File name:

nuker.exe

Full analysis: https://app.any.run/tasks/c25e99a1-e78f-4a38-b8cd-d3a6aa491759
Verdict: Malicious activity
Threats:

Exela Stealer is an infostealer malware written in Python. It is capable of collecting a wide range of sensitive information from compromised systems and exfiltrating it to attackers over Discord. It is frequently used to steal browser data, and obtain session files from various applications, including gaming platforms, social media platforms, and messaging apps.

Malware Trends Tracker     >>>
Analysis date: April 13, 2025, 17:59:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
stealer
evasion
exela
discord
screenshot
pyinstaller
susp-powershell
ims-api
generic
discordgrabber
growtopia
upx
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

86F16EA4E8118A29B3D14E379C923AAC

SHA1:

A2C482FA274F12F4E32A0BCD32A5648A784A21CA

SHA256:

86C2BFA1421C2103E72217C27A8C5A9D6D8DF4DE533125B1C8AF362097D5A0D1

SSDEEP:

196608:EtMyz9vmA0g6ahC2qeX9Q+LrnoccGJfv9C9+12CGqzaxAtTQkZc:CMyz936a6WPrJcQu+1YoT3i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • dfwx.exe (PID: 6388)

    • Actions looks like stealing of personal data

      • dfwx.exe (PID: 6388)

    • ExelaStealer has been detected

      • dfwx.exe (PID: 6388)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 632)
      • net.exe (PID: 6564)
      • net.exe (PID: 6080)
      • net.exe (PID: 1628)

    • Starts NET.EXE to view/change users localgroup

      • cmd.exe (PID: 632)
      • net.exe (PID: 6972)
      • net.exe (PID: 6620)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4212)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 6572)

    • DISCORDGRABBER has been detected (YARA)

      • dfwx.exe (PID: 6388)

    • GROWTOPIA has been detected (YARA)

      • dfwx.exe (PID: 6388)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • nuker.exe (PID: 516)

    • Reads the date of Windows installation

      • nuker.exe (PID: 516)

    • Process drops legitimate windows executable

      • nuker.exe (PID: 516)
      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)

    • Executable content was dropped or overwritten

      • nuker.exe (PID: 516)
      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)
      • csc.exe (PID: 1128)

    • The process drops C-runtime libraries

      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)

    • Starts a Microsoft application from unusual location

      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 5956)
      • cmd.exe (PID: 5332)
      • cmd.exe (PID: 5156)

    • Process drops python dynamic module

      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)

    • Loads Python modules

      • dfwx.exe (PID: 6388)
      • rainy.exe (PID: 2692)

    • Application launched itself

      • dfwx.exe (PID: 1056)
      • rainy.exe (PID: 3100)
      • cmd.exe (PID: 6592)
      • cmd.exe (PID: 6752)

    • Get information on the list of running processes

      • dfwx.exe (PID: 6388)
      • cmd.exe (PID: 616)
      • cmd.exe (PID: 6512)
      • cmd.exe (PID: 2984)
      • cmd.exe (PID: 632)

    • Starts CMD.EXE for commands execution

      • rainy.exe (PID: 2692)
      • dfwx.exe (PID: 6388)
      • cmd.exe (PID: 6752)
      • cmd.exe (PID: 6592)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 3020)
      • WMIC.exe (PID: 5596)
      • WMIC.exe (PID: 4996)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 4996)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 2432)

    • Checks for external IP

      • dfwx.exe (PID: 6388)
      • svchost.exe (PID: 2196)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 5156)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 632)

    • Uses WMIC.EXE to obtain local storage devices information

      • cmd.exe (PID: 632)

    • Uses QUSER.EXE to read information about current user sessions

      • query.exe (PID: 5528)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1628)
      • cmd.exe (PID: 6572)

    • Uses WMIC.EXE to obtain commands that are run when users log in

      • cmd.exe (PID: 632)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 632)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 632)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 632)

    • Windows service management via SC.EXE

      • sc.exe (PID: 904)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 632)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 632)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 6572)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6572)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 1128)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 6572)

    • Captures screenshot (POWERSHELL)

      • powershell.exe (PID: 4212)

    • Multiple wallet extension IDs have been found

      • dfwx.exe (PID: 6388)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • dfwx.exe (PID: 6388)

  • INFO

    • Reads the machine GUID from the registry

      • nuker.exe (PID: 516)
      • csc.exe (PID: 1128)

    • Checks supported languages

      • nuker.exe (PID: 516)
      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)
      • rainy.exe (PID: 2692)
      • chcp.com (PID: 6480)
      • chcp.com (PID: 6656)
      • cvtres.exe (PID: 5256)
      • csc.exe (PID: 1128)

    • Reads the computer name

      • rainy.exe (PID: 3100)
      • nuker.exe (PID: 516)
      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)

    • Create files in a temporary directory

      • nuker.exe (PID: 516)
      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)
      • cvtres.exe (PID: 5256)
      • csc.exe (PID: 1128)

    • The sample compiled with english language support

      • nuker.exe (PID: 516)
      • dfwx.exe (PID: 1056)
      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 6388)

    • Process checks computer location settings

      • nuker.exe (PID: 516)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 3020)
      • WMIC.exe (PID: 1188)
      • WMIC.exe (PID: 5156)
      • WMIC.exe (PID: 5596)
      • WMIC.exe (PID: 4996)

    • Creates files or folders in the user directory

      • dfwx.exe (PID: 6388)

    • The Powershell gets current clipboard

      • powershell.exe (PID: 616)

    • Changes the display of characters in the console

      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 7020)

    • Checks operating system version

      • dfwx.exe (PID: 6388)

    • Reads the time zone

      • net1.exe (PID: 780)
      • net1.exe (PID: 2240)

    • Prints a route via ROUTE.EXE

      • ROUTE.EXE (PID: 4212)

    • PyInstaller has been detected (YARA)

      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • rainy.exe (PID: 2692)
      • dfwx.exe (PID: 6388)

    • Attempting to use instant messaging service

      • dfwx.exe (PID: 6388)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • dfwx.exe (PID: 6388)

    • UPX packer has been detected

      • dfwx.exe (PID: 6388)

    • Application based on Rust

      • dfwx.exe (PID: 6388)

    • Checks proxy server information

      • slui.exe (PID: 6576)

    • Reads the software policy settings

      • slui.exe (PID: 6576)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(6388) dfwx.exe
Discord-Webhook-Tokens (1)1353770225698345061/mPWJshRknHagamtzBrVDrXPpWdCRgQR9IuXeVaLyCuT7PdesoxhG7rhmzvroWsa7lGlg
Discord-Info-Links
1353770225698345061/mPWJshRknHagamtzBrVDrXPpWdCRgQR9IuXeVaLyCuT7PdesoxhG7rhmzvroWsa7lGlg
Get Webhook Infohttps://discord.com/api/webhooks/1353770225698345061/mPWJshRknHagamtzBrVDrXPpWdCRgQR9IuXeVaLyCuT7PdesoxhG7rhmzvroWsa7lGlg
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:28 17:46:00+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 25698816
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x18841ee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: nuker.exe
LegalCopyright:
OriginalFileName: nuker.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
198
Monitored processes
76
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start nuker.exe rainy.exe conhost.exe no specs dfwx.exe #EXELASTEALER dfwx.exe rainy.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs powershell.exe no specs chcp.com no specs chcp.com no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs systeminfo.exe no specs svchost.exe tiworker.exe no specs hostname.exe no specs wmic.exe no specs net.exe no specs net1.exe no specs query.exe no specs quser.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs wmic.exe no specs tasklist.exe no specs ipconfig.exe no specs route.exe no specs arp.exe no specs netstat.exe no specs sc.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Users\admin\Desktop\nuker.exe" C:\Users\admin\Desktop\nuker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\nuker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
616C:\WINDOWS\system32\cmd.exe /c "tasklist"C:\Windows\System32\cmd.exe—dfwx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
616powershell.exe Get-ClipboardC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
616C:\WINDOWS\system32\net1 localgroup administrators C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
632C:\WINDOWS\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"C:\Windows\System32\cmd.exe—dfwx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
660arp -a C:\Windows\System32\ARP.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Arp Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\arp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\iphlpapi.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780C:\WINDOWS\system32\net1 user guest C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
904sc query type= service state= all C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
27 910
Read events
27 908
Write events
2
Delete events
0

Modification events

(PID) Process:(7152) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31173789
(PID) Process:(7152) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
Executable files
60
Suspicious files
39
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
516nuker.exeC:\Users\admin\AppData\Local\Temp\rainy.exeexecutable
MD5:B1558352F2E971929693AEE887A16B87
SHA256:628363695D45AE82465D6DCCF04C2A7C5481C4659C45866EADAB542FB71C06BA
1056dfwx.exeC:\Users\admin\AppData\Local\Temp\_MEI10562\_asyncio.pydexecutable
MD5:1B8CE772A230A5DA8CBDCCD8914080A5
SHA256:FA5A1E7031DE5849AB2AB5A177E366B41E1DF6BBD90C8D2418033A01C740771F
1056dfwx.exeC:\Users\admin\AppData\Local\Temp\_MEI10562\VCRUNTIME140.dllexecutable
MD5:F12681A472B9DD04A812E16096514974
SHA256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
516nuker.exeC:\Users\admin\AppData\Local\Temp\dfwx.exeexecutable
MD5:FE56A37AD91C2EA626459621345EC7B2
SHA256:538B368FCCBF6A5146F49F07575E20EC56584C9DD53B2D29D7404665FFDF2541
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_lzma.pydexecutable
MD5:337B0E65A856568778E25660F77BC80A
SHA256:613DE58E4A9A80EFF8F8BC45C350A6EAEBF89F85FFD2D7E3B0B266BF0888A60A
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_ctypes.pydexecutable
MD5:6A9CA97C039D9BBB7ABF40B53C851198
SHA256:E662D2B35BB48C5F3432BDE79C0D20313238AF800968BA0FAA6EA7E7E5EF4535
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_bz2.pydexecutable
MD5:4101128E19134A4733028CFAAFC2F3BB
SHA256:5843872D5E2B08F138A71FE9BA94813AFEE59C8B48166D4A8EB0F606107A7E80
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_asyncio.pydexecutable
MD5:2859C39887921DAD2FF41FEDA44FE174
SHA256:AEBC378DB08617EA81A0A3A3BC044BCC7E6303E314630392DD51BAB12F879BD9
1056dfwx.exeC:\Users\admin\AppData\Local\Temp\_MEI10562\_decimal.pydexecutable
MD5:E9501519A447B13DCCA19E09140C9E84
SHA256:6B5FE2DEA13B84E40B0278D1702AA29E9E2091F9DC09B64BBFF5FD419A604C3C
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_multiprocessing.pydexecutable
MD5:1386DBC6DCC5E0BE6FEF05722AE572EC
SHA256:0AE3BF383FF998886F97576C55D6BF0A076C24395CF6FCD2265316E9A6E8C007
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
47
DNS requests
18
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6388
dfwx.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2644
SIHClient.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
2644
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2644
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
unknown
2644
SIHClient.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
—
—
GET
200
4.245.163.56:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
unknown
2644
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6388
dfwx.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6388
dfwx.exe
162.159.128.233:443
discord.com
CLOUDFLARENET
—
whitelisted
2644
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2644
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 23.48.23.183
  • 23.48.23.193
  • 23.48.23.181
  • 23.48.23.137
  • 23.48.23.138
  • 23.48.23.194
  • 23.48.23.180
  • 23.48.23.140
  • 23.48.23.177
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
discord.com
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.135.232
  • 162.159.136.232
  • 162.159.138.232
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
api.gofile.io
  • 51.91.7.6
  • 45.112.123.126
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6388
dfwx.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6388
dfwx.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
6388
dfwx.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
—
—
Misc activity
ET HUNTING Discord WebHook Activity M2 (Contains Key, embeds)
6388
dfwx.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
6388
dfwx.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nuker.exe