download:

/o/o.png

Full analysis: https://app.any.run/tasks/77f00fd8-d540-4521-bba3-135000eac6ed
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 17, 2024, 21:42:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
netsupport
unwanted
loader
remote
tool
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

A9053A6606748A87A135B942EB47A8C0

SHA1:

6062CEA39903E0BDFA10C45E54C335D88BE71962

SHA256:

A6F4B90B39688C9920B9F8198E559E3ACE42E46D5A31811DFFBFB4C2532FAF93

SSDEEP:

48:UdKxIOgGiKxM9OM3iE+Uq9IXpVKWQFREKSXaWyoKGPngm0VKLJyYBfYeHOwqfsdK:2NJBddkREKSXByPMgnAl19luw9F4F/S4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6196)

    • NETSUPPORT has been detected (SURICATA)

      • client32.exe (PID: 6164)

    • Connects to the CnC server

      • client32.exe (PID: 6164)

    • NETSUPPORT has been detected (YARA)

      • client32.exe (PID: 6164)

    • NETSUPPORT mutex has been found

      • client32.exe (PID: 6164)

  • SUSPICIOUS

    • Process uses IPCONFIG to clear DNS cache

      • powershell.exe (PID: 6196)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 6756)

    • Drop NetSupport executable file

      • powershell.exe (PID: 6196)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 6196)
      • client32.exe (PID: 6164)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 6196)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 6196)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 6196)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 6196)

    • Contacting a server suspected of hosting an CnC

      • client32.exe (PID: 6164)

    • Connects to the server without a host name

      • client32.exe (PID: 6164)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 6116)

    • Reads the date of Windows installation

      • SearchApp.exe (PID: 6376)

    • Reads security settings of Internet Explorer

      • client32.exe (PID: 6164)

  • INFO

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6196)

    • Gets or sets the time when the file was last written to (POWERSHELL)

      • powershell.exe (PID: 6196)

    • The sample compiled with english language support

      • powershell.exe (PID: 6196)

    • Disables trace logs

      • powershell.exe (PID: 6196)

    • Checks proxy server information

      • powershell.exe (PID: 6196)
      • SearchApp.exe (PID: 6376)
      • client32.exe (PID: 6164)

    • The process uses the downloaded file

      • powershell.exe (PID: 6196)

    • Creates files or folders in the user directory

      • client32.exe (PID: 6164)

    • Checks supported languages

      • StartMenuExperienceHost.exe (PID: 5748)
      • SearchApp.exe (PID: 6376)
      • client32.exe (PID: 6164)

    • Reads the computer name

      • StartMenuExperienceHost.exe (PID: 5748)
      • client32.exe (PID: 6164)

    • Sends debugging messages

      • StartMenuExperienceHost.exe (PID: 5748)

    • The executable file from the user directory is run by the Powershell process

      • client32.exe (PID: 6164)

    • Process checks computer location settings

      • SearchApp.exe (PID: 6376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pic | Bio-Rad Image(s) bitmap (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs ipconfig.exe no specs cmd.exe no specs attrib.exe no specs #NETSUPPORT client32.exe plugscheduler.exe no specs startmenuexperiencehost.exe no specs tiworker.exe no specs searchapp.exe dllhost.exe no specs textinputhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4220C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
4856"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
5040C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
5748"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
6116"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
6164"C:\Users\admin\AppData\Roaming\prfqgU\client32.exe" C:\Users\admin\AppData\Roaming\prfqgU\client32.exe
powershell.exe
User:
admin
Company:
NetSupport Ltd
Integrity Level:
MEDIUM
Description:
NetSupport Client Application
Exit code:
1073807364
Version:
V14.10
Modules
Images
c:\users\admin\appdata\roaming\prfqgu\client32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\admin\appdata\roaming\prfqgu\pcicl32.dll
6196"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\o.png.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6204\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6376"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6568"C:\WINDOWS\system32\ipconfig.exe" /flushdnsC:\Windows\System32\ipconfig.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\dhcpcsvc.dll
Total events
19 466
Read events
19 405
Write events
58
Delete events
3

Modification events

(PID) Process:(6196) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft
Value:
C:\Users\admin\AppData\Roaming\prfqgU\client32.exe
(PID) Process:(6164) client32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6164) client32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6164) client32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5748) StartMenuExperienceHost.exeKey:\REGISTRY\A\{f880cc0c-775b-6f58-7966-eda9f52f4462}\LocalState\DataCorruptionRecovery
Operation:writeName:InitializationAttemptCount
Value:
010000006DF9EA47CD50DB01
(PID) Process:(5040) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31150285
(PID) Process:(5040) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
(PID) Process:(5748) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties
Operation:writeName:Completed
Value:
1
(PID) Process:(5748) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties_AppUsageData
Operation:writeName:Completed
Value:
1
(PID) Process:(5748) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties_TargetedContentTiles
Operation:writeName:Completed
Value:
1
Executable files
8
Suspicious files
18
Text files
14
Unknown types
34

Dropped files

PID
Process
Filename
Type
6196powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DB1HBGK93K9VL9QH84V2.tempbinary
MD5:8392F2FF1D20941774986F329889624A
SHA256:CAF5AAC965D6BF4F681D6760BA2B8D65EE6C95903567FA2C5BDEC779006CE17B
6196powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF135382.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
6196powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:8392F2FF1D20941774986F329889624A
SHA256:CAF5AAC965D6BF4F681D6760BA2B8D65EE6C95903567FA2C5BDEC779006CE17B
6196powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_01lbmiqn.zuk.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6196powershell.exeC:\Users\admin\AppData\Roaming\prfqgU\HTCTL32.DLLexecutable
MD5:2D3B207C8A48148296156E5725426C7F
SHA256:EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
6196powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3cekh445.sih.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6196powershell.exeC:\Users\admin\AppData\Roaming\prfqgU\PCICHEK.DLLexecutable
MD5:A0B9388C5F18E27266A31F8C5765B263
SHA256:313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
6196powershell.exeC:\Users\admin\AppData\Roaming\prfqgU\TCCTL32.DLLexecutable
MD5:EAB603D12705752E3D268D86DFF74ED4
SHA256:6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
6196powershell.exeC:\Users\admin\AppData\Roaming\prfqgU\pcicapi.dllexecutable
MD5:DCDE2248D19C778A41AA165866DD52D0
SHA256:9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
6196powershell.exeC:\Users\admin\AppData\Roaming\prfqgU\msvcr100.dllexecutable
MD5:0E37FBFA79D349D672456923EC5FBBE3
SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
37
DNS requests
23
Threats
31

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
132
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
132
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6196
powershell.exe
GET
200
171.22.108.177:80
http://goaccredited.biz/o/1.png
unknown
—
—
unknown
6196
powershell.exe
GET
200
171.22.108.177:80
http://goaccredited.biz/o/2.png
unknown
—
—
unknown
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6196
powershell.exe
GET
200
171.22.108.177:80
http://goaccredited.biz/o/3.png
unknown
—
—
unknown
6196
powershell.exe
GET
200
171.22.108.177:80
http://goaccredited.biz/o/4.png
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
132
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
132
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.185
  • 2.23.209.176
  • 2.23.209.133
  • 2.23.209.177
  • 2.23.209.193
  • 2.23.209.130
  • 2.23.209.148
  • 2.23.209.182
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.69
  • 20.190.159.73
  • 40.126.31.73
  • 40.126.31.67
  • 20.190.159.68
  • 20.190.159.2
  • 20.190.159.64
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
goaccredited.biz
  • 171.22.108.177
unknown
geo.netsupportsoftware.com
  • 104.26.0.231
  • 172.67.68.212
  • 104.26.1.231
unknown

Threats

PID
Process
Class
Message
6196
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6196
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6196
powershell.exe
Misc activity
ET HUNTING Possible EXE Download From Suspicious TLD
6196
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6196
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6196
powershell.exe
Misc activity
ET HUNTING Possible EXE Download From Suspicious TLD
6196
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6196
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6196
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6196
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/o/o.png