download:

/xrp.php

Full analysis: https://app.any.run/tasks/c9d6971b-fd33-4f2e-a6ad-772f42b4a1b0
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 02, 2026, 21:24:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
netsupport
rmm-tool
remote
loader
tool
Indicators:
MIME: text/plain
File info: ASCII text
MD5:

A772F8FC304311F31316C949ACD2236A

SHA1:

4DF88BDD12AC3B926D21BCCCE6B8501BC0C401D3

SHA256:

48A683E97F9F8CADA3CBCC287632DDF8024A708DDB99E54B455B549546073542

SSDEEP:

24:1y2A4s9+NdgXTz3ZP70da2A4Mx2Ag0qGaQH6xvu2AQ2Aau+s:1lI9z3h0bM6JQcn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8016)

    • NETSUPPORT mutex has been found

      • neservice.exe (PID: 2248)

    • Create files in the Startup directory

      • 7z.exe (PID: 2432)

    • NETSUPPORT has been detected (YARA)

      • neservice.exe (PID: 2248)

    • NETSUPPORT has been detected (SURICATA)

      • neservice.exe (PID: 2248)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • powershell.exe (PID: 8016)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 8016)
      • 7z.exe (PID: 7664)

    • Drop NetSupport executable file

      • 7z.exe (PID: 7664)

    • The process drops C-runtime libraries

      • 7z.exe (PID: 7664)

    • Process drops legitimate windows executable

      • 7z.exe (PID: 7664)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 8016)

    • There is functionality for communication over UDP network (YARA)

      • neservice.exe (PID: 2248)

    • Contacting a server suspected of hosting an CnC

      • neservice.exe (PID: 2248)

  • INFO

    • Checks proxy server information

      • powershell.exe (PID: 8016)
      • slui.exe (PID: 3500)

    • Disables trace logs

      • powershell.exe (PID: 8016)

    • Drops script file

      • powershell.exe (PID: 8016)

    • The executable file from the user directory is run by the Powershell process

      • 7z.exe (PID: 7664)
      • neservice.exe (PID: 2248)
      • 7z.exe (PID: 2432)

    • Checks supported languages

      • 7z.exe (PID: 7664)
      • neservice.exe (PID: 2248)
      • 7z.exe (PID: 2432)

    • The sample compiled with english language support

      • powershell.exe (PID: 8016)
      • 7z.exe (PID: 7664)

    • Reads the computer name

      • 7z.exe (PID: 7664)
      • neservice.exe (PID: 2248)
      • 7z.exe (PID: 2432)

    • Creates files or folders in the user directory

      • 7z.exe (PID: 7664)
      • 7z.exe (PID: 2432)

    • Launching a file from the Startup directory

      • 7z.exe (PID: 2432)

    • There is functionality for taking screenshot (YARA)

      • neservice.exe (PID: 2248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
6
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs 7z.exe #NETSUPPORT neservice.exe 7z.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2248"C:\Users\admin\AppData\Local\Nfservice\neservice.exe" C:\Users\admin\AppData\Local\Nfservice\neservice.exe
powershell.exe
User:
admin
Company:
NetSupport Ltd
Integrity Level:
MEDIUM
Description:
NetSupport Client Application
Version:
V14.12
Modules
Images
c:\users\admin\appdata\local\nfservice\neservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\local\nfservice\pcicl32.dll
2432"C:\Users\admin\AppData\Local\Nfservice\7z.exe" x C:\Users\admin\AppData\Local\Nfservice\lnk.7z -pppp -aoa -y "-oC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"C:\Users\admin\AppData\Local\Nfservice\7z.exe
powershell.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\nfservice\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
3500C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7664"C:\Users\admin\AppData\Local\Nfservice\7z.exe" x at.7z -pppp -aoa -yC:\Users\admin\AppData\Local\Nfservice\7z.exe
powershell.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\nfservice\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
8016"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\xrp.php.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 312
Read events
9 312
Write events
0
Delete events
0

Modification events

No data
Executable files
20
Suspicious files
9
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
8016powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1e5292.TMPbinary
MD5:00A03B286E6E0EBFF8D9C492365D5EC2
SHA256:4DBFC417D053BA6867308671F1C61F4DCAFC61F058D4044DB532DA6D3BDE3615
8016powershell.exeC:\Users\admin\AppData\Local\Nfservice\7z.dllexecutable
MD5:95C6515D88E9EA48A9B949A81C1DAC4E
SHA256:B17C3E4058AACDCC36B18858D128D6B3058E0EA607A4DC59EB95B18B7C6ACC7C
8016powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hrkia50o.nut.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8016powershell.exeC:\Users\admin\AppData\Local\Nfservice\lnk.7zcompressed
MD5:4B261A6ADF6E0C952B5FB837091FF023
SHA256:5D821DB386C7C879CAEABF3E9F94C94A48EEC6EC5A3A0EFBAE9D69DA3F52C1DB
8016powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xa5edlbu.2h2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8016powershell.exeC:\Users\admin\AppData\Local\Nfservice\at.7zcompressed
MD5:B95044D0B689F2BD01492C9F8EE6E38C
SHA256:18F015F359AE83835DD8562991A248166F66A1C04D093C536959D9750382C11E
76647z.exeC:\Users\admin\AppData\Local\Nfservice\ns\NSM.initext
MD5:99F493DCE7FAB330DC47F0CAB8FE6172
SHA256:E0ED36C897EAA5352FAB181C20020B60DF4C58986193D6AAF5BF3E3ECDC4C05D
76647z.exeC:\Users\admin\AppData\Local\Nfservice\ns\nskbfltr.infbinary
MD5:26E28C01461F7E65C402BDF09923D435
SHA256:D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
76647z.exeC:\Users\admin\AppData\Local\Nfservice\ns\NSM.LICtext
MD5:5D7445EFA8A5560842C868369127CD79
SHA256:E09980D1B1C508EB29D2931AC92F8D0A7E49CA5FE6AB6277FABF097A0B033B63
76647z.exeC:\Users\admin\AppData\Local\Nfservice\ns\nsm_vpro.initext
MD5:3BE27483FDCDBF9EBAE93234785235E3
SHA256:4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
35
DNS requests
22
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6768
MoUsoCoreWorker.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
unknown
—
—
whitelisted
4936
svchost.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
unknown
—
—
whitelisted
2752
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
whitelisted
2752
SIHClient.exe
GET
200
135.233.95.135:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
whitelisted
2752
SIHClient.exe
GET
200
74.179.77.204:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
whitelisted
2752
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
whitelisted
2752
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3292
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
3292
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5568
SearchApp.exe
2.16.241.219:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4936
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7244
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
8016
powershell.exe
87.120.93.69:80
validatorxrp.dev
H2NEXUS-AS
GB
unknown
356
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 20.42.73.31
whitelisted
google.com
  • 142.251.208.14
whitelisted
www.bing.com
  • 2.16.241.219
  • 2.16.241.218
  • 2.16.241.205
  • 2.16.241.207
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
validatorxrp.dev
  • 87.120.93.69
unknown
login.live.com
  • 20.190.160.17
  • 20.190.160.3
  • 20.190.160.14
  • 40.126.32.74
  • 20.190.160.66
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.64
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.39
  • 23.216.77.32
  • 23.216.77.38
  • 23.216.77.33
  • 23.216.77.31
  • 23.216.77.29
  • 23.216.77.35
  • 23.216.77.37
  • 23.216.77.28
  • 2.16.164.49
  • 2.16.164.120
whitelisted
jakkakaskakasj.com
  • 87.120.93.69
unknown

Threats

PID
Process
Class
Message
8016
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
8016
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
8016
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
8016
powershell.exe
Misc activity
ET INFO Request for EXE via Powershell
8016
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
4936
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2248
neservice.exe
Potentially Bad Traffic
ET INFO HTTP traffic on port 443 (POST)
2248
neservice.exe
Potentially Bad Traffic
ET INFO HTTP traffic on port 443 (POST)
2248
neservice.exe
A Network Trojan was detected
REMOTE [ANY.RUN] NetSupport RAT
2248
neservice.exe
A Network Trojan was detected
REMOTE [ANY.RUN] NetSupport RAT
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/xrp.php