File name:

test.ps1

Full analysis: https://app.any.run/tasks/e592b9ef-8606-443d-82b8-d3e4a1952054
Verdict: Malicious activity
Analysis date: June 13, 2025, 21:07:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (3778), with CRLF line terminators
MD5:

3C3783341B6A87914F3738FA9273A0D6

SHA1:

B836AF8857DA9196F0AD2B4BA266A3E44C627C2B

SHA256:

E0B5A00164F465E590B2966B571DE231FA656E13CD22AA789FDFA8261D39749E

SSDEEP:

96:YGS4pe6AytY7HjZPdtWVOTJ8NMkaRXtzHzWPsJRBG:YGSaEkY/YsF8NMPRdb1BG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

    • Modifies registry (POWERSHELL)

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

  • SUSPICIOUS

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

    • Remote server returned an error (POWERSHELL)

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

    • Checks proxy server information

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)
      • slui.exe (PID: 3100)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 3976)
      • powershell.exe (PID: 856)

    • Manual execution by a user

      • powershell.exe (PID: 856)
      • mspaint.exe (PID: 3608)

    • Reads the software policy settings

      • slui.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs slui.exe powershell.exe conhost.exe no specs mspaint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass "C:\Users\admin\Desktop\test.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3100C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3608"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\yesnorthern.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3876\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3976"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\test.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
5616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
22 592
Read events
22 592
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
7
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3976powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF176820.TMPbinary
MD5:00A03B286E6E0EBFF8D9C492365D5EC2
SHA256:4DBFC417D053BA6867308671F1C61F4DCAFC61F058D4044DB532DA6D3BDE3615
3976powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NYUUL2Y1DGFL146BHPTU.tempbinary
MD5:C242F9641598ADCEC8665583DAC75E6C
SHA256:C3AC6ABDEA9F51534A489645E866DA3863A1B26113202AE7AD4E777A8BF41AEF
3976powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_v5avinux.dxq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
856powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1d4p3ayg.cwf.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
856powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF190286.TMPbinary
MD5:C242F9641598ADCEC8665583DAC75E6C
SHA256:C3AC6ABDEA9F51534A489645E866DA3863A1B26113202AE7AD4E777A8BF41AEF
856powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_emlbkmhr.ok2.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3976powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:951B08A0879A972E30105A2B0A365F56
SHA256:7CC5B1E24C602D0A39632E7085953DFAEC90A2A3000F5D0D7E3FFF6BB4CEA8CC
856powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:12B4BB3785E35921EF1AC330E1EC1BC3
SHA256:C9FF5C297DE8C6FE12837B75CEA941D444C0A4FAB8388925C5D907B4D6AAFC64
856powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kbybf0zb.23o.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3976powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:C242F9641598ADCEC8665583DAC75E6C
SHA256:C3AC6ABDEA9F51534A489645E866DA3863A1B26113202AE7AD4E777A8BF41AEF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
53
DNS requests
27
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
—
20.190.159.0:443
https://login.live.com/RST2.srf
US
—
—
whitelisted
—
—
GET
—
140.82.121.3:443
https://github.com/Chainski/AES-Encoder/raw/main/amsi_patch.ps1
US
—
—
unknown
—
—
POST
—
20.190.160.67:443
https://login.live.com/RST2.srf
US
—
—
whitelisted
—
—
POST
—
40.126.32.138:443
https://login.live.com/RST2.srf
US
—
—
whitelisted
—
—
POST
—
40.126.31.71:443
https://login.live.com/RST2.srf
US
—
—
whitelisted
—
—
POST
—
40.126.32.138:443
https://login.live.com/RST2.srf
US
—
—
whitelisted
—
—
POST
—
40.126.31.71:443
https://login.live.com/RST2.srf
US
—
—
whitelisted
3976
powershell.exe
GET
—
31.31.197.39:80
http://alt-v.ru/1
RU
—
—
unknown
—
—
POST
—
20.190.159.128:443
https://login.live.com/RST2.srf
US
—
—
whitelisted
3976
powershell.exe
GET
—
31.31.197.39:80
http://alt-v.ru/1
RU
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1488
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2288
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3976
powershell.exe
140.82.121.4:443
github.com
GITHUB
US
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6024
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3976
powershell.exe
31.31.197.39:80
alt-v.ru
Domain names registrar REG.RU, Ltd
RU
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.130
  • 40.126.31.129
  • 40.126.31.3
  • 20.190.159.128
  • 40.126.31.128
  • 20.190.159.23
  • 20.190.159.64
whitelisted
github.com
  • 140.82.121.4
  • 140.82.121.3
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
alt-v.ru
  • 31.31.197.39
unknown
nexusrules.officeapps.live.com
  • 52.111.236.22
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO PS1 Powershell File Request
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3976
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3976
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3976
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3976
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3976
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3976
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Potentially Bad Traffic
ET INFO PS1 Powershell File Request
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
test.ps1