File name:

WindowsCommandLine.ps1

Full analysis: https://app.any.run/tasks/a01071e7-fd01-44ce-b5b8-1c5f0e240e3c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 17, 2025, 03:35:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
evasion
stealer
umbralstealer
discord
exfiltration
umbral
divulgestealer
discordgrabber
generic
ims-api
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

282C4CE26B54E8AE3E6CD1BA9C57E71B

SHA1:

9999D642910E404F67C8895D5153C1CB99027FAC

SHA256:

AE0C605F6DA95E8E30763B13393F8D732A04EE78448C4991F77172F813E304D1

SSDEEP:

12:ipc8tAUo29wk7mHndLgyaIS1PKC2Y0Bu490iomE0r9yKGRh8cXMnOfDMhA9nCEFl:myUo2WhdLw1PKC21M4KDmxrUXRCccOQE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7548)
      • powershell.exe (PID: 7344)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 7344)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7548)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 5504)

    • Changes Windows Defender settings

      • WindowsUpdater.exe (PID: 7964)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 5504)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 5504)

    • Changes settings for real-time protection

      • powershell.exe (PID: 5504)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 5504)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 5504)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 5504)

    • Create files in the Startup directory

      • WindowsUpdater.exe (PID: 7964)

    • Adds path to the Windows Defender exclusion list

      • WindowsUpdater.exe (PID: 7964)

    • UMBRALSTEALER has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • Steals credentials from Web Browsers

      • WindowsUpdater.exe (PID: 7964)

    • Actions looks like stealing of personal data

      • WindowsUpdater.exe (PID: 7964)

    • UMBRAL has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • DIVULGESTEALER has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • DISCORDGRABBER has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • Stealers network behavior

      • WindowsUpdater.exe (PID: 7964)

    • Starts CMD.EXE for self-deleting

      • WindowsUpdater.exe (PID: 7964)

    • UMBRALSTEALER has been detected (SURICATA)

      • WindowsUpdater.exe (PID: 7964)

    • Attempting to use instant messaging service

      • WindowsUpdater.exe (PID: 7964)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7964)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7344)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7964)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 7344)

    • Application launched itself

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7528)

    • Uses WMIC.EXE to obtain Windows Installer data

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Reads the date of Windows installation

      • WindowsUpdater.exe (PID: 7528)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 7744)
      • WMIC.exe (PID: 8076)
      • WMIC.exe (PID: 7388)

    • Reads security settings of Internet Explorer

      • WindowsUpdater.exe (PID: 7528)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Script adds exclusion path to Windows Defender

      • WindowsUpdater.exe (PID: 7964)

    • Script disables Windows Defender's real-time protection

      • WindowsUpdater.exe (PID: 7964)

    • Script disables Windows Defender's IPS

      • WindowsUpdater.exe (PID: 7964)

    • Uses ATTRIB.EXE to modify file attributes

      • WindowsUpdater.exe (PID: 7964)

    • Modifies hosts file to alter network resolution

      • WindowsUpdater.exe (PID: 7964)

    • Uses WMIC.EXE to obtain operating system information

      • WindowsUpdater.exe (PID: 7964)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 2616)

    • Uses WMIC.EXE to obtain computer system information

      • WindowsUpdater.exe (PID: 7964)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • WindowsUpdater.exe (PID: 7964)

    • Starts CMD.EXE for commands execution

      • WindowsUpdater.exe (PID: 7964)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 7772)

    • The process connected to a server suspected of theft

      • WindowsUpdater.exe (PID: 7964)

    • Uses WMIC.EXE to obtain a list of video controllers

      • WindowsUpdater.exe (PID: 7964)

  • INFO

    • Checks proxy server information

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)
      • slui.exe (PID: 8116)

    • Disables trace logs

      • powershell.exe (PID: 7344)
      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Checks supported languages

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7344)

    • The executable file from the user directory is run by the Powershell process

      • WindowsUpdater.exe (PID: 7528)

    • Gets or sets the time when the file was last written to (POWERSHELL)

      • powershell.exe (PID: 7344)

    • Reads the computer name

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Reads the machine GUID from the registry

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Reads Environment values

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)

    • Reads the software policy settings

      • WindowsUpdater.exe (PID: 7528)
      • WindowsUpdater.exe (PID: 7964)
      • slui.exe (PID: 8116)

    • Process checks computer location settings

      • WindowsUpdater.exe (PID: 7528)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 8076)
      • WMIC.exe (PID: 7744)
      • WMIC.exe (PID: 2616)
      • WMIC.exe (PID: 7468)
      • WMIC.exe (PID: 7388)
      • WMIC.exe (PID: 7772)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7148)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7148)
      • powershell.exe (PID: 5504)
      • powershell.exe (PID: 2320)
      • powershell.exe (PID: 4180)

    • Create files in a temporary directory

      • WindowsUpdater.exe (PID: 7964)

    • Creates files in the program directory

      • WindowsUpdater.exe (PID: 7964)

    • Attempting to use instant messaging service

      • WindowsUpdater.exe (PID: 7964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(7964) WindowsUpdater.exe
Discord-Webhook-Tokens (1)1361371476728746156/sEKY6jxCuZVbLAFNK8HUW-8b9JraaDw5I4jFLv5702R5NaptrXdnYE3XQ6JKxsHS9vLl
Discord-Info-Links
1361371476728746156/sEKY6jxCuZVbLAFNK8HUW-8b9JraaDw5I4jFLv5702R5NaptrXdnYE3XQ6JKxsHS9vLl
Get Webhook Infohttps://discord.com/api/webhooks/1361371476728746156/sEKY6jxCuZVbLAFNK8HUW-8b9JraaDw5I4jFLv5702R5NaptrXdnYE3XQ6JKxsHS9vLl
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
35
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs windowsupdater.exe powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs svchost.exe #UMBRALSTEALER windowsupdater.exe wmic.exe no specs conhost.exe no specs attrib.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240ping localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2320"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITYC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WindowsUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2616"wmic.exe" os get CaptionC:\Windows\System32\wbem\WMIC.exe—WindowsUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
4180"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITYC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WindowsUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4696\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5504"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WindowsUpdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
5508\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
43 011
Read events
42 997
Write events
14
Delete events
0

Modification events

(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7528) WindowsUpdater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\WindowsUpdater_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
11
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
7344powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10bb34.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
7548powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactivebinary
MD5:04B1F0676EF21246E2D2EAC7170B6DB2
SHA256:51A4D907D39ABFEF3A726F7737DA746B154757E6DB1D9B26DC6B69E4947EAA89
7344powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:EF54665087074EE590A9F42A83DFFC54
SHA256:575FD91C4163DBA0266C58448800095F9642FDFEE483CDDA88EEDA86A5EC190D
7148powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_z0dubnfk.mra.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5504powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_g1ez2aeu.knc.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7344powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4qni1bhv.xlz.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7344powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cu4azkrk.jqt.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7964WindowsUpdater.exeC:\Users\admin\AppData\Local\Temp\UvjlpzmHK623Hq4binary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
7964WindowsUpdater.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\rxAJC.screxecutable
MD5:609265CBE2B6CCB099A327BF93E768EA
SHA256:B197851A0AD90F0BB7B9859E9FFDBEC6A10383AC1A5D6909201B372D35891619
7964WindowsUpdater.exeC:\Windows\System32\drivers\etc\hoststext
MD5:2992FEB95030E84DE4A6D2F432E17E5F
SHA256:5E9F7AAADDAD64848ADC44BD44DE1FFE3E69DFCCDEFF29B58067A7F313EABD2D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
48
DNS requests
20
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
172.217.18.3:443
https://gstatic.com/generate_204
unknown
—
—
unknown
—
—
GET
204
172.217.18.3:443
https://gstatic.com/generate_204
unknown
—
—
unknown
7528
WindowsUpdater.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7964
WindowsUpdater.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7964
WindowsUpdater.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/?fields=225545
unknown
—
—
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
7716
SIHClient.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7716
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7716
SIHClient.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7716
SIHClient.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7344
powershell.exe
64.29.17.129:443
file-upload-service-eight.vercel.app
—
US
unknown
7528
WindowsUpdater.exe
142.250.186.99:443
gstatic.com
GOOGLE
US
whitelisted
7528
WindowsUpdater.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
7964
WindowsUpdater.exe
142.250.186.99:443
gstatic.com
GOOGLE
US
whitelisted
7964
WindowsUpdater.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
file-upload-service-eight.vercel.app
  • 64.29.17.129
  • 216.198.79.129
unknown
gstatic.com
  • 142.250.186.99
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
discord.com
  • 162.159.135.232
  • 162.159.137.232
  • 162.159.136.232
  • 162.159.138.232
  • 162.159.128.233
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloud infrastructure to build app (vercel .app)
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO EXE - Served Inline HTTP
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Request for EXE via Powershell
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7528
WindowsUpdater.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
7528
WindowsUpdater.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7964
WindowsUpdater.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WindowsCommandLine.ps1