File name:

update1.exe

Full analysis: https://app.any.run/tasks/8c480183-2e0b-4c73-9a45-0ee21c8c14b2
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 21, 2026, 13:25:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
powershell
loader
evasion
pastebin
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

FCF8AA3912D70FC2401E6568B0A0F633

SHA1:

B06C0EF84DA4EA87E59AE2BBBC76848E6285E2E1

SHA256:

CEDA7C4370AC7990DB1928E84F589F97FA9B635CC3AE5B02ACBF09B0DEFAF227

SSDEEP:

768:J9glHGyzJy1kTIWU3/E89lqFoC0g19NDHeFvmOE:J9glHGyzJyqEJc6hgJsun

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • update1.exe (PID: 6584)
      • update1.exe (PID: 6544)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 5204)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)
      • SecurityHealthSystray.exe (PID: 792)
      • SecurityHealthSystray.exe (PID: 6296)

    • UAC/LUA settings modification

      • update1.exe (PID: 6584)

    • Changes Windows Defender settings

      • update1.exe (PID: 6584)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)

    • Adds process to the Windows Defender exclusion list

      • update1.exe (PID: 6584)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7448)

    • Changes powershell execution policy (Bypass)

      • update1.exe (PID: 6584)
      • winhost.exe (PID: 7604)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 7448)

    • Changes the login/logoff helper path in the registry

      • svchost_conf.exe (PID: 2944)

    • Adds path to the Windows Defender exclusion list

      • winhost.exe (PID: 7604)

    • Uses Task Scheduler to run other applications

      • winhost.exe (PID: 7604)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • update1.exe (PID: 6544)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 5204)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)

    • Application launched itself

      • update1.exe (PID: 6544)
      • svchost_conf.exe (PID: 5204)

    • Script adds exclusion process to Windows Defender

      • update1.exe (PID: 6584)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 404)

    • Script adds exclusion path to Windows Defender

      • update1.exe (PID: 6584)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)

    • Starts POWERSHELL.EXE for commands execution

      • update1.exe (PID: 6584)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)

    • BASE64 encoded PowerShell command has been detected

      • update1.exe (PID: 6584)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 7448)

    • Base64-obfuscated command line is found

      • update1.exe (PID: 6584)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7448)
      • svchost_conf.exe (PID: 2944)
      • winhost.exe (PID: 7604)

    • The process bypasses the loading of PowerShell profile settings

      • update1.exe (PID: 6584)

    • Executes script without checking the security policy

      • powershell.exe (PID: 7448)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7448)
      • powershell.exe (PID: 6784)
      • powershell.exe (PID: 8168)
      • powershell.exe (PID: 4040)
      • powershell.exe (PID: 4500)

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 7448)

    • Likely accesses (executes) a file from the Public directory

      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 5204)
      • svchost_conf.exe (PID: 3212)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 7448)

    • The process creates files with name similar to system file names

      • svchost_conf.exe (PID: 2944)

    • Checks for external IP

      • winhost.exe (PID: 7604)
      • svchost.exe (PID: 2292)

    • Creates scheduled task with highest privileges

      • schtasks.exe (PID: 8404)

    • The process executes via Task Scheduler

      • SecurityHealthSystray.exe (PID: 6296)
      • SecurityHealthSystray.exe (PID: 792)

  • INFO

    • Checks supported languages

      • update1.exe (PID: 6544)
      • update1.exe (PID: 6584)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 5204)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)
      • SecurityHealthSystray.exe (PID: 792)
      • SecurityHealthSystray.exe (PID: 6296)

    • Process checks computer location settings

      • update1.exe (PID: 6544)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 3212)
      • svchost_conf.exe (PID: 5204)
      • winhost.exe (PID: 7604)

    • Reads the computer name

      • update1.exe (PID: 6544)
      • update1.exe (PID: 6584)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 5204)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)
      • SecurityHealthSystray.exe (PID: 792)
      • SecurityHealthSystray.exe (PID: 6296)

    • Reads security settings of Internet Explorer

      • update1.exe (PID: 6544)
      • svchost_conf.exe (PID: 2944)
      • svchost_conf.exe (PID: 5204)
      • svchost_conf.exe (PID: 3212)
      • winhost.exe (PID: 7604)

    • Process checks whether UAC notifications are on

      • update1.exe (PID: 6584)

    • Drops script file

      • powershell.exe (PID: 404)
      • powershell.exe (PID: 7448)
      • powershell.exe (PID: 7532)
      • powershell.exe (PID: 3552)
      • powershell.exe (PID: 6784)
      • powershell.exe (PID: 4040)
      • powershell.exe (PID: 8168)
      • powershell.exe (PID: 4500)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 404)
      • powershell.exe (PID: 7448)
      • powershell.exe (PID: 3552)
      • powershell.exe (PID: 7532)
      • powershell.exe (PID: 8168)
      • powershell.exe (PID: 6784)
      • powershell.exe (PID: 4040)
      • powershell.exe (PID: 4500)

    • Reads Environment values

      • update1.exe (PID: 6584)
      • winhost.exe (PID: 7604)

    • Disables trace logs

      • update1.exe (PID: 6584)
      • powershell.exe (PID: 7448)
      • winhost.exe (PID: 7604)

    • Reads the machine GUID from the registry

      • update1.exe (PID: 6584)
      • winhost.exe (PID: 7604)
      • SecurityHealthSystray.exe (PID: 792)
      • SecurityHealthSystray.exe (PID: 6296)

    • Checks proxy server information

      • update1.exe (PID: 6584)
      • powershell.exe (PID: 7448)
      • winhost.exe (PID: 7604)
      • slui.exe (PID: 1344)

    • Creates files in the program directory

      • svchost_conf.exe (PID: 2944)
      • winhost.exe (PID: 7604)

    • Manual execution by a user

      • svchost_conf.exe (PID: 5204)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7532)
      • powershell.exe (PID: 3552)
      • powershell.exe (PID: 6784)
      • powershell.exe (PID: 8168)
      • powershell.exe (PID: 4040)
      • powershell.exe (PID: 4500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2026:01:21 06:24:16+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 4096
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x2f9e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: FinalUpdate.exe
LegalCopyright:
OriginalFileName: FinalUpdate.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
28
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start update1.exe no specs update1.exe powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs svchost_conf.exe powershell.exe no specs conhost.exe no specs svchost_conf.exe no specs svchost_conf.exe powershell.exe no specs conhost.exe no specs winhost.exe powershell.exe no specs conhost.exe no specs svchost.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs slui.exe schtasks.exe no specs conhost.exe no specs securityhealthsystray.exe no specs securityhealthsystray.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
404"powershell" Add-MpPreference -ExclusionPath 'C:\','C:\Users','C:\ProgramData' -ExclusionProcess 'powershell.exe','update1.exe' -ErrorAction SilentlyContinueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—update1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
792"C:\ProgramData\SecurityHealthSystray.exe"C:\ProgramData\SecurityHealthSystray.exe—svchost.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\programdata\securityhealthsystray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1344C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1492\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2256\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2944"C:\Users\Public\Documents\svchost_conf.exe" C:\Users\Public\Documents\svchost_conf.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\public\documents\svchost_conf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3212"C:\Users\Public\Documents\svchost_conf.exe" C:\Users\Public\Documents\svchost_conf.exe
svchost_conf.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\public\documents\svchost_conf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3552"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users','C:\ProgramData','C:\ProgramData\WindowsIndex' -ExclusionProcess 'powershell.exe','winhost.exe' -ForceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—svchost_conf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
Total events
69 019
Read events
68 985
Write events
34
Delete events
0

Modification events

(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
0
(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:PromptOnSecureDesktop
Value:
0
(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\update1_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\update1_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\update1_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\update1_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\update1_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\update1_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6584) update1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\update1_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
3
Suspicious files
1
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
404powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ew0qfugk.lvi.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
404powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rzkykwsz.jve.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
404powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xesc5flt.3wl.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
404powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ugrawi3f.v5t.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7532powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kazwfrkv.fkd.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3552powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2ieujtpj.ggv.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3552powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3rynddog.z1q.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3552powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_34rpjrq2.fpm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
404powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:C314DA769C951A2220AB00F899F2DEE6
SHA256:5E3F26C85A3877BB3AD827835C73888EB5C71EA0DA2C93629437A8F3D452F0F4
3552powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mcxhfaus.1ud.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
60
TCP/UDP connections
58
DNS requests
25
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6768
MoUsoCoreWorker.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
unknown
—
—
whitelisted
5528
RUXIMICS.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/RUXIM?os=Windows&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3623&OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&FlightRing=Retail&AttrDataVer=186&App=RUXIM&AppVer=&DeviceFamily=Windows.Desktop
unknown
—
—
whitelisted
6584
update1.exe
GET
302
140.82.121.3:443
https://github.com/srap18/ddoss/raw/refs/heads/main/setup.ps1
unknown
—
—
unknown
7448
powershell.exe
GET
302
140.82.121.3:443
https://github.com/srap18/ddoss/raw/refs/heads/main/SystemUpdate.exe
unknown
—
—
unknown
8652
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5900
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5528
RUXIMICS.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5900
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.160.66:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5900
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5528
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.16.204.155:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
6768
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5528
RUXIMICS.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5900
svchost.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.16.204.155
  • 2.16.204.149
  • 2.16.204.156
  • 2.16.204.151
  • 2.16.204.144
  • 2.16.204.152
  • 2.16.204.150
  • 2.16.204.147
  • 2.16.204.153
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
google.com
  • 142.250.201.78
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
  • 23.55.110.211
  • 23.55.110.193
whitelisted
www.microsoft.com
  • 23.52.181.212
  • 88.221.169.152
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.133
  • 20.190.160.65
  • 20.190.160.67
  • 40.126.32.72
  • 40.126.32.76
whitelisted
github.com
  • 140.82.121.3
whitelisted
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.108.133
whitelisted
slscr.update.microsoft.com
  • 74.179.77.204
whitelisted

Threats

PID
Process
Class
Message
6768
MoUsoCoreWorker.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
Potentially Bad Traffic
ET INFO PS1 Powershell File Request
2292
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
6584
update1.exe
Potentially Bad Traffic
ET INFO PS1 Powershell File Request
—
—
Potentially Bad Traffic
ET INFO PS1 Powershell File Request
—
—
Misc activity
SUSPICIOUS [ANY.RUN] The Principal.WindowsIdentity in PS.Script has been detected
—
—
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Check Security.Principal.WindowsBuiltInRole has been detected
—
—
Potentially Bad Traffic
ET HUNTING PowerShell DownloadData Command Common In Powershell Stagers
—
—
Potentially Bad Traffic
ET ATTACK_RESPONSE PowerShell NoProfile Command Received In Powershell Stagers
6584
update1.exe
Potentially Bad Traffic
ET INFO PS1 Powershell File Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
update1.exe