File name:

stage1.ps1

Full analysis: https://app.any.run/tasks/03c68d63-831b-41c6-b1c5-203af530f9f7
Verdict: Malicious activity
Analysis date: January 29, 2025, 00:54:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text
MD5:

406EA6B5F1E48ACF063DE5E03603F714

SHA1:

4B068CC5550C71107B8CE8F7C6CDAD0DB35DE9F6

SHA256:

A1EF73CE71725489ED221105BBF808DDD8EF9D4AB03240DD2A5FD6C065762DB4

SSDEEP:

96:BRNW9VjInbrrUQAeu+iMZ9D9bOhg8LurJlFSmPEs5ficqPBPpHPoP1:BRwVjInrUQABPMZp9UDullFS4Es56cqk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 6716)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6092)
      • powershell.exe (PID: 3076)
      • powershell.exe (PID: 2292)
      • powershell.exe (PID: 6160)
      • powershell.exe (PID: 2144)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 5736)
      • wscript.exe (PID: 2460)

    • Uses base64 encoding (SCRIPT)

      • wscript.exe (PID: 2460)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • wscript.exe (PID: 2460)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 2460)

  • SUSPICIOUS

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 6092)
      • powershell.exe (PID: 3076)
      • powershell.exe (PID: 2292)
      • powershell.exe (PID: 6160)
      • powershell.exe (PID: 2144)

    • Probably UAC bypass using CMSTP.exe (Connection Manager service profile)

      • powershell.exe (PID: 6092)
      • powershell.exe (PID: 3076)
      • powershell.exe (PID: 2292)
      • powershell.exe (PID: 6160)
      • powershell.exe (PID: 2144)

    • Identifying current user with WHOAMI command

      • powershell.exe (PID: 6092)
      • powershell.exe (PID: 3076)
      • powershell.exe (PID: 2292)
      • powershell.exe (PID: 6160)
      • powershell.exe (PID: 2144)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 6552)
      • csc.exe (PID: 3420)
      • csc.exe (PID: 6764)
      • csc.exe (PID: 4912)
      • csc.exe (PID: 3532)

    • Uses TASKKILL.EXE to kill process

      • dllhost.exe (PID: 6716)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 6552)
      • csc.exe (PID: 3420)
      • csc.exe (PID: 6764)
      • csc.exe (PID: 4912)
      • csc.exe (PID: 3532)

    • The process executes Powershell scripts

      • cmd.exe (PID: 5736)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5736)
      • wscript.exe (PID: 2460)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 5736)
      • wscript.exe (PID: 2460)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 2460)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 2460)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 2460)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 2460)

    • Reads data from a binary Stream object (SCRIPT)

      • wscript.exe (PID: 2460)

    • Script creates XML DOM node (SCRIPT)

      • wscript.exe (PID: 2460)

    • Sets XML DOM element text (SCRIPT)

      • wscript.exe (PID: 2460)

    • Creates XML DOM element (SCRIPT)

      • wscript.exe (PID: 2460)

    • Changes charset (SCRIPT)

      • wscript.exe (PID: 2460)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 2460)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2460)

  • INFO

    • Checks supported languages

      • SearchApp.exe (PID: 5064)
      • csc.exe (PID: 6552)
      • cvtres.exe (PID: 6772)
      • csc.exe (PID: 3420)
      • cvtres.exe (PID: 2100)
      • csc.exe (PID: 6764)
      • cvtres.exe (PID: 372)
      • csc.exe (PID: 4912)
      • cvtres.exe (PID: 2124)
      • csc.exe (PID: 3532)
      • cvtres.exe (PID: 4548)

    • Checks transactions between databases Windows and Oracle

      • cmstp.exe (PID: 6508)
      • cmstp.exe (PID: 5696)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 6552)
      • SearchApp.exe (PID: 5064)
      • csc.exe (PID: 3420)
      • csc.exe (PID: 6764)
      • csc.exe (PID: 4912)
      • csc.exe (PID: 3532)

    • Create files in a temporary directory

      • csc.exe (PID: 6552)
      • cvtres.exe (PID: 6772)
      • cvtres.exe (PID: 2100)
      • csc.exe (PID: 3420)
      • cvtres.exe (PID: 372)
      • csc.exe (PID: 6764)
      • cvtres.exe (PID: 2124)
      • csc.exe (PID: 4912)
      • csc.exe (PID: 3532)
      • cvtres.exe (PID: 4548)

    • Disables trace logs

      • cmstp.exe (PID: 6508)
      • cmstp.exe (PID: 5696)
      • cmstp.exe (PID: 3876)
      • cmstp.exe (PID: 648)
      • cmstp.exe (PID: 2216)

    • Creates files in the program directory

      • dllhost.exe (PID: 6716)

    • Process checks computer location settings

      • SearchApp.exe (PID: 5064)

    • Reads the software policy settings

      • SearchApp.exe (PID: 5064)

    • Manual execution by a user

      • cmd.exe (PID: 5736)
      • wscript.exe (PID: 2460)
      • chrome.exe (PID: 3900)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2292)
      • powershell.exe (PID: 6160)
      • powershell.exe (PID: 2144)

    • Application launched itself

      • chrome.exe (PID: 3900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
198
Monitored processes
63
Malicious processes
3
Suspicious processes
5

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs whoami.exe no specs cmstp.exe no specs csc.exe CMSTPLUA cvtres.exe no specs wscript.exe no specs taskkill.exe no specs conhost.exe no specs explorer.exe no specs COpenControlPanel no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs whoami.exe no specs cmstp.exe no specs csc.exe cvtres.exe no specs wscript.exe no specs powershell.exe no specs whoami.exe no specs cmstp.exe no specs csc.exe cvtres.exe no specs powershell.exe no specs whoami.exe no specs cmstp.exe no specs csc.exe cvtres.exe no specs wscript.exe no specs powershell.exe no specs conhost.exe no specs whoami.exe no specs cmstp.exe no specs csc.exe cvtres.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
372C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES459E.tmp" "c:\Users\admin\AppData\Local\Temp\CSCF11A13448A7F47B8A22786923D2D60E2.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
372"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5652 --field-trial-handle=1940,i,5214472131177649609,16186631295709850380,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
648"c:\windows\system32\cmstp.exe" /au C:\Users\admin\AppData\Local\Temp\ScrollOfEru.infC:\Windows\System32\cmstp.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile Installer
Exit code:
0
Version:
7.2.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmstp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1016"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5072 --field-trial-handle=1940,i,5214472131177649609,16186631295709850380,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1140taskkill /IM cmstp.exe /FC:\Windows\System32\taskkill.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1796"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5500 --field-trial-handle=1940,i,5214472131177649609,16186631295709850380,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1876taskkill /IM cmstp.exe /FC:\Windows\System32\taskkill.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2100C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESE425.tmp" "c:\Users\admin\AppData\Local\Temp\CSC540ED75551342649D98293B1C12886B.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
2124C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES6674.tmp" "c:\Users\admin\AppData\Local\Temp\CSC607EA0731C174827BC5117724A0A3D9.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
Total events
49 028
Read events
48 874
Write events
151
Delete events
3

Modification events

(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\DSB
Operation:writeName:DynamicText
Value:
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\DSB
Operation:writeName:DynamicTextTruncated
Value:
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\DynamicSearchBox
Operation:writeName:TelemetryID
Value:
00005AF8C154E871DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\DynamicSearchBox
Operation:writeName:TelemetryID
Value:
0000BC5BC454E871DB01
(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:writeName:Total
Value:
50667
(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:writeName:Total
Value:
929
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\ConstraintIndex
Operation:writeName:CurrentConstraintIndexCabPath
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C005000610063006B0061006700650073005C004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E005300650061007200630068005F006300770035006E003100680032007400780079006500770079005C004C006F00630061006C00530074006100740065005C0043006F006E00730074007200610069006E00740049006E006400650078005C0049006E007000750074005F007B00380033003200620036003800640032002D0037006600650032002D0034006500370031002D0061003300610064002D003200360031003600360062003600350036006500630036007D00000061845D57E871DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\AppsConstraintIndex
Operation:writeName:LatestConstraintIndexFolder
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C005000610063006B0061006700650073005C004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E005300650061007200630068005F006300770035006E003100680032007400780079006500770079005C004C006F00630061006C00530074006100740065005C0043006F006E00730074007200610069006E00740049006E006400650078005C0041007000700073005F007B00330039006600320035003400650063002D0037003500330039002D0034003100370038002D0061006500370062002D003800360065006500620065003400320036003000340063007D00000061845D57E871DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\AppsConstraintIndex
Operation:writeName:LastConstraintIndexBuildCompleted
Value:
25595F57E871DB0161845D57E871DB01
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Microsoft.Windows.Search_cw5n1h2txyewy\AppsConstraintIndex
Operation:writeName:CurrentConstraintIndexCabPath
Value:
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{832b68d2-7fe2-4e71-a3ad-26166b656ec6}
Executable files
6
Suspicious files
124
Text files
162
Unknown types
1

Dropped files

PID
Process
Filename
Type
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZWUI0EBX\www.bing[1].xmltext
MD5:9D6DD5903DFA076C1488BDD06E2EBAC6
SHA256:8CE518ED1E1B9C5B47C2058D0137661762C9641169CE1D297F9C8EDF49EA0380
6092powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1355d4.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
6092powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kib5li0r.hj5.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6092powershell.exeC:\Users\admin\AppData\Local\Temp\ScrollOfEru.inftext
MD5:C2ABC29F2D6FB7EF587F6564719E95F9
SHA256:A0C1E558D19D4ACCB445E74958EF3BB5E516399870CDCA0FADB5840B8AF231A1
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{39f254ec-7539-4178-ae7b-86eebe42604c}\0.2.filtertrie.intermediate.txttext
MD5:C204E9FAAF8565AD333828BEFF2D786E
SHA256:D65B6A3BF11A27A1CED1F7E98082246E40CF01289FD47FE4A5ED46C221F2F73F
6092powershell.exeC:\Users\admin\AppData\Local\Temp\j1mb45bz.cmdlinetext
MD5:55D9C1AE36A0B117DA040C2FFA6D5DD4
SHA256:5EF652751B42A8A70C07A717B2B2ECFE0A151BA56CDB1B09D06C73C3A3CE1388
6772cvtres.exeC:\Users\admin\AppData\Local\Temp\RES6A27.tmpbinary
MD5:00EE9C71A0728CDBAA22706E29ECDCBF
SHA256:8BE0CB366BE5EED79FD3EEBC84E582DD9290109D9432E1CF6748620F3B7C5C14
6092powershell.exeC:\Users\admin\AppData\Local\Temp\j1mb45bz.0.cstext
MD5:61485494B45178267276DB36C51E98A6
SHA256:1F4A118AAC48006D2FFBDE13F3FA84FFF10FBB40B6BC03940E00F9CF229AB383
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{39f254ec-7539-4178-ae7b-86eebe42604c}\0.1.filtertrie.intermediate.txttext
MD5:34BD1DFB9F72CF4F86E6DF6DA0A9E49A
SHA256:8E1E6A3D56796A245D0C7B0849548932FEE803BBDB03F6E289495830E017F14C
6092powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0tbizrql.s24.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
55
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
95.101.78.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6180
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5536
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
5536
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
132
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
95.101.78.32:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
184.30.18.9:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 104.126.37.131
  • 104.126.37.129
  • 104.126.37.176
  • 104.126.37.144
  • 104.126.37.123
  • 104.126.37.136
  • 104.126.37.163
  • 104.126.37.145
  • 104.126.37.128
  • 104.126.37.170
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.178
whitelisted
google.com
  • 142.250.184.238
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 95.101.78.32
  • 95.101.78.42
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
go.microsoft.com
  • 184.30.18.9
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.138
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
stage1.ps1