File name:

WindowsCommandLine.ps1

Full analysis: https://app.any.run/tasks/a01071e7-fd01-44ce-b5b8-1c5f0e240e3c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 17, 2025, 03:35:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
evasion
stealer
umbralstealer
discord
exfiltration
umbral
divulgestealer
discordgrabber
generic
ims-api
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

282C4CE26B54E8AE3E6CD1BA9C57E71B

SHA1:

9999D642910E404F67C8895D5153C1CB99027FAC

SHA256:

AE0C605F6DA95E8E30763B13393F8D732A04EE78448C4991F77172F813E304D1

SSDEEP:

12:ipc8tAUo29wk7mHndLgyaIS1PKC2Y0Bu490iomE0r9yKGRh8cXMnOfDMhA9nCEFl:myUo2WhdLw1PKC21M4KDmxrUXRCccOQE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 7344)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7548)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7344)
      • powershell.exe (PID: 7548)

    • Adds path to the Windows Defender exclusion list

      • WindowsUpdater.exe (PID: 7964)

    • Changes Windows Defender settings

      • WindowsUpdater.exe (PID: 7964)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 5504)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 5504)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 5504)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 5504)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 5504)

    • Changes settings for real-time protection

      • powershell.exe (PID: 5504)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 5504)

    • Create files in the Startup directory

      • WindowsUpdater.exe (PID: 7964)

    • Steals credentials from Web Browsers

      • WindowsUpdater.exe (PID: 7964)

    • Actions looks like stealing of personal data

      • WindowsUpdater.exe (PID: 7964)

    • DISCORDGRABBER has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • UMBRALSTEALER has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • UMBRALSTEALER has been detected (SURICATA)

      • WindowsUpdater.exe (PID: 7964)

    • Attempting to use instant messaging service

      • WindowsUpdater.exe (PID: 7964)

    • Stealers network behavior

      • WindowsUpdater.exe (PID: 7964)

    • UMBRAL has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • DIVULGESTEALER has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • Starts CMD.EXE for self-deleting

      • WindowsUpdater.exe (PID: 7964)

  • SUSPICIOUS

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7344)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7964)

    • Application launched itself

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7528)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • WindowsUpdater.exe (PID: 7964)
      • WindowsUpdater.exe (PID: 7528)

    • Uses WMIC.EXE to obtain Windows Installer data

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 7744)
      • WMIC.exe (PID: 8076)
      • WMIC.exe (PID: 7388)

    • Reads security settings of Internet Explorer

      • WindowsUpdater.exe (PID: 7528)

    • Reads the date of Windows installation

      • WindowsUpdater.exe (PID: 7528)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7964)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 7344)

    • Uses ATTRIB.EXE to modify file attributes

      • WindowsUpdater.exe (PID: 7964)

    • Script adds exclusion path to Windows Defender

      • WindowsUpdater.exe (PID: 7964)

    • Script disables Windows Defender's real-time protection

      • WindowsUpdater.exe (PID: 7964)

    • Script disables Windows Defender's IPS

      • WindowsUpdater.exe (PID: 7964)

    • Modifies hosts file to alter network resolution

      • WindowsUpdater.exe (PID: 7964)

    • Uses WMIC.EXE to obtain operating system information

      • WindowsUpdater.exe (PID: 7964)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 2616)

    • Uses WMIC.EXE to obtain computer system information

      • WindowsUpdater.exe (PID: 7964)

    • Uses WMIC.EXE to obtain a list of video controllers

      • WindowsUpdater.exe (PID: 7964)

    • The process connected to a server suspected of theft

      • WindowsUpdater.exe (PID: 7964)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 7772)

    • Starts CMD.EXE for commands execution

      • WindowsUpdater.exe (PID: 7964)

  • INFO

    • Checks proxy server information

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)
      • slui.exe (PID: 8116)

    • Gets or sets the time when the file was last written to (POWERSHELL)

      • powershell.exe (PID: 7344)

    • The executable file from the user directory is run by the Powershell process

      • WindowsUpdater.exe (PID: 7528)

    • Checks supported languages

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Reads the computer name

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Reads the machine GUID from the registry

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Reads Environment values

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Reads the software policy settings

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)
      • slui.exe (PID: 8116)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 7744)
      • WMIC.exe (PID: 8076)
      • WMIC.exe (PID: 2616)
      • WMIC.exe (PID: 7388)
      • WMIC.exe (PID: 7468)
      • WMIC.exe (PID: 7772)

    • Process checks computer location settings

      • WindowsUpdater.exe (PID: 7528)

    • Disables trace logs

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7344)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7148)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7148)
      • powershell.exe (PID: 5504)
      • powershell.exe (PID: 2320)
      • powershell.exe (PID: 4180)

    • Creates files in the program directory

      • WindowsUpdater.exe (PID: 7964)

    • Create files in a temporary directory

      • WindowsUpdater.exe (PID: 7964)

    • Attempting to use instant messaging service

      • WindowsUpdater.exe (PID: 7964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(7964) WindowsUpdater.exe
Discord-Webhook-Tokens (1)1361371476728746156/sEKY6jxCuZVbLAFNK8HUW-8b9JraaDw5I4jFLv5702R5NaptrXdnYE3XQ6JKxsHS9vLl
Discord-Info-Links
1361371476728746156/sEKY6jxCuZVbLAFNK8HUW-8b9JraaDw5I4jFLv5702R5NaptrXdnYE3XQ6JKxsHS9vLl
Get Webhook Infohttps://discord.com/api/webhooks/1361371476728746156/sEKY6jxCuZVbLAFNK8HUW-8b9JraaDw5I4jFLv5702R5NaptrXdnYE3XQ6JKxsHS9vLl
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
35
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs windowsupdater.exe powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs svchost.exe #UMBRALSTEALER windowsupdater.exe wmic.exe no specs conhost.exe no specs attrib.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240ping localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2320"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITYC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WindowsUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2616"wmic.exe" os get CaptionC:\Windows\System32\wbem\WMIC.exe—WindowsUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
4180"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITYC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WindowsUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4696\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5504"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WindowsUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
5508\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
43 011
Read events
42 997
Write events
14
Delete events
0

Modification events

(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
11
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
7344powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cu4azkrk.jqt.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7344powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VMJ4VKLGMLZDYRNDN5HJ.tempbinary
MD5:B683246B909FE82C18378A9D0FACB9C0
SHA256:15E1D094E77C030AE03A772576441DDE9C456E300562E8115D686A94AC6AB204
7344powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4qni1bhv.xlz.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7344powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10bb34.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
7344powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:B683246B909FE82C18378A9D0FACB9C0
SHA256:15E1D094E77C030AE03A772576441DDE9C456E300562E8115D686A94AC6AB204
7344powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:EF54665087074EE590A9F42A83DFFC54
SHA256:575FD91C4163DBA0266C58448800095F9642FDFEE483CDDA88EEDA86A5EC190D
7964WindowsUpdater.exeC:\Users\admin\AppData\Local\Temp\8EYMb1cGMCGYHVrbinary
MD5:B13FCB3223116F6EEC60BE9143CAE98B
SHA256:961FC9BF866C5B58401D3C91735F9A7B7B4FC93C94038C504C965491F622B52B
7964WindowsUpdater.exeC:\Users\admin\AppData\Local\Temp\PPmDG31t8LSEacAbinary
MD5:46D9FCA6032297F8AEE08D73418312BA
SHA256:865856FA4C33C4AEE52E15FBB370B6611468FE947E76E197F0E50D0AD62CB1B4
7964WindowsUpdater.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\rxAJC.screxecutable
MD5:609265CBE2B6CCB099A327BF93E768EA
SHA256:B197851A0AD90F0BB7B9859E9FFDBEC6A10383AC1A5D6909201B372D35891619
7964WindowsUpdater.exeC:\Users\admin\AppData\Local\Temp\2ian24qr9RfkaIxbinary
MD5:09A22B1BCD9725DF5B3591EBBD2CEBD6
SHA256:4F81904A9B06C58572A0E5769B3B4FFB99E7BD4BE88EE8C2B64A804F483D9DC6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
48
DNS requests
20
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
172.217.18.3:443
https://gstatic.com/generate_204
unknown
—
—
—
—
—
GET
204
172.217.18.3:443
https://gstatic.com/generate_204
unknown
—
—
—
7528
WindowsUpdater.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7964
WindowsUpdater.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7964
WindowsUpdater.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/?fields=225545
unknown
—
—
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7716
SIHClient.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7716
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7716
SIHClient.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7716
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7344
powershell.exe
64.29.17.129:443
file-upload-service-eight.vercel.app
—
US
unknown
7528
WindowsUpdater.exe
142.250.186.99:443
gstatic.com
GOOGLE
US
whitelisted
7528
WindowsUpdater.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
7964
WindowsUpdater.exe
142.250.186.99:443
gstatic.com
GOOGLE
US
whitelisted
7964
WindowsUpdater.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
file-upload-service-eight.vercel.app
  • 64.29.17.129
  • 216.198.79.129
unknown
gstatic.com
  • 142.250.186.99
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
discord.com
  • 162.159.135.232
  • 162.159.137.232
  • 162.159.136.232
  • 162.159.138.232
  • 162.159.128.233
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloud infrastructure to build app (vercel .app)
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Request for EXE via Powershell
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7528
WindowsUpdater.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
7528
WindowsUpdater.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7964
WindowsUpdater.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WindowsCommandLine.ps1