File name:

d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505

Full analysis: https://app.any.run/tasks/117143a1-8b64-4af0-8250-2b6f6a8ec37f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:07:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
discordgrabber
generic
stealer
crypto-regex
ims-api
golang
ip-check
evasion
discord
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, 6 sections
MD5:

8DF1E0135851D1A0B66FBAA9BE282009

SHA1:

1B6523DC8DEA8E2F29E8D55819AC75B94DA9ACBF

SHA256:

D11EFAD7EBE520CCC9F682003D76EBFABD5D18B746A801FEFBF04317F7AE7505

SSDEEP:

98304:evrrXgwM0bczDuOVljU4E6wdYRPtGfXfyNLrb:e4wMaMuOVljukRPt1rb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DISCORDGRABBER has been detected (YARA)

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Actions looks like stealing of personal data

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Steals credentials from Web Browsers

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

  • SUSPICIOUS

    • Uses WMIC.EXE to obtain Windows Installer data

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 1912)
      • WMIC.exe (PID: 7012)
      • WMIC.exe (PID: 4024)
      • WMIC.exe (PID: 5528)
      • WMIC.exe (PID: 4620)
      • WMIC.exe (PID: 6872)
      • WMIC.exe (PID: 1056)
      • WMIC.exe (PID: 2800)
      • WMIC.exe (PID: 4980)
      • WMIC.exe (PID: 7052)
      • WMIC.exe (PID: 5048)
      • WMIC.exe (PID: 1628)
      • WMIC.exe (PID: 4988)
      • WMIC.exe (PID: 7036)
      • WMIC.exe (PID: 5968)
      • WMIC.exe (PID: 6800)
      • WMIC.exe (PID: 2320)
      • WMIC.exe (PID: 5680)
      • WMIC.exe (PID: 960)
      • WMIC.exe (PID: 7200)
      • WMIC.exe (PID: 5968)
      • WMIC.exe (PID: 5640)
      • WMIC.exe (PID: 1812)
      • WMIC.exe (PID: 4688)
      • WMIC.exe (PID: 4996)
      • WMIC.exe (PID: 6388)
      • WMIC.exe (PID: 7596)
      • WMIC.exe (PID: 7396)
      • WMIC.exe (PID: 7492)
      • WMIC.exe (PID: 7716)
      • WMIC.exe (PID: 7636)
      • WMIC.exe (PID: 7676)
      • WMIC.exe (PID: 7244)
      • WMIC.exe (PID: 7328)
      • WMIC.exe (PID: 7448)
      • WMIC.exe (PID: 7796)
      • WMIC.exe (PID: 7920)
      • WMIC.exe (PID: 7960)
      • WMIC.exe (PID: 8040)
      • WMIC.exe (PID: 8000)
      • WMIC.exe (PID: 8080)
      • WMIC.exe (PID: 7756)
      • WMIC.exe (PID: 7856)
      • WMIC.exe (PID: 7172)
      • WMIC.exe (PID: 8136)
      • WMIC.exe (PID: 8176)
      • WMIC.exe (PID: 7224)
      • WMIC.exe (PID: 7288)
      • WMIC.exe (PID: 7364)
      • WMIC.exe (PID: 2656)
      • WMIC.exe (PID: 6156)
      • WMIC.exe (PID: 7468)
      • WMIC.exe (PID: 7448)
      • WMIC.exe (PID: 7568)
      • WMIC.exe (PID: 4448)
      • WMIC.exe (PID: 900)
      • WMIC.exe (PID: 7396)
      • WMIC.exe (PID: 2100)
      • WMIC.exe (PID: 7740)
      • WMIC.exe (PID: 7780)
      • WMIC.exe (PID: 7840)
      • WMIC.exe (PID: 7816)
      • WMIC.exe (PID: 7548)
      • WMIC.exe (PID: 7904)
      • WMIC.exe (PID: 7948)
      • WMIC.exe (PID: 7624)
      • WMIC.exe (PID: 7664)
      • WMIC.exe (PID: 7700)
      • WMIC.exe (PID: 7984)
      • WMIC.exe (PID: 5964)
      • WMIC.exe (PID: 8028)
      • WMIC.exe (PID: 8044)
      • WMIC.exe (PID: 2772)
      • WMIC.exe (PID: 6752)
      • WMIC.exe (PID: 1240)
      • WMIC.exe (PID: 8160)
      • WMIC.exe (PID: 6964)
      • WMIC.exe (PID: 8084)
      • WMIC.exe (PID: 7380)
      • WMIC.exe (PID: 7372)
      • WMIC.exe (PID: 2908)
      • WMIC.exe (PID: 6712)
      • WMIC.exe (PID: 7484)
      • WMIC.exe (PID: 7268)
      • WMIC.exe (PID: 7216)
      • WMIC.exe (PID: 7260)
      • WMIC.exe (PID: 7340)
      • WMIC.exe (PID: 1628)
      • WMIC.exe (PID: 7428)
      • WMIC.exe (PID: 7564)
      • WMIC.exe (PID: 7768)
      • WMIC.exe (PID: 7664)
      • WMIC.exe (PID: 7808)
      • WMIC.exe (PID: 7580)
      • WMIC.exe (PID: 7512)
      • WMIC.exe (PID: 7620)
      • WMIC.exe (PID: 7532)
      • WMIC.exe (PID: 7584)

    • There is functionality for taking screenshot (YARA)

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Found regular expressions for crypto-addresses (YARA)

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • There is functionality for capture public ip (YARA)

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Starts POWERSHELL.EXE for commands execution

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

  • INFO

    • Checks supported languages

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Reads the computer name

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1912)
      • WMIC.exe (PID: 7012)
      • WMIC.exe (PID: 5528)
      • WMIC.exe (PID: 4024)
      • WMIC.exe (PID: 4620)
      • WMIC.exe (PID: 6872)
      • WMIC.exe (PID: 1056)
      • WMIC.exe (PID: 2800)
      • WMIC.exe (PID: 5048)
      • WMIC.exe (PID: 4980)
      • WMIC.exe (PID: 7052)
      • WMIC.exe (PID: 1628)
      • WMIC.exe (PID: 4988)
      • WMIC.exe (PID: 7036)
      • WMIC.exe (PID: 5968)
      • WMIC.exe (PID: 6800)
      • WMIC.exe (PID: 6388)
      • WMIC.exe (PID: 2320)
      • WMIC.exe (PID: 960)
      • WMIC.exe (PID: 5680)
      • WMIC.exe (PID: 5640)
      • WMIC.exe (PID: 5968)
      • WMIC.exe (PID: 4996)
      • WMIC.exe (PID: 1812)
      • WMIC.exe (PID: 4688)
      • WMIC.exe (PID: 7200)
      • WMIC.exe (PID: 7244)
      • WMIC.exe (PID: 7492)
      • WMIC.exe (PID: 7448)
      • WMIC.exe (PID: 7636)
      • WMIC.exe (PID: 7596)
      • WMIC.exe (PID: 7676)
      • WMIC.exe (PID: 7716)
      • WMIC.exe (PID: 7756)
      • WMIC.exe (PID: 7328)
      • WMIC.exe (PID: 7396)
      • WMIC.exe (PID: 7920)
      • WMIC.exe (PID: 8000)
      • WMIC.exe (PID: 7960)
      • WMIC.exe (PID: 8040)
      • WMIC.exe (PID: 8080)
      • WMIC.exe (PID: 8136)
      • WMIC.exe (PID: 7796)
      • WMIC.exe (PID: 7856)
      • WMIC.exe (PID: 7224)
      • WMIC.exe (PID: 7288)
      • WMIC.exe (PID: 8176)
      • WMIC.exe (PID: 7172)
      • WMIC.exe (PID: 7364)
      • WMIC.exe (PID: 2656)
      • WMIC.exe (PID: 6156)
      • WMIC.exe (PID: 7448)
      • WMIC.exe (PID: 7568)
      • WMIC.exe (PID: 7624)
      • WMIC.exe (PID: 4448)
      • WMIC.exe (PID: 900)
      • WMIC.exe (PID: 2100)
      • WMIC.exe (PID: 7396)
      • WMIC.exe (PID: 7468)
      • WMIC.exe (PID: 7740)
      • WMIC.exe (PID: 7816)
      • WMIC.exe (PID: 7840)
      • WMIC.exe (PID: 7548)
      • WMIC.exe (PID: 7904)
      • WMIC.exe (PID: 7948)
      • WMIC.exe (PID: 7984)
      • WMIC.exe (PID: 7664)
      • WMIC.exe (PID: 7700)
      • WMIC.exe (PID: 7780)
      • WMIC.exe (PID: 8044)
      • WMIC.exe (PID: 5964)
      • WMIC.exe (PID: 8084)
      • WMIC.exe (PID: 1240)
      • WMIC.exe (PID: 8160)
      • WMIC.exe (PID: 8028)
      • WMIC.exe (PID: 7372)
      • WMIC.exe (PID: 1628)
      • WMIC.exe (PID: 2908)
      • WMIC.exe (PID: 7428)
      • WMIC.exe (PID: 7268)
      • WMIC.exe (PID: 7216)
      • WMIC.exe (PID: 7260)
      • WMIC.exe (PID: 7664)
      • WMIC.exe (PID: 7768)
      • WMIC.exe (PID: 7808)
      • WMIC.exe (PID: 7532)
      • WMIC.exe (PID: 7564)

    • Application based on Golang

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Detects GO elliptic curve encryption (YARA)

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Reads the software policy settings

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Reads the machine GUID from the registry

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)

    • Create files in a temporary directory

      • d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe (PID: 680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(680) d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
Discord-Webhook-Tokens (1)1101151106052145214/BIaHrwzWkurP1ifNTfI0S-nV_adpU3L7CtHkZgsoxNh0xWIhQpjX2fdzD9kB7BDNYQi7
Discord-Info-Links
1101151106052145214/BIaHrwzWkurP1ifNTfI0S-nV_adpU3L7CtHkZgsoxNh0xWIhQpjX2fdzD9kB7BDNYQi7
Get Webhook Infohttps://discord.com/api/webhooks/1101151106052145214/BIaHrwzWkurP1ifNTfI0S-nV_adpU3L7CtHkZgsoxNh0xWIhQpjX2fdzD9kB7BDNYQi7
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware, No debug
PEType: PE32+
LinkerVersion: 3
CodeSize: 5751808
InitializedDataSize: 430080
UninitializedDataSize: -
EntryPoint: 0x67700
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
234
Monitored processes
105
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DISCORDGRABBER d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe conhost.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs sppextcomobj.exe no specs wmic.exe no specs slui.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs svchost.exe wmic.exe no specs powershell.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Users\admin\AppData\Local\Temp\d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe" C:\Users\admin\AppData\Local\Temp\d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
ims-api
(PID) Process(680) d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
Discord-Webhook-Tokens (1)1101151106052145214/BIaHrwzWkurP1ifNTfI0S-nV_adpU3L7CtHkZgsoxNh0xWIhQpjX2fdzD9kB7BDNYQi7
Discord-Info-Links
1101151106052145214/BIaHrwzWkurP1ifNTfI0S-nV_adpU3L7CtHkZgsoxNh0xWIhQpjX2fdzD9kB7BDNYQi7
Get Webhook Infohttps://discord.com/api/webhooks/1101151106052145214/BIaHrwzWkurP1ifNTfI0S-nV_adpU3L7CtHkZgsoxNh0xWIhQpjX2fdzD9kB7BDNYQi7
900wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
960wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1056wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1240wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1628wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1628wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1812wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1912wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
2088"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
30 524
Read events
30 524
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
19
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Local\Temp\download_db —
MD5:—
SHA256:—
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Local\Temp\cookies.sqlitebinary
MD5:19BA68C3ECBCA72C2B90AFADDE745DC6
SHA256:8B3758EE2D2C0A07EE7003F902F0667ABE5D9667941F8617EDA3CDF94C78E7B8
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Local\Temp\download_db-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Local\Temp\browsers.zipcompressed
MD5:A08F39AACC76679AC03D29DE6722BAEA
SHA256:F9E686DB34FAA2C4C879C3CD2ACBC10E075F05DF4794B4FB9660E38E01B59E57
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Local\Temp\card_dbbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Local\Temp\browsers\Edge\Default\cookies.txttext
MD5:6E09C34FAE133543F91454AC62BF2E4C
SHA256:0BFE8956F30CBF44688B9EE6A1A34DD7F4E883D5791815046C3450382B0A5130
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Local\Temp\cookie_dbbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Local\Temp\browsers\Edge\Default\history.txttext
MD5:54DF6ADB91D780CF71A20EBA0FBAF54B
SHA256:13544265D11A7A5F06927A0ABE8AF8DF4E5AA0485DD609A91474595AA254DBFC
680d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exeC:\Users\admin\AppData\Local\Temp\masterkey_dbbinary
MD5:0FF3BCDD0BE077B9EB8194B5C09F453C
SHA256:225D669E47EB14D8C969799C92AAEF27B66CD984872EA09284E48DB46521E651
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
27
DNS requests
19
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1280
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
680
d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/216.24.216.99
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3008
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3008
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.131
  • 20.190.159.75
  • 40.126.31.0
  • 20.190.159.23
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.64
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
api.ipify.org
  • 104.26.13.205
  • 172.67.74.152
  • 104.26.12.205
shared
api.gofile.io
  • 45.112.123.126
  • 51.91.7.6
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
680
d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
680
d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
Misc activity
ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io)
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
680
d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
680
d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
d11efad7ebe520ccc9f682003d76ebfabd5d18b746a801fefbf04317f7ae7505