File name:

encryptor.exe

Full analysis: https://app.any.run/tasks/4303bcce-9773-4319-93d7-30cfa901b3a1
Verdict: Malicious activity
Analysis date: May 28, 2025, 00:59:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

AD2C1142C52EB03D182645364E7E87E2

SHA1:

6C9A118E5FF1B8D3CA72915FB83B4FBAAD97D928

SHA256:

C25ABD3F13EA5E98A8C3F433F7251DA497BDEE60321D67CDC07BB2B24B0BA2FB

SSDEEP:

196608:7oxtYJFrFcwyK3TeRi/Bqannpet/eSgdVz:eYPpjyK3KRi5q8KeSgj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • encryptor.exe (PID: 6728)

    • Process drops legitimate windows executable

      • encryptor.exe (PID: 6728)

    • Process drops python dynamic module

      • encryptor.exe (PID: 6728)

    • Application launched itself

      • encryptor.exe (PID: 6728)

    • Starts CMD.EXE for commands execution

      • encryptor.exe (PID: 1072)

    • Loads Python modules

      • encryptor.exe (PID: 1072)

    • Modifies hosts file to alter network resolution

      • encryptor.exe (PID: 1072)

    • Creates files in the driver directory

      • encryptor.exe (PID: 1072)

    • Executable content was dropped or overwritten

      • encryptor.exe (PID: 6728)

  • INFO

    • Create files in a temporary directory

      • encryptor.exe (PID: 6728)
      • encryptor.exe (PID: 1072)

    • The sample compiled with english language support

      • encryptor.exe (PID: 6728)

    • Checks supported languages

      • encryptor.exe (PID: 6728)
      • encryptor.exe (PID: 1072)

    • Reads the computer name

      • encryptor.exe (PID: 1072)
      • encryptor.exe (PID: 6728)

    • Checks operating system version

      • encryptor.exe (PID: 1072)

    • Application launched itself

      • firefox.exe (PID: 4920)
      • firefox.exe (PID: 6516)

    • Manual execution by a user

      • firefox.exe (PID: 6516)
      • notepad++.exe (PID: 6032)

    • Reads the software policy settings

      • slui.exe (PID: 5212)
      • slui.exe (PID: 6744)

    • Checks proxy server information

      • slui.exe (PID: 5212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:28 00:52:47+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 178688
InitializedDataSize: 153600
UninitializedDataSize: -
EntryPoint: 0xc380
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
25
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start encryptor.exe conhost.exe no specs encryptor.exe no specs cmd.exe no specs sppextcomobj.exe no specs slui.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs rundll32.exe no specs slui.exe notepad++.exe no specs svchost.exe encryptor.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1072"C:\Users\admin\AppData\Local\Temp\encryptor.exe" C:\Users\admin\AppData\Local\Temp\encryptor.exe—encryptor.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\encryptor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4024"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4320 -childID 2 -isForBrowser -prefsHandle 4312 -prefMapHandle 4308 -prefsLen 36588 -prefMapSize 244583 -jsInitHandle 1544 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afc9f45b-2df7-4459-8eda-85f53143cb46} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 215a48e9a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4068"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2764 -childID 1 -isForBrowser -prefsHandle 2780 -prefMapHandle 2724 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1544 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {040f140f-a313-45e2-95a2-16892c1b0dcf} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 215a249ef50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
4448"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2144 -parentBuildID 20240213221259 -prefsHandle 2136 -prefMapHandle 2132 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b9e9c8a-9f33-49d0-a1c5-299f626cd6fe} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 2159087f510 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
4896"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1900 -parentBuildID 20240213221259 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2af1bb79-f298-45f4-9922-f3ddce77f05e} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 2159d7eab10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
4920"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5212C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5352\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—encryptor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5404C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
16 502
Read events
16 501
Write events
1
Delete events
0

Modification events

(PID) Process:(4920) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
Executable files
118
Suspicious files
200
Text files
49
Unknown types
1

Dropped files

PID
Process
Filename
Type
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_Salsa20.pydexecutable
MD5:5B855B3E838D9C7FAAD4BD736CF56D59
SHA256:7D1B252ADC643DEEB896430B58CF457436152351EB7FA043B4B24736C9EDF864
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_raw_arc2.pydexecutable
MD5:75A2D9A48DF773694E82534635BE7B9C
SHA256:B8D36C0ED8C994ED11F36B2ABC7D3C5116C215719BDC19C9596BB9E3FB811A4B
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_ARC4.pydexecutable
MD5:ABA0195EB33D86216170DCFF947DEBDB
SHA256:1F588A0D71C5378987FE05224493D85E93D02A52CE0B05809A06FC2BD489C325
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_pkcs1_decode.pydexecutable
MD5:68FD499C14CDDA49C5460E377410C30E
SHA256:48958204C0CC8412758C33FB4A970C87A83BE5A8A889959FE8831793D8102E06
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_raw_blowfish.pydexecutable
MD5:AAF446AAF23C92FAD7D41B82DAA6F03C
SHA256:0432E9CF535C5C50DFA6776777BA89A2076BBF2DC6DB0EFA6C84483F501B00E3
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_raw_aes.pydexecutable
MD5:3BD3AF4C84932CD1AB5A8084040A76F6
SHA256:437E89FD3DD47F5DEB6165F4F2A7F228CD415FB7F3D5DF5C1CB16A90044008CE
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_chacha20.pydexecutable
MD5:5298CA8A45BB3ADD1A03EC4CF8A46072
SHA256:D70795D5B6103AC1D81794D209085C573E4554A312CCD762CC5767AC98E5965C
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_raw_cbc.pydexecutable
MD5:A1B78A3CE3165E90957880B8724D944F
SHA256:84E071321E378054B6D3B56BBD66699E36554F637A44728B38B96A31199DFA69
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_raw_cast.pydexecutable
MD5:07D25B197C0E35BFD3C96550C5C64A6D
SHA256:FEFFAED6DBF10D4359DE74F6DA88C03C6A6B50D1568C5330343927E7797E3EC1
6728encryptor.exeC:\Users\admin\AppData\Local\Temp\_MEI67282\Crypto\Cipher\_raw_ofb.pydexecutable
MD5:4ED6D4B1B100384D13F25DFA3737FB78
SHA256:084E4B2DA2180AD2A2E96E8804A6F2FC37BCE6349EB8A5F6B182116B4D04BD82
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
113
DNS requests
136
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4920
firefox.exe
POST
200
142.250.185.163:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4920
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
4920
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
4920
firefox.exe
POST
200
2.16.206.143:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
4920
firefox.exe
POST
—
142.250.185.163:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
4920
firefox.exe
POST
200
142.250.185.163:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
4920
firefox.exe
POST
200
142.250.185.163:80
http://o.pki.goog/s/wr3/3H4
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4920
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
4920
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted
4920
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.143
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.0
  • 40.126.31.128
  • 40.126.31.0
  • 20.190.159.23
  • 40.126.31.3
  • 20.190.159.130
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted
example.org
  • 23.215.0.132
  • 23.215.0.133
  • 96.7.128.186
  • 96.7.128.192
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
encryptor.exe