File name:

4cd8dd0c2916a962fbef018de240de5f2d8dcd13c69d4d1f2c9d4ae1ac3a32d9.zip

Full analysis: https://app.any.run/tasks/4ca15ba8-b7fc-4cf1-b423-46f99a978483
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 29, 2026, 07:19:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
susp-powershell
auto-reg
loader
reverseloader
rat
remcos
payload
api-base64
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

06B23218C25C6CC1C8D37B6CAF62EF9B

SHA1:

AEAA40EB6DDFBEB42570EA08F43EB69AFE44E741

SHA256:

4CD8DD0C2916A962FBEF018DE240DE5F2D8DCD13C69D4D1F2C9D4AE1AC3A32D9

SSDEEP:

192:AqRpA7lryuoO+bjbBU8ZawJjvtKC73VTbscSevAwS:AGA52dO+ntdrjFhJmmVS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2396)

    • May hide the program window using WMI (SCRIPT)

      • wscript.exe (PID: 2396)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6804)

    • Changes the autorun value in the registry

      • powershell.exe (PID: 6804)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2132)

    • REMCOS mutex has been found

      • MSBuild.exe (PID: 4284)

    • REMCOS has been detected

      • MSBuild.exe (PID: 4284)

    • REVERSELOADER has been detected (SURICATA)

      • powershell.exe (PID: 6804)

    • REMCOS has been detected (YARA)

      • MSBuild.exe (PID: 4284)

  • SUSPICIOUS

    • Creates an object to access WMI (SCRIPT)

      • wscript.exe (PID: 2396)

    • Executed via WMI

      • powershell.exe (PID: 6804)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 2396)

    • Сharacter substitution obfuscation via .replace()

      • powershell.exe (PID: 6804)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 6804)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6804)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 2396)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6804)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7232)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 7232)

    • Starts process via Powershell

      • powershell.exe (PID: 2132)

    • Application launched itself

      • powershell.exe (PID: 6804)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1268)
      • powershell.exe (PID: 6804)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 1268)
      • cmd.exe (PID: 7816)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7816)

    • Contacting a server suspected of hosting an Exploit Kit

      • powershell.exe (PID: 6804)

    • Get information on the list of running processes

      • cmd.exe (PID: 7816)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 6804)

    • Payload loading activity detected

      • powershell.exe (PID: 6804)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 6804)

  • INFO

    • Manual execution by a user

      • wscript.exe (PID: 2396)
      • wscript.exe (PID: 7780)

    • Generic archive extractor

      • WinRAR.exe (PID: 4968)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • wscript.exe (PID: 2396)
      • powershell.exe (PID: 6804)

    • Found Base64 encoded access to processes via PowerShell (YARA)

      • wscript.exe (PID: 2396)
      • powershell.exe (PID: 6804)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • wscript.exe (PID: 2396)
      • powershell.exe (PID: 6804)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6804)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 6804)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 6804)

    • Found Base64 encoded network access via PowerShell (YARA)

      • wscript.exe (PID: 2396)
      • powershell.exe (PID: 6804)

    • Create files in a temporary directory

      • powershell.exe (PID: 6804)
      • cvtres.exe (PID: 7856)
      • csc.exe (PID: 7232)

    • Checks supported languages

      • csc.exe (PID: 7232)
      • cvtres.exe (PID: 7856)
      • MSBuild.exe (PID: 4284)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 7232)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 6804)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6804)

    • Launching a file from a Registry key

      • powershell.exe (PID: 6804)

    • Potential remote process memory reading (Base64 Encoded 'ReadProcessMemory')

      • powershell.exe (PID: 6804)

    • Potential dynamic function import (Base64 Encoded 'GetProcAddress')

      • powershell.exe (PID: 6804)

    • Reads the computer name

      • MSBuild.exe (PID: 4284)

    • Potential remote process memory writing (Base64 Encoded 'WriteProcessMemory')

      • powershell.exe (PID: 6804)

    • Potential modification of remote process state (Base64 Encoded 'SetThreadContext')

      • powershell.exe (PID: 6804)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 4284)

    • Potential remote process memory interaction (Base64 Encoded 'VirtualAllocEx')

      • powershell.exe (PID: 6804)

    • Potential library load (Base64 Encoded 'LoadLibrary')

      • powershell.exe (PID: 6804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(4284) MSBuild.exe
C2 (1)kamglobal.duckdns.org:14645
Botnetsvchost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-HNE8WZ
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2026:04:28 19:06:38
ZipCRC: 0xb702e0cd
ZipCompressedSize: 5771
ZipUncompressedSize: 41069
ZipFileName: PO 4500070387.js
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
26
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs slui.exe wscript.exe no specs #REVERSELOADER powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs powershell.exe no specs conhost.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs msbuild.exe no specs taskkill.exe no specs conhost.exe no specs #REMCOS msbuild.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs svchost.exe tasklist.exe no specs find.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1268"C:\WINDOWS\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2132"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -WaitC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
2232C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2396"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\PO 4500070387.js"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2588\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2840\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2988timeout 60 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3416C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3580taskkill /IM RegAsm.exe /F C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4284"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Remcos
(PID) Process(4284) MSBuild.exe
C2 (1)kamglobal.duckdns.org:14645
Botnetsvchost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-HNE8WZ
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
Total events
17 431
Read events
17 414
Write events
17
Delete events
0

Modification events

(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\4cd8dd0c2916a962fbef018de240de5f2d8dcd13c69d4d1f2c9d4ae1ac3a32d9.zip
(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4968) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
1
Suspicious files
3
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
6804powershell.exeC:\Users\admin\AppData\Local\Temp\qrdhlngu.cmdlinetext
MD5:EA9363C990A4C2F4E56AA3BB571E4311
SHA256:1985409465CC26EE96119B0CC96F9F5A7A7F1EA186E1C9C77033345E2D852978
6804powershell.exeC:\Users\admin\AppData\Local\Temp\qrdhlngu.0.cstext
MD5:DBD5C6F96ED1813DBCC61C2C6091C05E
SHA256:6F73F3ED4FDCAC3BE47B0398F5E9F79C0E138E052F31F885E86B37E2060A00E0
7232csc.exeC:\Users\admin\AppData\Local\Temp\qrdhlngu.outtext
MD5:488CBB8DEE536049F617452BCE8E223A
SHA256:6D87D026166F4174F902672417E1600E491337B1ACD9EC1B2F6482ED62004944
6804powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mli4v3u3.sli.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6804powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jlf5wjia.kmy.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2132powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_n0v0goz1.bgi.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2132powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:CE473557B23EF1AAB43D04E34CF4F3AD
SHA256:E7FAFCE9AEDA7941A05699C6075C17D93B6958795193E7211AE6989506F63E10
6804powershell.exeC:\ProgramData\AaSehbm.jstext
MD5:D1AD730A6E1F476537E856E21DFFB69F
SHA256:CD26B27A96B78D7C581924F55B45152A716CB45959F6621FFB19C1B0A3A04A2C
7232csc.exeC:\Users\admin\AppData\Local\Temp\qrdhlngu.dllexecutable
MD5:FFE8BB5F74660873B1BAF16299768B69
SHA256:5B003E8DEB2CB40AB655CED5FA5B41194FFA81A1C445B777FE685201DD741E6E
7856cvtres.exeC:\Users\admin\AppData\Local\Temp\RES588B.tmpbinary
MD5:5E8D75C81CD94061F20BAA4EA5D54632
SHA256:137F154744C6E360DACD9BA84B0F5028F2644DE851D6F7FFC8C4A6BEA2BB96D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
73
TCP/UDP connections
54
DNS requests
21
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
4044
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5316
svchost.exe
POST
400
40.126.31.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
5316
svchost.exe
POST
400
40.126.31.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
4044
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5316
svchost.exe
POST
200
40.126.31.67:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
5316
svchost.exe
POST
400
40.126.31.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
5316
svchost.exe
POST
400
40.126.31.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
5316
svchost.exe
POST
400
40.126.31.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
5316
svchost.exe
POST
400
40.126.31.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
204 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
4044
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8152
slui.exe
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
4044
svchost.exe
23.216.77.42:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
4044
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5208
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3416
slui.exe
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.20
  • 2.18.67.76
  • 2.18.67.70
whitelisted
google.com
  • 142.251.14.102
  • 142.251.14.138
  • 142.251.14.113
  • 142.251.14.101
  • 142.251.14.100
  • 142.251.14.139
whitelisted
www.microsoft.com
  • 23.59.18.102
  • 173.222.171.238
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.131
  • 40.126.31.2
  • 20.190.159.71
  • 40.126.31.129
  • 20.190.159.73
  • 40.126.31.1
  • 20.190.159.68
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
paste.sensio.no
  • 185.240.204.143
unknown
slscr.update.microsoft.com
  • 135.233.95.144
whitelisted
arc.msn.com
  • 20.86.201.138
whitelisted

Threats

PID
Process
Class
Message
5276
MoUsoCoreWorker.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
A Network Trojan was detected
ET MALWARE Windows executable base64 encoded
—
—
Misc activity
ET HUNTING EXE Base64 Encoded potential malware
6804
powershell.exe
A Network Trojan was detected
ET MALWARE Windows executable base64 encoded
6804
powershell.exe
Misc activity
ET HUNTING EXE Base64 Encoded potential malware
—
—
Exploit Kit Activity Detected
ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1
—
—
Exploit Kit Activity Detected
ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound
2232
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2232
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Potentially Bad Traffic
PAYLOAD [ANY.RUN] Reverse Base64 Encoded EXE Inbound
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4cd8dd0c2916a962fbef018de240de5f2d8dcd13c69d4d1f2c9d4ae1ac3a32d9.zip