File name:

trigger.ps1

Full analysis: https://app.any.run/tasks/d6556770-57f5-4c69-9284-764ff062a431
Verdict: Malicious activity
Analysis date: June 21, 2025, 16:45:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

6B335A726BDC8DA1F5C17610814BACDE

SHA1:

FB298264F72B3B710E59684422AA920413E82A2E

SHA256:

9A811286FB857F62447485A634517E314A39DE2DCF7F7389B4C599BA68758613

SSDEEP:

6:SdziFUUyO8Ea+8GfXQLEwNgi0T5RoqzUUEUIR9:7U9EKG0EwH0vdy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2076)
      • powershell.exe (PID: 4576)
      • powershell.exe (PID: 5060)
      • powershell.exe (PID: 5020)
      • powershell.exe (PID: 5232)
      • powershell.exe (PID: 1356)
      • powershell.exe (PID: 2792)
      • powershell.exe (PID: 5476)
      • powershell.exe (PID: 592)
      • powershell.exe (PID: 1644)
      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 5848)
      • powershell.exe (PID: 1652)
      • powershell.exe (PID: 6424)
      • powershell.exe (PID: 472)
      • powershell.exe (PID: 6852)
      • powershell.exe (PID: 5264)
      • powershell.exe (PID: 2524)
      • powershell.exe (PID: 3388)
      • powershell.exe (PID: 4752)
      • powershell.exe (PID: 5896)
      • powershell.exe (PID: 5368)
      • powershell.exe (PID: 6508)
      • powershell.exe (PID: 4216)
      • powershell.exe (PID: 5600)
      • powershell.exe (PID: 6128)
      • powershell.exe (PID: 1752)
      • powershell.exe (PID: 6256)
      • powershell.exe (PID: 6900)
      • powershell.exe (PID: 5764)
      • powershell.exe (PID: 6140)
      • powershell.exe (PID: 4760)
      • powershell.exe (PID: 6308)
      • powershell.exe (PID: 7052)
      • powershell.exe (PID: 4708)
      • powershell.exe (PID: 2040)
      • powershell.exe (PID: 6360)
      • powershell.exe (PID: 4088)
      • powershell.exe (PID: 6212)
      • powershell.exe (PID: 6380)
      • powershell.exe (PID: 5908)
      • powershell.exe (PID: 4476)
      • powershell.exe (PID: 3160)
      • powershell.exe (PID: 3732)
      • powershell.exe (PID: 2044)
      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 3964)
      • powershell.exe (PID: 2708)
      • powershell.exe (PID: 4808)
      • powershell.exe (PID: 7140)
      • powershell.exe (PID: 7080)
      • powershell.exe (PID: 360)
      • powershell.exe (PID: 3568)
      • powershell.exe (PID: 1268)
      • powershell.exe (PID: 3956)

    • Changes Windows Defender settings

      • powershell.exe (PID: 2076)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 2076)

    • Adds path to the Windows Defender exclusion list

      • powershell.exe (PID: 2076)

  • SUSPICIOUS

    • Application launched itself

      • powershell.exe (PID: 2076)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 2076)

    • Script adds exclusion path to Windows Defender

      • powershell.exe (PID: 2076)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 2076)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 2076)

    • Checks proxy server information

      • powershell.exe (PID: 2076)
      • slui.exe (PID: 6232)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4576)
      • powershell.exe (PID: 5060)
      • powershell.exe (PID: 5020)
      • powershell.exe (PID: 5232)
      • powershell.exe (PID: 2792)
      • powershell.exe (PID: 1356)
      • powershell.exe (PID: 5476)
      • powershell.exe (PID: 592)
      • powershell.exe (PID: 1644)
      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 5848)
      • powershell.exe (PID: 1652)
      • powershell.exe (PID: 6424)
      • powershell.exe (PID: 5896)
      • powershell.exe (PID: 472)
      • powershell.exe (PID: 3388)
      • powershell.exe (PID: 6852)
      • powershell.exe (PID: 2524)
      • powershell.exe (PID: 4752)
      • powershell.exe (PID: 5368)
      • powershell.exe (PID: 4216)
      • powershell.exe (PID: 5600)
      • powershell.exe (PID: 6508)
      • powershell.exe (PID: 6128)
      • powershell.exe (PID: 1752)
      • powershell.exe (PID: 5264)
      • powershell.exe (PID: 6256)
      • powershell.exe (PID: 6900)
      • powershell.exe (PID: 6140)
      • powershell.exe (PID: 5764)
      • powershell.exe (PID: 4708)
      • powershell.exe (PID: 2040)
      • powershell.exe (PID: 4760)
      • powershell.exe (PID: 7052)
      • powershell.exe (PID: 6308)
      • powershell.exe (PID: 6360)
      • powershell.exe (PID: 6212)
      • powershell.exe (PID: 6380)
      • powershell.exe (PID: 4476)
      • powershell.exe (PID: 5908)
      • powershell.exe (PID: 3160)
      • powershell.exe (PID: 4088)
      • powershell.exe (PID: 3732)
      • powershell.exe (PID: 2044)
      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 3964)
      • powershell.exe (PID: 2708)
      • powershell.exe (PID: 7140)
      • powershell.exe (PID: 360)
      • powershell.exe (PID: 3568)
      • powershell.exe (PID: 1268)
      • powershell.exe (PID: 4808)
      • powershell.exe (PID: 3956)
      • powershell.exe (PID: 7080)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4576)
      • powershell.exe (PID: 5060)
      • powershell.exe (PID: 5020)
      • powershell.exe (PID: 5232)
      • powershell.exe (PID: 1356)
      • powershell.exe (PID: 5476)
      • powershell.exe (PID: 2792)
      • powershell.exe (PID: 6424)
      • powershell.exe (PID: 1644)
      • powershell.exe (PID: 592)
      • powershell.exe (PID: 5848)
      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 1652)
      • powershell.exe (PID: 6852)
      • powershell.exe (PID: 2524)
      • powershell.exe (PID: 472)
      • powershell.exe (PID: 3388)
      • powershell.exe (PID: 4752)
      • powershell.exe (PID: 5264)
      • powershell.exe (PID: 5896)
      • powershell.exe (PID: 5368)
      • powershell.exe (PID: 5600)
      • powershell.exe (PID: 6508)
      • powershell.exe (PID: 4216)
      • powershell.exe (PID: 6128)
      • powershell.exe (PID: 1752)
      • powershell.exe (PID: 6256)
      • powershell.exe (PID: 6900)
      • powershell.exe (PID: 5764)
      • powershell.exe (PID: 6140)
      • powershell.exe (PID: 7052)
      • powershell.exe (PID: 4708)
      • powershell.exe (PID: 6308)
      • powershell.exe (PID: 2040)
      • powershell.exe (PID: 4760)
      • powershell.exe (PID: 6360)
      • powershell.exe (PID: 4088)
      • powershell.exe (PID: 6212)
      • powershell.exe (PID: 4476)
      • powershell.exe (PID: 5908)
      • powershell.exe (PID: 3160)
      • powershell.exe (PID: 6380)
      • powershell.exe (PID: 2044)
      • powershell.exe (PID: 2708)
      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 3964)
      • powershell.exe (PID: 4808)
      • powershell.exe (PID: 3732)
      • powershell.exe (PID: 7140)
      • powershell.exe (PID: 3568)
      • powershell.exe (PID: 7080)
      • powershell.exe (PID: 360)
      • powershell.exe (PID: 1268)
      • powershell.exe (PID: 3956)

    • Reads the software policy settings

      • slui.exe (PID: 6232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
299
Monitored processes
111
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs slui.exe powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
360"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
472"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
592\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
592"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
868\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1044\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1268"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1356"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $ErrorActionPreference='Stop'; Add-MpPreference -ExclusionPath 'C:\Windows\Temp' C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
314 487
Read events
314 487
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
166
Text files
110
Unknown types
0

Dropped files

PID
Process
Filename
Type
2076powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V1SHX9807ZTDK2AUERQU.tempbinary
MD5:3E69B6BCAD201E7FB161B3249DA56643
SHA256:04D6D5EA61CEC68C1F87596538C012D180F5E3A7FBADB868E2AA3BEC2AD50CCD
4576powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qkv1dfkg.mp0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4576powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:3484C8CCA0BD05BA1C7B89D40008BD04
SHA256:B81F0929B6A56CCB4383D61DDAB6BFCCC8D05F5E2637F3F337B1546541028E73
2076powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:3E69B6BCAD201E7FB161B3249DA56643
SHA256:04D6D5EA61CEC68C1F87596538C012D180F5E3A7FBADB868E2AA3BEC2AD50CCD
2076powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rislsvl2.yky.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5020powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF179cec.TMPbinary
MD5:85990005B5B279F36AD39447BCCA38F5
SHA256:882924970DD9BDF623F5B62334F7A0CCC5B12EA6B70DDD2D44A94A2E6D819A7A
4576powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1782cc.TMPbinary
MD5:3E69B6BCAD201E7FB161B3249DA56643
SHA256:04D6D5EA61CEC68C1F87596538C012D180F5E3A7FBADB868E2AA3BEC2AD50CCD
5060powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\X9O91Q0GE8XHN3SC1PT3.tempbinary
MD5:85990005B5B279F36AD39447BCCA38F5
SHA256:882924970DD9BDF623F5B62334F7A0CCC5B12EA6B70DDD2D44A94A2E6D819A7A
4576powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YSSUMIUQM34JLK77VIOB.tempbinary
MD5:3484C8CCA0BD05BA1C7B89D40008BD04
SHA256:B81F0929B6A56CCB4383D61DDAB6BFCCC8D05F5E2637F3F337B1546541028E73
4576powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ykvsdc05.zra.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
23
DNS requests
7
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
184.24.77.15:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.24.77.15:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5900
RUXIMICS.exe
GET
200
184.24.77.15:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5900
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2076
powershell.exe
GET
200
92.118.113.110:80
http://knmvrf.com/
unknown
—
—
unknown
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5900
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
184.24.77.15:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
184.24.77.15:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5900
RUXIMICS.exe
184.24.77.15:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 184.24.77.15
  • 184.24.77.42
  • 184.24.77.12
  • 184.24.77.37
  • 184.24.77.35
  • 184.24.77.11
  • 184.24.77.6
  • 184.24.77.14
  • 184.24.77.17
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
knmvrf.com
  • 92.118.113.110
unknown
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
self.events.data.microsoft.com
  • 20.42.73.27
whitelisted

Threats

PID
Process
Class
Message
2076
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2076
powershell.exe
Potentially Bad Traffic
ET ATTACK_RESPONSE PowerShell NoProfile Command Received In Powershell Stagers
2076
powershell.exe
A Network Trojan was detected
LOADER [ANY.RUN] Gen.Powershell.Downloader Script Payload
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
trigger.ps1