File name:

bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515

Full analysis: https://app.any.run/tasks/fa85e0a5-98b7-4494-98c8-bf0f67e9bd93
Verdict: Malicious activity
Analysis date: May 18, 2025, 15:01:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pastebin
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

36CF36A3C8FA1E1A5233FFDF9330DDD8

SHA1:

A42407109009E07FC2E6A56B529F6A0FB070DE0F

SHA256:

BBA099A7D260B2F39A2E84FFBABFC021D1FFAA1C13F38FC5C6C72B27BC476515

SSDEEP:

6144:660HWhUebJLkbidUKflRq6lN2fbXDPU6muh1jIYOD+/w7nFAjGARq:6602iGObYUussYfbXQZ2ya8nFASARq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe (PID: 4652)

    • Changes Windows Defender settings

      • bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe (PID: 4652)

    • Create files in the Startup directory

      • CasPol.exe (PID: 6516)

  • SUSPICIOUS

    • Script adds exclusion path to Windows Defender

      • bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe (PID: 4652)

    • Starts POWERSHELL.EXE for commands execution

      • bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe (PID: 4652)

    • Reads security settings of Internet Explorer

      • bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe (PID: 4652)
      • CasPol.exe (PID: 6516)

  • INFO

    • Reads the computer name

      • bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe (PID: 4652)
      • CasPol.exe (PID: 6516)

    • Checks supported languages

      • bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe (PID: 4652)
      • CasPol.exe (PID: 6516)

    • Reads the machine GUID from the registry

      • bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe (PID: 4652)
      • CasPol.exe (PID: 6516)

    • Process checks computer location settings

      • bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe (PID: 4652)
      • CasPol.exe (PID: 6516)

    • Disables trace logs

      • CasPol.exe (PID: 6516)

    • Checks proxy server information

      • CasPol.exe (PID: 6516)

    • Reads the software policy settings

      • CasPol.exe (PID: 6516)

    • Creates files or folders in the user directory

      • CasPol.exe (PID: 6516)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3240)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2088:12:23 14:19:56+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 293832
InitializedDataSize: 3072
UninitializedDataSize: -
EntryPoint: 0x49bc2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.42.342.93
ProductVersionNumber: 6.42.342.93
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: uuiRonEBi
FileDescription: EeEqUm EMOnUwUv ixoyaCuHaa iveQOk OsogIjeRaEe.
FileVersion: 6.42.342.93
InternalName: IeAzAK
LegalCopyright: © 2023 uuiRonEBi.
OriginalFileName: EvuNUpi
ProductName: OeOc
ProductVersion: 6.42.342.93
Comments: OFIq IpAsUC UgoJIUovOZ ueeMouiwOb uQeTEge aaucuOiiEL ETeNO aoaYInUrOgu IhIqAOazIge.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe no specs powershell.exe no specs conhost.exe no specs caspol.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3240"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Local\Temp\bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe" -ForceC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4608"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4652"C:\Users\admin\AppData\Local\Temp\bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe" C:\Users\admin\AppData\Local\Temp\bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe—explorer.exe
User:
admin
Company:
uuiRonEBi
Integrity Level:
MEDIUM
Description:
EeEqUm EMOnUwUv ixoyaCuHaa iveQOk OsogIjeRaEe.
Exit code:
0
Version:
6.42.342.93
Modules
Images
c:\users\admin\appdata\local\temp\bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5392C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6272\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6516"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\caspol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
7 164
Read events
7 149
Write events
15
Delete events
0

Modification events

(PID) Process:(4652) bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance
Operation:writeName:Enabled
Value:
0
(PID) Process:(6516) CasPol.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CasPol_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6516) CasPol.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CasPol_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6516) CasPol.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CasPol_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6516) CasPol.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CasPol_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6516) CasPol.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CasPol_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6516) CasPol.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CasPol_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6516) CasPol.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CasPol_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6516) CasPol.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CasPol_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6516) CasPol.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\CasPol_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
0
Suspicious files
1
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
3240powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_eb4qkg44.spt.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3240powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_y5p3beiu.zn1.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3240powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:11723EC2758FC4B5398D70F7D29FAA48
SHA256:BBC90FF545D1549CE7BDD09035F8A3F666DCCE6A067565566C851ADF179B4DF4
6516CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PYAsbt37Iz3zgOZFwnkDSaWC.battext
MD5:C543F13450FBD31BC44A8CE999373E06
SHA256:2F6F3A2A21E5681A74A1734569CCB04ED901DBD3ADADE5794CED0097C0A8C0F3
3240powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zhjo0pio.tlf.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6516CasPol.exeC:\Users\admin\Pictures\3a3AAbcnxsia3RjR7K8iw0MG.exehtml
MD5:70134B7E3ECEFA285E7FF61FD3592BA2
SHA256:53869EC437097DC7E99F444AA8EFD2723B5C299CE3971F4E0701C1909DC27433
3240powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3bie2513.nbe.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6516CasPol.exeC:\Users\admin\AppData\Local\J7Txz49BA0IGYpqsVQGfofKk.exehtml
MD5:70134B7E3ECEFA285E7FF61FD3592BA2
SHA256:53869EC437097DC7E99F444AA8EFD2723B5C299CE3971F4E0701C1909DC27433
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6516
CasPol.exe
188.114.97.3:443
yip.su
CLOUDFLARENET
NL
whitelisted
6516
CasPol.exe
104.22.69.199:443
pastebin.com
CLOUDFLARENET
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
yip.su
  • 188.114.97.3
  • 188.114.96.3
whitelisted
pastebin.com
  • 104.22.69.199
  • 104.22.68.199
  • 172.67.25.94
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.65
  • 20.190.160.2
  • 20.190.160.22
  • 20.190.160.67
  • 20.190.160.14
  • 20.190.160.64
  • 20.190.160.132
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bba099a7d260b2f39a2e84ffbabfc021d1ffaa1c13f38fc5c6c72b27bc476515