN2YWMlBTYyQTN2MWY3MzM3kjM5ATZis3W
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
20.7.2.167:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.25
whitelisted
google.com
  • 142.250.186.142
whitelisted
client.wns.windows.com
  • 20.7.2.167
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.64
  • 40.126.31.130
  • 40.126.31.131
  • 40.126.31.2
  • 20.190.159.73
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
ilaila5b.beget.tech
  • 5.101.152.39
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
3268
upfc.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
3268
upfc.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3268
upfc.exe
A Network Trojan was detected
ET MALWARE Possible Windows executable sent when remote host claims to send html content
3268
upfc.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Nurik.exe