URL:

http://146.103.7.34/xampp/rgb/nextbestkissingbestthingsformebetterwaygood.hta

Full analysis: https://app.any.run/tasks/b1ca5665-f7ac-4d28-a42c-46421f99fc64
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 21:48:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
susp-powershell
Indicators:
MD5:

6FBC507BB6E6866371704CE9AA183DC9

SHA1:

FA1178CF4A6D4C0D7ED3B095E945A6EBA606F7AD

SHA256:

A79FC8F1BF5F8495916065E51B55AA498659A06FBD9F04BD6D2A31831A08F466

SSDEEP:

3:N1KpsTis9VKSw2AC3Tu2ci0U9i:CIis9anC3HBJo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses environment variables (SCRIPT)

      • mshta.exe (PID: 8464)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8616)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 8616)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 8560)

    • Starts Visual C# compiler

      • powershell.exe (PID: 8616)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 8616)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 8464)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 8560)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 8560)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 8464)

    • Executes script without checking the security policy

      • powershell.exe (PID: 8616)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 8616)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 8560)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 8560)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 8780)

    • Uses .NET C# to load dll

      • powershell.exe (PID: 8616)

    • Connects to the server without a host name

      • powershell.exe (PID: 8616)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 8780)
      • powershell.exe (PID: 8616)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 8616)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 8616)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 8616)

    • Executes application which crashes

      • TiWorker.exe (PID: 9064)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 6632)
      • firefox.exe (PID: 5332)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 8464)

    • Manual execution by a user

      • mshta.exe (PID: 8464)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8616)

    • Checks supported languages

      • csc.exe (PID: 8780)
      • cvtres.exe (PID: 8820)
      • TiWorker.exe (PID: 9064)

    • Create files in a temporary directory

      • cvtres.exe (PID: 8820)
      • csc.exe (PID: 8780)
      • TiWorker.exe (PID: 9064)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 8780)

    • Checks proxy server information

      • powershell.exe (PID: 8616)

    • The sample compiled with english language support

      • powershell.exe (PID: 8616)

    • Reads mouse settings

      • TiWorker.exe (PID: 9064)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • cmd.exe (PID: 8560)

    • The executable file from the user directory is run by the Powershell process

      • TiWorker.exe (PID: 9064)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 9168)

    • Reads the software policy settings

      • slui.exe (PID: 7368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
23
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs sppextcomobj.exe no specs slui.exe mshta.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe csc.exe cvtres.exe no specs tiworker.exe svchost.exe no specs werfault.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5332"C:\Program Files\Mozilla Firefox\firefox.exe" http://146.103.7.34/xampp/rgb/nextbestkissingbestthingsformebetterwaygood.htaC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
6632"C:\Program Files\Mozilla Firefox\firefox.exe" "http://146.103.7.34/xampp/rgb/nextbestkissingbestthingsformebetterwaygood.hta"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\msvcp140.dll
7152"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1800 -parentBuildID 20240213221259 -prefsHandle 1736 -prefMapHandle 1724 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d91fe252-d024-457e-928a-8161aeffbf74} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2f757dc8b10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
7176"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2076 -parentBuildID 20240213221259 -prefsHandle 2068 -prefMapHandle 2064 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23c5989f-19c3-48f0-b35c-ac2ebc1ed456} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2f74bd82f10 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
7368"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7464C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7480"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2764 -childID 1 -isForBrowser -prefsHandle 2684 -prefMapHandle 2712 -prefsLen 26911 -prefMapSize 244583 -jsInitHandle 1296 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {029e4ee9-3e4a-4bed-b5c5-8f91fe5e8415} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2f75d3c3d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
7708"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4108 -childID 2 -isForBrowser -prefsHandle 4172 -prefMapHandle 4168 -prefsLen 36588 -prefMapSize 244583 -jsInitHandle 1296 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c779460-c6b2-4e33-a2c8-fcbe8d317808} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2f76017da10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
7976"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 3096 -prefMapHandle 4088 -prefsLen 36588 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89c68f3f-adcb-4a21-9282-ddc1afdd53bb} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2f761e9e910 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
8000"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4804 -childID 3 -isForBrowser -prefsHandle 3128 -prefMapHandle 4548 -prefsLen 31144 -prefMapSize 244583 -jsInitHandle 1296 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66c0b4a8-8748-4ebb-a01e-6a087c5c9639} 5332 "\\.\pipe\gecko-crash-server-pipe.5332" 2f76191fd90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
Total events
24 483
Read events
24 476
Write events
7
Delete events
0

Modification events

(PID) Process:(5332) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(8464) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8464) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8464) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8616) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8616) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8616) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
3
Suspicious files
163
Text files
29
Unknown types
0

Dropped files

PID
Process
Filename
Type
5332firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:2C99A16AED3906D92FFE3EF1808E2753
SHA256:08412578CC3BB4922388F8FF8C23962F616B69A1588DA720ADE429129C73C452
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5332firefox.exeC:\Users\admin\Downloads\nextbestkissingbestthingsformebetterwaygood.oZU25amT.hta.part —
MD5:—
SHA256:—
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.binbinary
MD5:CF89BF2D8A5104F008782353E042AA8D
SHA256:7203A54525BCD07566B1144DEA5C1ABFC9307871CCCD6961B9BB6A293783C9DB
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\protections.sqlite-journalbinary
MD5:2D6A6082176FAE2B1C20B22EA1753561
SHA256:EB606EA4F757F84DED175F258512BF12EB9024683E5CDB895A8101F44858F35F
5332firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.tmpbinary
MD5:4006DDC2918B16C7EF5516C58373842B
SHA256:269EA23B77EDE0874628BD8611BCC5A3E87E0C44CA8A821C0D028B929D4F468F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
78
DNS requests
105
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5332
firefox.exe
GET
200
146.103.7.34:80
http://146.103.7.34/xampp/rgb/nextbestkissingbestthingsformebetterwaygood.hta
unknown
—
—
unknown
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5332
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5332
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
5332
firefox.exe
POST
200
184.24.77.83:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
5332
firefox.exe
POST
200
184.24.77.83:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
5332
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
5332
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
5332
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/s/wr3/3H4
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.43:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5332
firefox.exe
146.103.7.34:80
—
—
BE
unknown
5332
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
5332
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted
5332
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.43
  • 23.216.77.39
  • 23.216.77.11
  • 23.216.77.6
  • 23.216.77.17
  • 23.216.77.16
  • 23.216.77.42
  • 23.216.77.37
  • 23.216.77.15
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 23.215.0.132
  • 23.215.0.133
  • 96.7.128.186
  • 96.7.128.192
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted

Threats

PID
Process
Class
Message
5332
firefox.exe
Potentially Bad Traffic
ET INFO Possible HTA Application Download
8616
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
8616
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
8616
powershell.exe
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
8616
powershell.exe
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
8616
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://146.103.7.34/xampp/rgb/nextbestkissingbestthingsformebetterwaygood.hta