File name:

script2.ps1

Full analysis: https://app.any.run/tasks/16b73831-32b2-43f3-8e36-acbcfc275ec1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 26, 2025, 01:37:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
auto-startup
auto
njrat
rat
bladabindi
auto-reg
loader
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
MD5:

E2A0863F3954D95F82B83C554378E87D

SHA1:

7F44BFE2D2D6508232A6D41AFEAA174C181F8092

SHA256:

45D99D34F3DD06F66ECD249BCD53BA9E97FA6B52008C92DD6EB812580AF6C760

SSDEEP:

96:mdebm6qmzbBw0iX31/9d2/yuCa4p08Q1qQ:mdebbqYbBw93l267a/AQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4024)
      • powershell.exe (PID: 7544)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 4024)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 5416)
      • powershell.exe (PID: 8000)

    • RAT has been found (auto)

      • powershell.exe (PID: 5416)
      • windows.exe (PID: 1180)
      • Windows.exe (PID: 2240)

    • Create files in the Startup directory

      • windows.exe (PID: 1180)
      • Windows.exe (PID: 2240)

    • NJRAT mutex has been found

      • windows.exe (PID: 1180)
      • Windows.exe (PID: 2240)
      • Windows.exe (PID: 7628)
      • Windows.exe (PID: 7456)
      • windows.exe (PID: 7908)

    • Changes the autorun value in the registry

      • windows.exe (PID: 1180)
      • Windows.exe (PID: 2240)
      • ie4uinit.exe (PID: 5600)

  • SUSPICIOUS

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 4024)
      • powershell.exe (PID: 7544)

    • Application launched itself

      • powershell.exe (PID: 4024)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 7544)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 4024)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 4024)
      • cmd.exe (PID: 5056)
      • cmd.exe (PID: 7912)

    • The process executes Powershell scripts

      • powershell.exe (PID: 4024)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 7544)
      • WindowsSecurity.exe (PID: 5116)
      • WindowsSecurity.exe (PID: 7724)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 7544)
      • WindowsSecurity.exe (PID: 5116)
      • WindowsSecurity.exe (PID: 7724)

    • Starts NET.EXE to display or manage information about active sessions

      • net.exe (PID: 7960)
      • cmd.exe (PID: 7900)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7900)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7544)
      • powershell.exe (PID: 5416)
      • windows.exe (PID: 1180)
      • Windows.exe (PID: 2240)
      • SoundSemo.exe (PID: 7396)
      • SoundSemo.tmp (PID: 7484)
      • MPluginManager.exe (PID: 4620)
      • MPluginManager_02_04_setup.exe (PID: 7760)
      • MPluginManager_02_04_setup.tmp (PID: 4228)
      • MPluginManager_02_04_setup.exe (PID: 7248)
      • MPluginManager_02_04_setup.exe (PID: 4120)

    • Probably download files using WebClient

      • cmd.exe (PID: 5056)
      • cmd.exe (PID: 7912)

    • Reads security settings of Internet Explorer

      • windows.exe (PID: 1180)
      • SoundSemo.tmp (PID: 7484)
      • MPluginManager_02_04_setup.tmp (PID: 4228)

    • Uses ATTRIB.EXE to modify file attributes

      • windows.exe (PID: 1180)
      • Windows.exe (PID: 2240)

    • Starts itself from another location

      • windows.exe (PID: 1180)

    • Reads the Windows owner or organization settings

      • SoundSemo.tmp (PID: 7484)
      • MPluginManager_02_04_setup.tmp (PID: 4228)

    • Potential Corporate Privacy Violation

      • MPluginManager.exe (PID: 4620)

    • Searches for installed software

      • MPluginManager_02_04_setup.tmp (PID: 4228)

    • Process requests binary or script from the Internet

      • MPluginManager.exe (PID: 4620)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 7544)
      • powershell.exe (PID: 5416)
      • powershell.exe (PID: 8000)

    • Checks proxy server information

      • powershell.exe (PID: 7544)
      • powershell.exe (PID: 5416)
      • powershell.exe (PID: 8000)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7544)

    • The executable file from the user directory is run by the Powershell process

      • WindowsSecurity.exe (PID: 5116)
      • SoundSemo.exe (PID: 7396)

    • Create files in a temporary directory

      • WindowsSecurity.exe (PID: 5116)
      • WindowsSecurity.exe (PID: 7724)
      • SoundSemo.exe (PID: 7396)
      • SoundSemo.tmp (PID: 7484)
      • MPluginManager_02_04_setup.exe (PID: 7760)
      • MPluginManager_02_04_setup.tmp (PID: 4228)

    • Auto-launch of the file from Startup directory

      • windows.exe (PID: 1180)
      • Windows.exe (PID: 2240)

    • Checks supported languages

      • windows.exe (PID: 1180)
      • WindowsSecurity.exe (PID: 5116)
      • Windows.exe (PID: 2240)
      • Windows.exe (PID: 7456)
      • Windows.exe (PID: 7628)
      • SoundSemo.exe (PID: 7396)
      • SoundSemo.tmp (PID: 7484)
      • WindowsSecurity.exe (PID: 7724)
      • windows.exe (PID: 7908)
      • MPluginManager.exe (PID: 4620)
      • MPluginManager_02_04_setup.exe (PID: 7760)
      • MPluginManager_02_04_setup.tmp (PID: 4228)
      • MPluginManager.exe (PID: 5328)

    • Reads the computer name

      • windows.exe (PID: 1180)
      • Windows.exe (PID: 7456)
      • Windows.exe (PID: 2240)
      • SoundSemo.exe (PID: 7396)
      • SoundSemo.tmp (PID: 7484)
      • Windows.exe (PID: 7628)
      • MPluginManager.exe (PID: 4620)
      • windows.exe (PID: 7908)
      • MPluginManager_02_04_setup.exe (PID: 7760)
      • MPluginManager_02_04_setup.tmp (PID: 4228)
      • MPluginManager.exe (PID: 5328)

    • Creates files or folders in the user directory

      • windows.exe (PID: 1180)
      • Windows.exe (PID: 2240)
      • SoundSemo.tmp (PID: 7484)
      • MPluginManager.exe (PID: 4620)
      • MPluginManager_02_04_setup.tmp (PID: 4228)
      • ie4uinit.exe (PID: 5600)
      • MPluginManager.exe (PID: 5328)

    • Auto-launch of the file from Registry key

      • windows.exe (PID: 1180)
      • Windows.exe (PID: 2240)
      • ie4uinit.exe (PID: 5600)

    • Manual execution by a user

      • Windows.exe (PID: 7456)
      • Windows.exe (PID: 7628)
      • WindowsSecurity.exe (PID: 7724)
      • MPluginManager_02_04_setup.exe (PID: 4120)

    • Reads the machine GUID from the registry

      • Windows.exe (PID: 2240)

    • Process checks computer location settings

      • windows.exe (PID: 1180)
      • SoundSemo.tmp (PID: 7484)
      • MPluginManager_02_04_setup.tmp (PID: 4228)

    • Creates a software uninstall entry

      • SoundSemo.tmp (PID: 7484)
      • MPluginManager_02_04_setup.tmp (PID: 4228)

    • Creates files in the program directory

      • SoundSemo.tmp (PID: 7484)
      • MPluginManager_02_04_setup.tmp (PID: 4228)

    • Reads the software policy settings

      • slui.exe (PID: 7324)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 5600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.txt | Text - UTF-8 encoded (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
42
Malicious processes
14
Suspicious processes
5

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs reg.exe no specs windowssecurity.exe no specs conhost.exe no specs cmd.exe no specs #RAT powershell.exe #NJRAT windows.exe #NJRAT windows.exe attrib.exe no specs conhost.exe no specs #NJRAT windows.exe no specs attrib.exe no specs attrib.exe no specs conhost.exe no specs conhost.exe no specs #NJRAT windows.exe no specs soundsemo.exe soundsemo.tmp windowssecurity.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe #NJRAT windows.exe no specs slui.exe no specs mpluginmanager.exe mpluginmanager_02_04_setup.exe mpluginmanager_02_04_setup.tmp ie4uinit.exe mpluginmanager.exe mpluginmanager_02_04_setup.exe mpluginmanager_02_04_setup.tmp no specs mpluginmanager_02_04_setup.exe mpluginmanager_02_04_setup.tmp no specs

Process information

PID
CMD
Path
Indicators
Parent process
1056"C:\Users\admin\AppData\Local\Temp\is-QT5D0.tmp\MPluginManager_02_04_setup.tmp" /SL5="$6025A,15503938,901632,C:\Users\admin\Downloads\MPluginManager_02_04_setup.exe" C:\Users\admin\AppData\Local\Temp\is-QT5D0.tmp\MPluginManager_02_04_setup.tmp—MPluginManager_02_04_setup.exe
User:
admin
Company:
MeldaProduction
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qt5d0.tmp\mpluginmanager_02_04_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1180"C:\Users\admin\AppData\windows.exe" C:\Users\admin\AppData\windows.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\windows.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1672attrib +h +r +s "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"C:\Windows\SysWOW64\attrib.exe—Windows.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
2240"C:\Users\admin\AppData\Roaming\Windows.exe" C:\Users\admin\AppData\Roaming\Windows.exe
windows.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\windows.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3008attrib +h +r +s "C:\Users\admin\AppData\Roaming\Windows.exe"C:\Windows\SysWOW64\attrib.exe—windows.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
4024"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\script2.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4040"C:\Users\admin\AppData\Local\Temp\is-DVU4G.tmp\MPluginManager_02_04_setup.tmp" /SL5="$70304,15503938,901632,C:\Users\admin\Downloads\MPluginManager_02_04_setup.exe" /SPAWNWND=$C02EA /NOTIFYWND=$6025A C:\Users\admin\AppData\Local\Temp\is-DVU4G.tmp\MPluginManager_02_04_setup.tmp—MPluginManager_02_04_setup.exe
User:
admin
Company:
MeldaProduction
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-dvu4g.tmp\mpluginmanager_02_04_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
4120"C:\Users\admin\Downloads\MPluginManager_02_04_setup.exe" C:\Users\admin\Downloads\MPluginManager_02_04_setup.exe
explorer.exe
User:
admin
Company:
MeldaProduction
Integrity Level:
MEDIUM
Description:
MPluginManager Setup
Version:
Modules
Images
c:\users\admin\downloads\mpluginmanager_02_04_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
4180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4228"C:\Users\admin\AppData\Local\Temp\is-C9PK3.tmp\MPluginManager_02_04_setup.tmp" /SL5="$30234,15503938,901632,C:\Users\admin\Downloads\MPluginManager_02_04_setup.exe" /silent /runC:\Users\admin\AppData\Local\Temp\is-C9PK3.tmp\MPluginManager_02_04_setup.tmp
MPluginManager_02_04_setup.exe
User:
admin
Company:
MeldaProduction
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-c9pk3.tmp\mpluginmanager_02_04_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\comdlg32.dll
c:\windows\syswow64\msvcrt.dll
Total events
26 772
Read events
26 554
Write events
217
Delete events
1

Modification events

(PID) Process:(8008) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths
Operation:writeName:C:\
Value:
(PID) Process:(1180) windows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Windows2
Value:
C:\Users\admin\AppData\Roaming\Windows.exe
(PID) Process:(2240) Windows.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:SEE_MASK_NOZONECHECKS
Value:
1
(PID) Process:(2240) Windows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Windows2
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
(PID) Process:(2240) Windows.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Windows2
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
(PID) Process:(2240) Windows.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Windows
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
(PID) Process:(2240) Windows.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Windows
Value:
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
(PID) Process:(7544) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:WindowsSecurity
Value:
"C:\Users\admin\AppData\WindowsSecurity.exe"
(PID) Process:(7484) SoundSemo.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C1AF678B-36F6-48F3-964D-41610AACE13B}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.3.3
(PID) Process:(7484) SoundSemo.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C1AF678B-36F6-48F3-964D-41610AACE13B}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\MeldaProduction
Executable files
20
Suspicious files
18
Text files
552
Unknown types
0

Dropped files

PID
Process
Filename
Type
4024powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KHSYI9CFE6MJI7AWASCX.tempbinary
MD5:8C66C3E541A757F212BF346EB11F3F69
SHA256:C6DEF341EDCBBA348DFC9A0E9FCA2E6F74BFC421F8656991B00E4A09C60E8100
4024powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10c238.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
1180windows.exeC:\Users\admin\AppData\Roaming\Windows.exeexecutable
MD5:2C4FE940C0AAF722B86F2784C09B65A7
SHA256:B37508A2880228DB684F461822C955304158E1E4BF210EBB4892466D81D5941C
4024powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_autqufin.urp.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1180windows.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnkbinary
MD5:5231CF01D4EB9CE70C7EDF6CBCDAB473
SHA256:9A5C09DEF3F2EB5EF8E524ED406E5B913D416E10814C79079612E0945EF4A1F0
7544powershell.exeC:\Users\admin\AppData\System.battext
MD5:AE22F7EFA38B410E144540A9978F2DD4
SHA256:0F690FA7F203EBEBA286B6E611E28802EE271C569172FD4B1448954C48A949E9
4024powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:8C66C3E541A757F212BF346EB11F3F69
SHA256:C6DEF341EDCBBA348DFC9A0E9FCA2E6F74BFC421F8656991B00E4A09C60E8100
7544powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:C711AED3E261495C4912229A9D6D8B48
SHA256:516B6D63599541AE3DF37D2F34F7CC9646D262FAC89888E64921D5118EE9A69A
7544powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10e224.TMPbinary
MD5:8C66C3E541A757F212BF346EB11F3F69
SHA256:C6DEF341EDCBBA348DFC9A0E9FCA2E6F74BFC421F8656991B00E4A09C60E8100
4024powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1gdpijdb.bhc.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
49
DNS requests
24
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5720
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5720
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4620
MPluginManager.exe
GET
200
52.29.75.84:80
http://www.meldaproduction.com:80/download/ConnectionTest.pkgm
unknown
—
—
whitelisted
4620
MPluginManager.exe
GET
200
52.29.75.84:80
http://www.meldaproduction.com:80/download/MPLUGINMANAGERDATABASE.xml
unknown
—
—
whitelisted
4620
MPluginManager.exe
GET
200
52.29.75.84:80
http://www.meldaproduction.com:80/download/MInstallerDefinition.mbx
unknown
—
—
whitelisted
4620
MPluginManager.exe
GET
200
52.29.75.84:80
http://www.meldaproduction.com:80/download/mpluginmanager/MPluginManager_02_04_setup.exe
unknown
—
—
whitelisted
4620
MPluginManager.exe
GET
200
52.29.75.84:80
http://www.meldaproduction.com:80/download/PRODUCTSX.xml
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7544
powershell.exe
207.241.224.2:443
archive.org
INTERNET-ARCHIVE
US
whitelisted
7544
powershell.exe
207.241.234.123:443
ia803203.us.archive.org
INTERNET-ARCHIVE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.64
  • 40.126.32.140
  • 20.190.160.67
  • 20.190.160.131
  • 20.190.160.14
  • 20.190.160.66
  • 40.126.32.68
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
archive.org
  • 207.241.224.2
whitelisted
ia803203.us.archive.org
  • 207.241.234.123
whitelisted
github.com
  • 140.82.121.4
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
4620
MPluginManager.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4620
MPluginManager.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
script2.ps1