File name:

Oneclick-V7.0.bat

Full analysis: https://app.any.run/tasks/eff36fd4-b342-46bd-adff-512a98b95882
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 13, 2025, 15:44:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
reflection
loader
arch-exec
arch-doc
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with CRLF line terminators
MD5:

C8E2A0C12285B709FC839A4C7CBD6E1A

SHA1:

CAE0726ADBD932745E4E4DB37C82C5839F632EFA

SHA256:

67B5E27F2726692662D746C555D403D35293C6BF6EB0F5D8BEABA417872A5D9C

SSDEEP:

1536:8PSPKdigMQgPTjIV4QJ8STaggyjH/nvfHH4pXfCWOBEzCLiD15ToSmcj/DB:MfjvvfeTTmcTDB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4512)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1540)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 6296)

    • Changes the Windows auto-update feature

      • OOSU10.exe (PID: 6648)

    • Creates or modifies Windows services

      • OOSU10.exe (PID: 6648)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 1688)
      • net.exe (PID: 5512)
      • net.exe (PID: 2624)
      • net.exe (PID: 4300)
      • cmd.exe (PID: 6296)
      • net.exe (PID: 236)
      • net.exe (PID: 5092)
      • net.exe (PID: 1176)
      • net.exe (PID: 1620)
      • net.exe (PID: 5212)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6708)
      • cmd.exe (PID: 524)
      • cmd.exe (PID: 5752)
      • cmd.exe (PID: 6296)
      • cmd.exe (PID: 5568)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6708)
      • cmd.exe (PID: 5752)
      • cmd.exe (PID: 6296)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 7008)
      • powershell.exe (PID: 1740)
      • NSudoLG.exe (PID: 6728)
      • NSudoLG.exe (PID: 6928)
      • NSudoLG.exe (PID: 3480)

    • Hides command output

      • cmd.exe (PID: 2548)
      • cmd.exe (PID: 6596)
      • cmd.exe (PID: 6760)
      • cmd.exe (PID: 1224)
      • cmd.exe (PID: 6912)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 524)
      • powershell.exe (PID: 7008)
      • powershell.exe (PID: 1740)
      • cmd.exe (PID: 6296)
      • NSudoLG.exe (PID: 6728)
      • NSudoLG.exe (PID: 6928)
      • NSudoLG.exe (PID: 3480)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2548)
      • cmd.exe (PID: 6596)
      • cmd.exe (PID: 6760)

    • Application launched itself

      • cmd.exe (PID: 524)
      • cmd.exe (PID: 6296)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6836)
      • sc.exe (PID: 3144)
      • sc.exe (PID: 6376)
      • sc.exe (PID: 2624)
      • sc.exe (PID: 5628)
      • sc.exe (PID: 640)
      • sc.exe (PID: 4544)
      • sc.exe (PID: 2736)
      • sc.exe (PID: 5568)
      • sc.exe (PID: 716)
      • sc.exe (PID: 6308)
      • sc.exe (PID: 6660)
      • sc.exe (PID: 6540)
      • sc.exe (PID: 6280)
      • sc.exe (PID: 6856)
      • sc.exe (PID: 3040)
      • sc.exe (PID: 4932)
      • sc.exe (PID: 1864)
      • sc.exe (PID: 6520)
      • sc.exe (PID: 6260)
      • sc.exe (PID: 6552)
      • sc.exe (PID: 6908)
      • sc.exe (PID: 5316)
      • sc.exe (PID: 6784)
      • sc.exe (PID: 2396)
      • sc.exe (PID: 6780)
      • sc.exe (PID: 6936)
      • sc.exe (PID: 2008)
      • sc.exe (PID: 2012)
      • sc.exe (PID: 6836)
      • sc.exe (PID: 6544)
      • sc.exe (PID: 7024)
      • sc.exe (PID: 6492)
      • sc.exe (PID: 6724)
      • sc.exe (PID: 6940)
      • sc.exe (PID: 7072)
      • sc.exe (PID: 7040)
      • sc.exe (PID: 5592)
      • sc.exe (PID: 7100)
      • sc.exe (PID: 4512)
      • sc.exe (PID: 6716)
      • sc.exe (PID: 5556)
      • sc.exe (PID: 5916)
      • sc.exe (PID: 5544)
      • sc.exe (PID: 4596)
      • sc.exe (PID: 2312)
      • sc.exe (PID: 5304)
      • sc.exe (PID: 4160)
      • sc.exe (PID: 3532)
      • sc.exe (PID: 5748)
      • sc.exe (PID: 6148)
      • sc.exe (PID: 6396)
      • sc.exe (PID: 1344)
      • sc.exe (PID: 5496)
      • sc.exe (PID: 1540)
      • sc.exe (PID: 6232)
      • sc.exe (PID: 3260)
      • sc.exe (PID: 6284)
      • sc.exe (PID: 1580)
      • sc.exe (PID: 6016)
      • sc.exe (PID: 6476)
      • sc.exe (PID: 1704)
      • sc.exe (PID: 6416)
      • sc.exe (PID: 4328)
      • sc.exe (PID: 6568)
      • sc.exe (PID: 6304)
      • sc.exe (PID: 6356)
      • sc.exe (PID: 6252)
      • sc.exe (PID: 6816)
      • sc.exe (PID: 6156)
      • sc.exe (PID: 5240)
      • sc.exe (PID: 4976)
      • sc.exe (PID: 6596)
      • sc.exe (PID: 556)
      • sc.exe (PID: 6644)
      • sc.exe (PID: 6588)
      • sc.exe (PID: 5876)
      • sc.exe (PID: 3172)
      • sc.exe (PID: 6600)
      • sc.exe (PID: 1876)
      • sc.exe (PID: 3816)
      • sc.exe (PID: 6536)
      • sc.exe (PID: 6780)
      • sc.exe (PID: 6772)
      • sc.exe (PID: 1668)
      • sc.exe (PID: 1852)
      • sc.exe (PID: 6208)
      • sc.exe (PID: 3060)
      • sc.exe (PID: 6828)
      • sc.exe (PID: 1688)
      • sc.exe (PID: 6972)
      • sc.exe (PID: 6876)
      • sc.exe (PID: 6076)
      • sc.exe (PID: 6944)
      • sc.exe (PID: 7016)
      • sc.exe (PID: 7036)
      • sc.exe (PID: 7084)
      • sc.exe (PID: 3144)
      • sc.exe (PID: 7064)
      • sc.exe (PID: 6760)
      • sc.exe (PID: 5580)
      • sc.exe (PID: 4120)
      • sc.exe (PID: 6736)
      • sc.exe (PID: 6864)
      • sc.exe (PID: 5456)
      • sc.exe (PID: 5200)
      • sc.exe (PID: 540)
      • sc.exe (PID: 2744)
      • sc.exe (PID: 5536)
      • sc.exe (PID: 4228)
      • sc.exe (PID: 5936)
      • sc.exe (PID: 1868)
      • sc.exe (PID: 4716)
      • sc.exe (PID: 3560)
      • sc.exe (PID: 3488)
      • sc.exe (PID: 6468)
      • sc.exe (PID: 2124)
      • sc.exe (PID: 5212)
      • sc.exe (PID: 4944)
      • sc.exe (PID: 880)
      • sc.exe (PID: 2940)
      • sc.exe (PID: 4544)
      • sc.exe (PID: 6292)
      • sc.exe (PID: 6412)
      • sc.exe (PID: 6308)
      • sc.exe (PID: 6556)
      • sc.exe (PID: 6856)
      • sc.exe (PID: 6820)
      • sc.exe (PID: 1740)
      • sc.exe (PID: 644)
      • sc.exe (PID: 3080)
      • sc.exe (PID: 5628)
      • sc.exe (PID: 6528)
      • sc.exe (PID: 6524)
      • sc.exe (PID: 6700)
      • sc.exe (PID: 6620)
      • sc.exe (PID: 3680)
      • sc.exe (PID: 6536)
      • sc.exe (PID: 2956)
      • sc.exe (PID: 68)
      • sc.exe (PID: 6812)
      • sc.exe (PID: 6976)
      • sc.exe (PID: 6500)
      • sc.exe (PID: 4908)
      • sc.exe (PID: 3900)
      • sc.exe (PID: 6652)
      • sc.exe (PID: 6580)
      • sc.exe (PID: 6988)
      • sc.exe (PID: 6944)
      • sc.exe (PID: 7036)
      • sc.exe (PID: 7080)
      • sc.exe (PID: 4300)
      • sc.exe (PID: 7092)
      • sc.exe (PID: 6076)
      • sc.exe (PID: 6716)
      • sc.exe (PID: 4120)
      • sc.exe (PID: 4512)
      • sc.exe (PID: 6376)
      • sc.exe (PID: 5456)
      • sc.exe (PID: 1620)
      • sc.exe (PID: 6888)
      • sc.exe (PID: 6960)
      • sc.exe (PID: 7024)
      • sc.exe (PID: 7100)
      • sc.exe (PID: 4576)
      • sc.exe (PID: 2744)
      • sc.exe (PID: 5936)
      • sc.exe (PID: 2680)
      • sc.exe (PID: 5988)
      • sc.exe (PID: 1868)
      • sc.exe (PID: 5536)
      • sc.exe (PID: 4816)
      • sc.exe (PID: 1856)
      • sc.exe (PID: 6428)
      • sc.exe (PID: 3488)
      • sc.exe (PID: 3260)
      • sc.exe (PID: 6160)
      • sc.exe (PID: 3836)
      • sc.exe (PID: 6456)
      • sc.exe (PID: 2940)
      • sc.exe (PID: 5628)
      • sc.exe (PID: 6568)
      • sc.exe (PID: 6308)
      • sc.exe (PID: 6328)
      • sc.exe (PID: 3876)
      • sc.exe (PID: 6476)
      • sc.exe (PID: 5212)
      • sc.exe (PID: 4020)
      • sc.exe (PID: 6508)
      • sc.exe (PID: 6292)
      • sc.exe (PID: 5340)
      • sc.exe (PID: 6588)
      • sc.exe (PID: 6596)
      • sc.exe (PID: 6624)
      • sc.exe (PID: 6780)
      • sc.exe (PID: 6524)
      • sc.exe (PID: 1328)
      • sc.exe (PID: 6536)
      • sc.exe (PID: 6776)
      • sc.exe (PID: 6700)
      • sc.exe (PID: 5316)
      • sc.exe (PID: 2956)
      • sc.exe (PID: 2160)
      • sc.exe (PID: 4548)
      • sc.exe (PID: 6856)
      • sc.exe (PID: 1864)
      • sc.exe (PID: 556)
      • sc.exe (PID: 6620)
      • sc.exe (PID: 4400)
      • sc.exe (PID: 4908)
      • sc.exe (PID: 6872)
      • sc.exe (PID: 6896)
      • sc.exe (PID: 7052)
      • sc.exe (PID: 6944)
      • sc.exe (PID: 3612)
      • sc.exe (PID: 7036)
      • sc.exe (PID: 7072)
      • sc.exe (PID: 4300)
      • sc.exe (PID: 4536)
      • sc.exe (PID: 7100)
      • sc.exe (PID: 4512)
      • sc.exe (PID: 6976)
      • sc.exe (PID: 6952)
      • sc.exe (PID: 7044)
      • sc.exe (PID: 6864)
      • sc.exe (PID: 4596)
      • sc.exe (PID: 2216)
      • sc.exe (PID: 5556)
      • sc.exe (PID: 6076)
      • sc.exe (PID: 4708)
      • sc.exe (PID: 1620)
      • sc.exe (PID: 2612)
      • sc.exe (PID: 7100)
      • sc.exe (PID: 7068)
      • sc.exe (PID: 3732)
      • sc.exe (PID: 7036)
      • sc.exe (PID: 7012)
      • sc.exe (PID: 7092)
      • sc.exe (PID: 4300)
      • sc.exe (PID: 5156)
      • sc.exe (PID: 7024)
      • sc.exe (PID: 5456)
      • sc.exe (PID: 5388)
      • sc.exe (PID: 4576)
      • sc.exe (PID: 5988)
      • sc.exe (PID: 1796)
      • sc.exe (PID: 1416)
      • sc.exe (PID: 540)
      • sc.exe (PID: 880)
      • sc.exe (PID: 5496)
      • sc.exe (PID: 6472)
      • sc.exe (PID: 5536)
      • sc.exe (PID: 6464)
      • sc.exe (PID: 6372)
      • sc.exe (PID: 2124)
      • sc.exe (PID: 2324)
      • sc.exe (PID: 5580)
      • sc.exe (PID: 4804)
      • sc.exe (PID: 4556)
      • sc.exe (PID: 6324)
      • sc.exe (PID: 3568)
      • sc.exe (PID: 6460)
      • sc.exe (PID: 1168)
      • sc.exe (PID: 2560)
      • sc.exe (PID: 1176)
      • sc.exe (PID: 3828)
      • sc.exe (PID: 4544)
      • sc.exe (PID: 6560)
      • sc.exe (PID: 716)
      • sc.exe (PID: 6284)
      • sc.exe (PID: 6552)
      • sc.exe (PID: 6416)
      • sc.exe (PID: 4264)
      • sc.exe (PID: 6056)
      • sc.exe (PID: 6404)
      • sc.exe (PID: 6412)
      • sc.exe (PID: 6252)
      • sc.exe (PID: 6452)
      • sc.exe (PID: 1760)
      • sc.exe (PID: 6160)
      • sc.exe (PID: 4020)
      • sc.exe (PID: 6856)
      • sc.exe (PID: 6628)
      • sc.exe (PID: 5652)
      • sc.exe (PID: 6592)
      • sc.exe (PID: 1864)
      • sc.exe (PID: 5316)
      • sc.exe (PID: 6624)
      • sc.exe (PID: 6580)
      • sc.exe (PID: 3680)
      • sc.exe (PID: 6492)
      • sc.exe (PID: 1540)
      • sc.exe (PID: 3364)
      • sc.exe (PID: 6772)
      • sc.exe (PID: 5080)
      • sc.exe (PID: 5256)
      • sc.exe (PID: 3080)
      • sc.exe (PID: 6156)
      • sc.exe (PID: 6900)
      • sc.exe (PID: 6200)
      • sc.exe (PID: 6896)
      • sc.exe (PID: 6876)
      • sc.exe (PID: 3900)
      • sc.exe (PID: 6888)
      • sc.exe (PID: 6912)
      • sc.exe (PID: 7048)
      • sc.exe (PID: 3732)
      • sc.exe (PID: 7096)
      • sc.exe (PID: 7012)
      • sc.exe (PID: 6340)
      • sc.exe (PID: 2396)
      • sc.exe (PID: 4336)
      • sc.exe (PID: 6848)
      • sc.exe (PID: 6828)
      • sc.exe (PID: 6796)
      • sc.exe (PID: 6712)
      • sc.exe (PID: 2324)
      • sc.exe (PID: 4992)
      • sc.exe (PID: 5392)
      • sc.exe (PID: 1520)
      • sc.exe (PID: 7100)
      • sc.exe (PID: 6288)
      • sc.exe (PID: 1064)
      • sc.exe (PID: 6352)
      • sc.exe (PID: 6056)
      • sc.exe (PID: 1228)
      • sc.exe (PID: 1468)
      • sc.exe (PID: 7012)
      • sc.exe (PID: 5912)
      • sc.exe (PID: 644)
      • sc.exe (PID: 6756)
      • sc.exe (PID: 1944)
      • sc.exe (PID: 4708)
      • sc.exe (PID: 1448)
      • sc.exe (PID: 6676)
      • sc.exe (PID: 1856)
      • sc.exe (PID: 3744)
      • sc.exe (PID: 6148)
      • sc.exe (PID: 3288)
      • sc.exe (PID: 5156)
      • sc.exe (PID: 6468)
      • sc.exe (PID: 236)
      • sc.exe (PID: 2712)
      • sc.exe (PID: 6056)
      • sc.exe (PID: 6660)
      • sc.exe (PID: 6576)
      • sc.exe (PID: 6592)
      • sc.exe (PID: 6644)
      • sc.exe (PID: 6628)
      • sc.exe (PID: 6440)
      • sc.exe (PID: 5752)
      • sc.exe (PID: 5740)
      • sc.exe (PID: 1064)
      • sc.exe (PID: 1480)
      • sc.exe (PID: 1228)
      • sc.exe (PID: 1540)
      • sc.exe (PID: 3364)
      • sc.exe (PID: 3280)
      • sc.exe (PID: 6608)
      • sc.exe (PID: 6496)
      • sc.exe (PID: 6624)
      • sc.exe (PID: 6520)
      • sc.exe (PID: 6492)
      • sc.exe (PID: 6920)
      • sc.exe (PID: 6988)
      • sc.exe (PID: 6836)
      • sc.exe (PID: 3060)
      • sc.exe (PID: 6700)
      • sc.exe (PID: 6852)
      • sc.exe (PID: 5256)
      • sc.exe (PID: 6208)
      • sc.exe (PID: 6832)
      • sc.exe (PID: 6828)
      • sc.exe (PID: 2956)
      • sc.exe (PID: 1016)
      • sc.exe (PID: 4080)
      • sc.exe (PID: 6364)
      • sc.exe (PID: 5508)
      • sc.exe (PID: 1596)
      • sc.exe (PID: 3732)
      • sc.exe (PID: 7108)
      • sc.exe (PID: 6888)
      • sc.exe (PID: 7064)
      • sc.exe (PID: 6768)
      • sc.exe (PID: 5692)
      • sc.exe (PID: 4408)
      • sc.exe (PID: 3984)
      • sc.exe (PID: 6756)
      • sc.exe (PID: 4512)
      • sc.exe (PID: 5456)
      • sc.exe (PID: 5544)
      • sc.exe (PID: 4120)
      • sc.exe (PID: 6744)
      • sc.exe (PID: 4300)
      • sc.exe (PID: 5916)
      • sc.exe (PID: 4992)
      • sc.exe (PID: 4708)
      • sc.exe (PID: 1416)
      • sc.exe (PID: 2844)
      • sc.exe (PID: 5400)
      • sc.exe (PID: 2072)
      • sc.exe (PID: 1200)
      • sc.exe (PID: 4228)
      • sc.exe (PID: 1512)
      • sc.exe (PID: 5000)
      • sc.exe (PID: 1348)
      • sc.exe (PID: 4576)
      • sc.exe (PID: 880)
      • sc.exe (PID: 1692)
      • sc.exe (PID: 6420)
      • sc.exe (PID: 5628)
      • sc.exe (PID: 3488)
      • sc.exe (PID: 6016)
      • sc.exe (PID: 6164)
      • sc.exe (PID: 3260)
      • sc.exe (PID: 3712)
      • sc.exe (PID: 2608)
      • sc.exe (PID: 1580)
      • sc.exe (PID: 4544)
      • sc.exe (PID: 6956)
      • sc.exe (PID: 6264)
      • sc.exe (PID: 6572)
      • sc.exe (PID: 6948)
      • sc.exe (PID: 5740)
      • sc.exe (PID: 2980)
      • sc.exe (PID: 6304)
      • sc.exe (PID: 2880)
      • sc.exe (PID: 636)
      • sc.exe (PID: 4456)
      • sc.exe (PID: 3864)
      • sc.exe (PID: 188)
      • sc.exe (PID: 1480)
      • sc.exe (PID: 6608)
      • sc.exe (PID: 6932)
      • sc.exe (PID: 1228)
      • sc.exe (PID: 4036)
      • sc.exe (PID: 6604)
      • sc.exe (PID: 648)
      • sc.exe (PID: 6592)
      • sc.exe (PID: 5992)
      • sc.exe (PID: 6988)
      • sc.exe (PID: 6888)
      • sc.exe (PID: 4580)
      • sc.exe (PID: 6980)
      • sc.exe (PID: 3900)
      • sc.exe (PID: 6796)
      • sc.exe (PID: 6984)
      • sc.exe (PID: 5544)
      • sc.exe (PID: 5456)
      • sc.exe (PID: 5568)
      • sc.exe (PID: 5936)
      • sc.exe (PID: 6860)
      • sc.exe (PID: 1416)
      • sc.exe (PID: 6420)
      • sc.exe (PID: 3416)

    • Detects reflection assembly loader (YARA)

      • powershell.exe (PID: 5604)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6296)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 6232)
      • powershell.exe (PID: 1540)

    • Removes files via Powershell

      • powershell.exe (PID: 6232)
      • powershell.exe (PID: 1540)

    • Executable content was dropped or overwritten

      • tar.exe (PID: 2260)
      • curl.exe (PID: 3176)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 6296)

    • Process uses powershell cmdlet to discover network configuration

      • cmd.exe (PID: 6296)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6296)
      • cmd.exe (PID: 6840)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6296)
      • cmd.exe (PID: 1688)

    • Sets the service to start on system boot

      • sc.exe (PID: 6448)
      • sc.exe (PID: 6556)
      • sc.exe (PID: 6328)
      • sc.exe (PID: 3876)
      • sc.exe (PID: 6584)
      • sc.exe (PID: 6608)
      • sc.exe (PID: 6620)
      • sc.exe (PID: 6732)
      • sc.exe (PID: 732)
      • sc.exe (PID: 6928)
      • sc.exe (PID: 6488)
      • sc.exe (PID: 4336)
      • sc.exe (PID: 5912)
      • sc.exe (PID: 7096)
      • sc.exe (PID: 3612)
      • sc.exe (PID: 6376)
      • sc.exe (PID: 1416)
      • sc.exe (PID: 2548)
      • sc.exe (PID: 3288)
      • sc.exe (PID: 6460)
      • sc.exe (PID: 4020)
      • sc.exe (PID: 2976)
      • sc.exe (PID: 1828)
      • sc.exe (PID: 6352)
      • sc.exe (PID: 3364)
      • sc.exe (PID: 6960)
      • sc.exe (PID: 6984)
      • sc.exe (PID: 6752)
      • sc.exe (PID: 4804)
      • sc.exe (PID: 2216)
      • sc.exe (PID: 3836)
      • sc.exe (PID: 2680)
      • sc.exe (PID: 720)
      • sc.exe (PID: 6368)
      • sc.exe (PID: 6408)
      • sc.exe (PID: 2736)
      • sc.exe (PID: 6572)
      • sc.exe (PID: 6328)
      • sc.exe (PID: 6152)
      • sc.exe (PID: 640)
      • sc.exe (PID: 6776)
      • sc.exe (PID: 6704)
      • sc.exe (PID: 5316)
      • sc.exe (PID: 4548)
      • sc.exe (PID: 3144)
      • sc.exe (PID: 6864)
      • sc.exe (PID: 2216)
      • sc.exe (PID: 880)
      • sc.exe (PID: 4944)
      • sc.exe (PID: 6556)
      • sc.exe (PID: 6412)
      • sc.exe (PID: 6812)
      • sc.exe (PID: 644)
      • sc.exe (PID: 1740)
      • sc.exe (PID: 6340)
      • sc.exe (PID: 3772)
      • sc.exe (PID: 3260)
      • sc.exe (PID: 4840)
      • sc.exe (PID: 6196)

    • Modifies existing scheduled task

      • schtasks.exe (PID: 1448)
      • schtasks.exe (PID: 3632)
      • schtasks.exe (PID: 3560)
      • schtasks.exe (PID: 4872)
      • schtasks.exe (PID: 2680)
      • schtasks.exe (PID: 1344)
      • schtasks.exe (PID: 1868)
      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 236)
      • schtasks.exe (PID: 5212)
      • schtasks.exe (PID: 2776)
      • schtasks.exe (PID: 6428)
      • schtasks.exe (PID: 6380)
      • schtasks.exe (PID: 6464)
      • schtasks.exe (PID: 2844)
      • schtasks.exe (PID: 4840)
      • schtasks.exe (PID: 880)
      • schtasks.exe (PID: 6168)
      • schtasks.exe (PID: 3260)
      • schtasks.exe (PID: 6368)
      • schtasks.exe (PID: 2976)
      • schtasks.exe (PID: 5520)
      • schtasks.exe (PID: 6316)
      • schtasks.exe (PID: 1828)
      • schtasks.exe (PID: 6268)
      • schtasks.exe (PID: 6508)
      • schtasks.exe (PID: 6380)
      • schtasks.exe (PID: 6504)
      • schtasks.exe (PID: 3416)
      • schtasks.exe (PID: 3828)
      • schtasks.exe (PID: 6568)
      • schtasks.exe (PID: 6272)
      • schtasks.exe (PID: 6288)
      • schtasks.exe (PID: 6956)
      • schtasks.exe (PID: 6400)
      • schtasks.exe (PID: 6816)
      • schtasks.exe (PID: 1480)
      • schtasks.exe (PID: 6856)
      • schtasks.exe (PID: 6604)
      • schtasks.exe (PID: 6180)
      • schtasks.exe (PID: 6584)
      • schtasks.exe (PID: 1864)
      • schtasks.exe (PID: 6496)
      • schtasks.exe (PID: 6620)
      • schtasks.exe (PID: 6520)
      • schtasks.exe (PID: 1328)
      • schtasks.exe (PID: 2996)
      • schtasks.exe (PID: 6792)
      • schtasks.exe (PID: 2132)
      • schtasks.exe (PID: 6704)
      • schtasks.exe (PID: 5316)
      • schtasks.exe (PID: 2160)
      • schtasks.exe (PID: 6208)
      • schtasks.exe (PID: 308)
      • schtasks.exe (PID: 4400)
      • schtasks.exe (PID: 4908)
      • schtasks.exe (PID: 1016)
      • schtasks.exe (PID: 7004)
      • schtasks.exe (PID: 6896)
      • schtasks.exe (PID: 7108)
      • schtasks.exe (PID: 7016)
      • schtasks.exe (PID: 6796)
      • schtasks.exe (PID: 6760)
      • schtasks.exe (PID: 6736)
      • schtasks.exe (PID: 3996)
      • schtasks.exe (PID: 2928)
      • schtasks.exe (PID: 5696)
      • schtasks.exe (PID: 4944)
      • schtasks.exe (PID: 4512)
      • schtasks.exe (PID: 1348)
      • schtasks.exe (PID: 3612)
      • schtasks.exe (PID: 3732)
      • schtasks.exe (PID: 7084)
      • schtasks.exe (PID: 4536)
      • schtasks.exe (PID: 7012)
      • schtasks.exe (PID: 836)
      • schtasks.exe (PID: 4228)
      • schtasks.exe (PID: 6260)
      • schtasks.exe (PID: 3288)
      • schtasks.exe (PID: 2744)
      • schtasks.exe (PID: 3124)
      • schtasks.exe (PID: 6016)
      • schtasks.exe (PID: 5548)
      • schtasks.exe (PID: 5092)
      • schtasks.exe (PID: 720)
      • schtasks.exe (PID: 2608)
      • schtasks.exe (PID: 5160)
      • schtasks.exe (PID: 3664)
      • schtasks.exe (PID: 1416)
      • schtasks.exe (PID: 6480)
      • schtasks.exe (PID: 1544)
      • schtasks.exe (PID: 1668)
      • schtasks.exe (PID: 2956)
      • schtasks.exe (PID: 2012)
      • schtasks.exe (PID: 2040)
      • schtasks.exe (PID: 6888)
      • schtasks.exe (PID: 6796)
      • schtasks.exe (PID: 7052)
      • schtasks.exe (PID: 7048)
      • schtasks.exe (PID: 6200)
      • schtasks.exe (PID: 68)
      • schtasks.exe (PID: 1688)
      • schtasks.exe (PID: 5112)
      • schtasks.exe (PID: 4556)
      • schtasks.exe (PID: 1828)
      • schtasks.exe (PID: 1176)
      • schtasks.exe (PID: 4020)
      • schtasks.exe (PID: 6292)
      • schtasks.exe (PID: 3836)
      • schtasks.exe (PID: 4932)
      • schtasks.exe (PID: 5240)
      • schtasks.exe (PID: 6056)
      • schtasks.exe (PID: 6616)
      • schtasks.exe (PID: 6892)
      • schtasks.exe (PID: 6656)
      • schtasks.exe (PID: 6592)
      • schtasks.exe (PID: 6488)
      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 6404)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 6956)
      • schtasks.exe (PID: 6180)
      • schtasks.exe (PID: 6608)
      • schtasks.exe (PID: 3680)
      • schtasks.exe (PID: 6792)
      • schtasks.exe (PID: 6500)
      • schtasks.exe (PID: 6904)
      • schtasks.exe (PID: 7056)
      • schtasks.exe (PID: 7004)
      • schtasks.exe (PID: 6988)
      • schtasks.exe (PID: 6836)
      • schtasks.exe (PID: 2380)
      • schtasks.exe (PID: 1668)
      • schtasks.exe (PID: 3280)
      • schtasks.exe (PID: 6772)
      • schtasks.exe (PID: 308)
      • schtasks.exe (PID: 2040)
      • schtasks.exe (PID: 2160)
      • schtasks.exe (PID: 3732)
      • schtasks.exe (PID: 4120)
      • schtasks.exe (PID: 6224)
      • schtasks.exe (PID: 6716)
      • schtasks.exe (PID: 6200)
      • schtasks.exe (PID: 7048)
      • schtasks.exe (PID: 2388)
      • schtasks.exe (PID: 4028)
      • schtasks.exe (PID: 5816)
      • schtasks.exe (PID: 6664)
      • schtasks.exe (PID: 5588)

    • Starts process via Powershell

      • powershell.exe (PID: 4512)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6296)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6296)
      • cmd.exe (PID: 1688)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 6296)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 5112)
      • schtasks.exe (PID: 1200)
      • schtasks.exe (PID: 4804)
      • schtasks.exe (PID: 2312)
      • schtasks.exe (PID: 5040)
      • schtasks.exe (PID: 3812)
      • schtasks.exe (PID: 5748)
      • schtasks.exe (PID: 3744)
      • schtasks.exe (PID: 5512)
      • schtasks.exe (PID: 1348)
      • schtasks.exe (PID: 6668)
      • schtasks.exe (PID: 768)
      • schtasks.exe (PID: 5400)
      • schtasks.exe (PID: 1856)
      • schtasks.exe (PID: 5244)
      • schtasks.exe (PID: 3840)
      • schtasks.exe (PID: 5548)
      • schtasks.exe (PID: 6232)
      • schtasks.exe (PID: 2712)
      • schtasks.exe (PID: 2324)
      • schtasks.exe (PID: 2928)
      • schtasks.exe (PID: 3532)
      • schtasks.exe (PID: 5112)
      • schtasks.exe (PID: 2548)
      • schtasks.exe (PID: 4708)
      • schtasks.exe (PID: 4228)
      • schtasks.exe (PID: 1448)
      • schtasks.exe (PID: 5000)
      • schtasks.exe (PID: 3560)
      • schtasks.exe (PID: 720)
      • schtasks.exe (PID: 5888)
      • schtasks.exe (PID: 2940)
      • schtasks.exe (PID: 5936)
      • schtasks.exe (PID: 3060)
      • schtasks.exe (PID: 1684)
      • schtasks.exe (PID: 5628)

    • Stops a currently running service

      • sc.exe (PID: 6552)
      • sc.exe (PID: 6572)
      • sc.exe (PID: 4076)
      • sc.exe (PID: 6948)
      • sc.exe (PID: 6440)
      • sc.exe (PID: 2736)
      • sc.exe (PID: 6420)
      • sc.exe (PID: 3620)
      • sc.exe (PID: 6284)

    • Creates or modifies Windows services

      • reg.exe (PID: 2396)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 6976)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 6296)

    • Uses TASKKILL.EXE to kill Browsers

      • cmd.exe (PID: 6296)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3712)

    • Uses WMIC.EXE to obtain commands that are run when users log in

      • cmd.exe (PID: 68)

  • INFO

    • The process uses the downloaded file

      • powershell.exe (PID: 7008)
      • powershell.exe (PID: 1740)

    • Manual execution by a user

      • cmd.exe (PID: 5752)

    • The sample compiled with english language support

      • tar.exe (PID: 2260)
      • curl.exe (PID: 6900)
      • curl.exe (PID: 3176)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6296)

    • Execution of CURL command

      • cmd.exe (PID: 6296)

    • Checks supported languages

      • curl.exe (PID: 6900)
      • tar.exe (PID: 2260)
      • chcp.com (PID: 7044)
      • chcp.com (PID: 6468)
      • chcp.com (PID: 6784)
      • chcp.com (PID: 6156)
      • OOSU10.exe (PID: 6648)
      • chcp.com (PID: 6552)
      • NSudoLG.exe (PID: 3480)

    • Reads the computer name

      • curl.exe (PID: 6900)
      • NSudoLG.exe (PID: 3480)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4136)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 5000)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5000)

    • Changes the registry key values via Powershell

      • cmd.exe (PID: 6296)

    • Reads mouse settings

      • reg.exe (PID: 7108)

    • Reads the machine GUID from the registry

      • OOSU10.exe (PID: 6648)

    • Reads Microsoft Office registry keys

      • OOSU10.exe (PID: 6648)

    • Sends debugging messages

      • StartMenuExperienceHost.exe (PID: 6224)

    • Manages system restore points

      • SrTasks.exe (PID: 6708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.cnt | Help File Contents (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
1 252
Monitored processes
1 131
Malicious processes
11
Suspicious processes
5

Behavior graph

Click at the process to see the details
start start cmd.exe no specs conhost.exe no specs fltmc.exe no specs powershell.exe no specs powershell.exe no specs timeout.exe no specs powershell.exe no specs cmd.exe conhost.exe no specs fltmc.exe no specs cmd.exe no specs reg.exe no specs findstr.exe no specs powershell.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs fltmc.exe no specs powershell.exe no specs powershell.exe no specs timeout.exe no specs powershell.exe no specs cmd.exe conhost.exe no specs fltmc.exe no specs cmd.exe no specs reg.exe no specs findstr.exe no specs powershell.exe no specs powershell.exe no specs sc.exe no specs find.exe no specs find.exe no specs curl.exe timeout.exe no specs tar.exe sc.exe no specs find.exe no specs find.exe no specs chcp.com no specs timeout.exe no specs chcp.com no specs chcp.com no specs powershell.exe no specs timeout.exe no specs chcp.com no specs timeout.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs powershell.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs powershell.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs powershell.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs powercfg.exe no specs timeout.exe no specs sc.exe no specs sc.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs powershell.exe no specs timeout.exe no specs reg.exe no specs timeout.exe no specs shellexperiencehost.exe no specs chcp.com no specs timeout.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs timeout.exe no specs timeout.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs bcdedit.exe no specs cmd.exe no specs reg.exe no specs findstr.exe no specs powershell.exe no specs taskmgr.exe no specs timeout.exe no specs reg.exe no specs taskkill.exe no specs reg.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs icacls.exe no specs reg.exe no specs timeout.exe no specs chcp.com no specs chcp.com no specs oosu10.exe no specs timeout.exe no specs chcp.com no specs timeout.exe no specs chcp.com no specs timeout.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs timeout.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs timeout.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs timeout.exe no specs sc.exe no specs sc.exe no specs schtasks.exe no specs schtasks.exe no specs timeout.exe no specs sc.exe no specs sc.exe no specs timeout.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs timeout.exe no specs chcp.com no specs timeout.exe no specs chcp.com no specs timeout.exe no specs chcp.com no specs timeout.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs timeout.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs timeout.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs timeout.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs taskkill.exe no specs taskkill.exe no specs net.exe no specs taskkill.exe no specs net1.exe no specs taskkill.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs net.exe no specs net1.exe no specs sc.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs timeout.exe no specs nsudolg.exe no specs cmd.exe conhost.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs timeout.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs timeout.exe no specs takeown.exe no specs icacls.exe no specs timeout.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs timeout.exe no specs taskkill.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs explorer.exe no specs timeout.exe no specs explorer.exe no specs takeown.exe no specs icacls.exe no specs timeout.exe no specs startmenuexperiencehost.exe no specs textinputhost.exe no specs searchapp.exe no specs taskkill.exe no specs taskkill.exe no specs shellexperiencehost.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs takeown.exe no specs icacls.exe no specs takeown.exe no specs icacls.exe no specs timeout.exe no specs takeown.exe no specs icacls.exe no specs timeout.exe no specs mobsync.exe no specs chcp.com no specs powershell.exe no specs timeout.exe no specs takeown.exe no specs icacls.exe no specs takeown.exe no specs icacls.exe no specs takeown.exe no specs icacls.exe no specs timeout.exe no specs chcp.com no specs powershell.exe no specs chcp.com no specs curl.exe curl.exe timeout.exe no specs openshellsetup_4_4_191.exe no specs chcp.com no specs powershell.exe no specs msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs cmd.exe no specs wmic.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs chcp.com no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
68sc config VSS start=demandC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
68schtasks /Change /TN "Microsoft\Windows\InstallService\ScanForUpdates" /DisableC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
68C:\WINDOWS\system32\cmd.exe /c wmic startup get caption /format:listC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
188sc config IntelAudioService start=disabled C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
236schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /Disable C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
236sc config lmhosts start= disabledC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
236net stop "ccleaner" C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\mpr.dll
308schtasks /Change /TN "Microsoft\Windows\MUI\LPRemove" /DisableC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
308schtasks /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /DisableC:\Windows\System32\schtasks.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
396\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
210 978
Read events
210 311
Write events
577
Delete events
90

Modification events

(PID) Process:(7008) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(7008) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(1348) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
Operation:writeName:PublishUserActivities
Value:
0
(PID) Process:(2680) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
Operation:writeName:UploadUserActivities
Value:
0
(PID) Process:(3532) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
Operation:writeName:EnableActivityFeed
Value:
0
(PID) Process:(440) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}
Operation:writeName:SensorPermissionState
Value:
0
(PID) Process:(5460) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lfsvc\Service\Configuration
Operation:writeName:Status
Value:
0
(PID) Process:(2280) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location
Operation:writeName:Value
Value:
Deny
(PID) Process:(4244) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Maps
Operation:writeName:AutoUpdateEnabled
Value:
0
(PID) Process:(1856) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer
Operation:writeName:DisableNotificationCenter
Value:
1
Executable files
6
Suspicious files
8
Text files
92
Unknown types
0

Dropped files

PID
Process
Filename
Type
7008powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ykttymii.0qv.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7008powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_gosjacel.ujj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6892powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xvqwis0j.qsw.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6796powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:F6E10ABCBA9F8A5F239F28400FC117C2
SHA256:D3E009861C237EF2CC859C17F6CD352C27B1C95AC8486A44729A4D3CA50F68F9
6088powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_aol3ddlg.qg5.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6428powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lkyfztcf.seu.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6428powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lus1flv2.25s.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5604powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rhfbsavq.gu3.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6088powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0j4fpt2y.shm.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5604powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0rmsodgj.jrk.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
14
DNS requests
8
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
760
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
760
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEE4o94a2bBo7lCzSxA63QqU%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6900
curl.exe
140.82.121.3:443
github.com
GITHUB
US
shared
760
lsass.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
6900
curl.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
shared
760
lsass.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2192
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2192
svchost.exe
224.0.0.251:5353
—
—
—
unknown
3176
curl.exe
140.82.121.3:443
github.com
GITHUB
US
shared
3176
curl.exe
185.199.109.133:443
objects.githubusercontent.com
FASTLY
US
shared

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.3
shared
ocsp.comodoca.com
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
shared
ocsp.digicert.com
  • 192.229.221.95
whitelisted
self.events.data.microsoft.com
  • 104.46.162.224
whitelisted
objects.githubusercontent.com
  • 185.199.109.133
shared

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Oneclick-V7.0.bat