File name:

nuker.exe

Full analysis: https://app.any.run/tasks/c25e99a1-e78f-4a38-b8cd-d3a6aa491759
Verdict: Malicious activity
Threats:

Exela Stealer is an infostealer malware written in Python. It is capable of collecting a wide range of sensitive information from compromised systems and exfiltrating it to attackers over Discord. It is frequently used to steal browser data, and obtain session files from various applications, including gaming platforms, social media platforms, and messaging apps.

Malware Trends Tracker     >>>
Analysis date: April 13, 2025, 17:59:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
stealer
evasion
exela
discord
screenshot
pyinstaller
susp-powershell
ims-api
generic
discordgrabber
growtopia
upx
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

86F16EA4E8118A29B3D14E379C923AAC

SHA1:

A2C482FA274F12F4E32A0BCD32A5648A784A21CA

SHA256:

86C2BFA1421C2103E72217C27A8C5A9D6D8DF4DE533125B1C8AF362097D5A0D1

SSDEEP:

196608:EtMyz9vmA0g6ahC2qeX9Q+LrnoccGJfv9C9+12CGqzaxAtTQkZc:CMyz936a6WPrJcQu+1YoT3i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • dfwx.exe (PID: 6388)

    • Steals credentials from Web Browsers

      • dfwx.exe (PID: 6388)

    • ExelaStealer has been detected

      • dfwx.exe (PID: 6388)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 632)
      • net.exe (PID: 6564)
      • net.exe (PID: 1628)
      • net.exe (PID: 6080)

    • Starts NET.EXE to view/change users localgroup

      • net.exe (PID: 6972)
      • cmd.exe (PID: 632)
      • net.exe (PID: 6620)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 6572)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4212)

    • GROWTOPIA has been detected (YARA)

      • dfwx.exe (PID: 6388)

    • DISCORDGRABBER has been detected (YARA)

      • dfwx.exe (PID: 6388)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • nuker.exe (PID: 516)
      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)
      • csc.exe (PID: 1128)

    • Reads security settings of Internet Explorer

      • nuker.exe (PID: 516)

    • The process drops C-runtime libraries

      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)

    • Process drops legitimate windows executable

      • nuker.exe (PID: 516)
      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)

    • Starts a Microsoft application from unusual location

      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)

    • Application launched itself

      • dfwx.exe (PID: 1056)
      • rainy.exe (PID: 3100)
      • cmd.exe (PID: 6592)
      • cmd.exe (PID: 6752)

    • Loads Python modules

      • dfwx.exe (PID: 6388)
      • rainy.exe (PID: 2692)

    • Get information on the list of running processes

      • dfwx.exe (PID: 6388)
      • cmd.exe (PID: 6512)
      • cmd.exe (PID: 616)
      • cmd.exe (PID: 2984)
      • cmd.exe (PID: 632)

    • Reads the date of Windows installation

      • nuker.exe (PID: 516)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 3020)
      • WMIC.exe (PID: 5596)
      • WMIC.exe (PID: 4996)

    • Starts CMD.EXE for commands execution

      • dfwx.exe (PID: 6388)
      • rainy.exe (PID: 2692)
      • cmd.exe (PID: 6752)
      • cmd.exe (PID: 6592)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 4996)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 5956)
      • cmd.exe (PID: 5332)
      • cmd.exe (PID: 5156)

    • Process drops python dynamic module

      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1628)
      • cmd.exe (PID: 6572)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 2432)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 5156)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 632)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • dfwx.exe (PID: 6388)

    • Uses QUSER.EXE to read information about current user sessions

      • query.exe (PID: 5528)

    • Uses WMIC.EXE to obtain commands that are run when users log in

      • cmd.exe (PID: 632)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 632)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 632)

    • Uses WMIC.EXE to obtain local storage devices information

      • cmd.exe (PID: 632)

    • Windows service management via SC.EXE

      • sc.exe (PID: 904)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 632)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 632)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 6572)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6572)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 632)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • dfwx.exe (PID: 6388)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 1128)

    • Captures screenshot (POWERSHELL)

      • powershell.exe (PID: 4212)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 6572)

    • Multiple wallet extension IDs have been found

      • dfwx.exe (PID: 6388)

  • INFO

    • Checks supported languages

      • nuker.exe (PID: 516)
      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)
      • rainy.exe (PID: 2692)
      • chcp.com (PID: 6656)
      • chcp.com (PID: 6480)
      • cvtres.exe (PID: 5256)
      • csc.exe (PID: 1128)

    • Reads the computer name

      • rainy.exe (PID: 3100)
      • nuker.exe (PID: 516)
      • dfwx.exe (PID: 1056)
      • dfwx.exe (PID: 6388)

    • Reads the machine GUID from the registry

      • nuker.exe (PID: 516)
      • csc.exe (PID: 1128)

    • The sample compiled with english language support

      • nuker.exe (PID: 516)
      • dfwx.exe (PID: 1056)
      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 6388)

    • Process checks computer location settings

      • nuker.exe (PID: 516)

    • Create files in a temporary directory

      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • nuker.exe (PID: 516)
      • dfwx.exe (PID: 6388)
      • csc.exe (PID: 1128)
      • cvtres.exe (PID: 5256)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 3020)
      • WMIC.exe (PID: 1188)
      • WMIC.exe (PID: 5156)
      • WMIC.exe (PID: 5596)
      • WMIC.exe (PID: 4996)

    • Creates files or folders in the user directory

      • dfwx.exe (PID: 6388)

    • The Powershell gets current clipboard

      • powershell.exe (PID: 616)

    • Changes the display of characters in the console

      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 7020)

    • Checks operating system version

      • dfwx.exe (PID: 6388)

    • Reads the time zone

      • net1.exe (PID: 780)
      • net1.exe (PID: 2240)

    • Prints a route via ROUTE.EXE

      • ROUTE.EXE (PID: 4212)

    • PyInstaller has been detected (YARA)

      • rainy.exe (PID: 3100)
      • dfwx.exe (PID: 1056)
      • rainy.exe (PID: 2692)
      • dfwx.exe (PID: 6388)

    • Attempting to use instant messaging service

      • dfwx.exe (PID: 6388)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • dfwx.exe (PID: 6388)

    • Application based on Rust

      • dfwx.exe (PID: 6388)

    • Checks proxy server information

      • slui.exe (PID: 6576)

    • Reads the software policy settings

      • slui.exe (PID: 6576)

    • UPX packer has been detected

      • dfwx.exe (PID: 6388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(6388) dfwx.exe
Discord-Webhook-Tokens (1)1353770225698345061/mPWJshRknHagamtzBrVDrXPpWdCRgQR9IuXeVaLyCuT7PdesoxhG7rhmzvroWsa7lGlg
Discord-Info-Links
1353770225698345061/mPWJshRknHagamtzBrVDrXPpWdCRgQR9IuXeVaLyCuT7PdesoxhG7rhmzvroWsa7lGlg
Get Webhook Infohttps://discord.com/api/webhooks/1353770225698345061/mPWJshRknHagamtzBrVDrXPpWdCRgQR9IuXeVaLyCuT7PdesoxhG7rhmzvroWsa7lGlg
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:28 17:46:00+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 25698816
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x18841ee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: nuker.exe
LegalCopyright:
OriginalFileName: nuker.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
198
Monitored processes
76
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start nuker.exe rainy.exe conhost.exe no specs dfwx.exe #EXELASTEALER dfwx.exe rainy.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs powershell.exe no specs chcp.com no specs chcp.com no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs systeminfo.exe no specs svchost.exe tiworker.exe no specs hostname.exe no specs wmic.exe no specs net.exe no specs net1.exe no specs query.exe no specs quser.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs wmic.exe no specs tasklist.exe no specs ipconfig.exe no specs route.exe no specs arp.exe no specs netstat.exe no specs sc.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Users\admin\Desktop\nuker.exe" C:\Users\admin\Desktop\nuker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\nuker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
616C:\WINDOWS\system32\cmd.exe /c "tasklist"C:\Windows\System32\cmd.exe—dfwx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
616powershell.exe Get-ClipboardC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
616C:\WINDOWS\system32\net1 localgroup administrators C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
632C:\WINDOWS\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"C:\Windows\System32\cmd.exe—dfwx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
660arp -a C:\Windows\System32\ARP.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Arp Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\arp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\iphlpapi.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780C:\WINDOWS\system32\net1 user guest C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
904sc query type= service state= all C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
27 910
Read events
27 908
Write events
2
Delete events
0

Modification events

(PID) Process:(7152) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31173789
(PID) Process:(7152) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
Executable files
60
Suspicious files
39
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_ctypes.pydexecutable
MD5:6A9CA97C039D9BBB7ABF40B53C851198
SHA256:E662D2B35BB48C5F3432BDE79C0D20313238AF800968BA0FAA6EA7E7E5EF4535
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\VCRUNTIME140.dllexecutable
MD5:F12681A472B9DD04A812E16096514974
SHA256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_cffi_backend.cp311-win_amd64.pydexecutable
MD5:739D352BD982ED3957D376A9237C9248
SHA256:9AEE90CF7980C8FF694BB3FFE06C71F87EB6A613033F73E3174A732648D39980
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_bz2.pydexecutable
MD5:4101128E19134A4733028CFAAFC2F3BB
SHA256:5843872D5E2B08F138A71FE9BA94813AFEE59C8B48166D4A8EB0F606107A7E80
1056dfwx.exeC:\Users\admin\AppData\Local\Temp\_MEI10562\_bz2.pydexecutable
MD5:80C69A1D87F0C82D6C4268E5A8213B78
SHA256:307359F1B2552B60839385EB63D74CBFE75CD5EFDB4E7CD0BB7D296FA67D8A87
1056dfwx.exeC:\Users\admin\AppData\Local\Temp\_MEI10562\_asyncio.pydexecutable
MD5:1B8CE772A230A5DA8CBDCCD8914080A5
SHA256:FA5A1E7031DE5849AB2AB5A177E366B41E1DF6BBD90C8D2418033A01C740771F
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_decimal.pydexecutable
MD5:D47E6ACF09EAD5774D5B471AB3AB96FF
SHA256:D0DF57988A74ACD50B2D261E8B5F2C25DA7B940EC2AAFBEE444C277552421E6E
3100rainy.exeC:\Users\admin\AppData\Local\Temp\_MEI31002\_lzma.pydexecutable
MD5:337B0E65A856568778E25660F77BC80A
SHA256:613DE58E4A9A80EFF8F8BC45C350A6EAEBF89F85FFD2D7E3B0B266BF0888A60A
516nuker.exeC:\Users\admin\AppData\Local\Temp\dfwx.exeexecutable
MD5:FE56A37AD91C2EA626459621345EC7B2
SHA256:538B368FCCBF6A5146F49F07575E20EC56584C9DD53B2D29D7404665FFDF2541
1056dfwx.exeC:\Users\admin\AppData\Local\Temp\_MEI10562\VCRUNTIME140.dllexecutable
MD5:F12681A472B9DD04A812E16096514974
SHA256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
47
DNS requests
18
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
6388
dfwx.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2644
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2644
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2644
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2644
SIHClient.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
2644
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
2644
SIHClient.exe
GET
200
23.48.23.183:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6388
dfwx.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6388
dfwx.exe
162.159.128.233:443
discord.com
CLOUDFLARENET
—
whitelisted
2644
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2644
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 23.48.23.183
  • 23.48.23.193
  • 23.48.23.181
  • 23.48.23.137
  • 23.48.23.138
  • 23.48.23.194
  • 23.48.23.180
  • 23.48.23.140
  • 23.48.23.177
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
discord.com
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.135.232
  • 162.159.136.232
  • 162.159.138.232
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
api.gofile.io
  • 51.91.7.6
  • 45.112.123.126
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6388
dfwx.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6388
dfwx.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
6388
dfwx.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
—
—
Misc activity
ET HUNTING Discord WebHook Activity M2 (Contains Key, embeds)
6388
dfwx.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
6388
dfwx.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nuker.exe