File name:

SecuriteInfo.com.Win32.Evo-gen.20014.21640

Full analysis: https://app.any.run/tasks/c7c73f8c-23a4-467b-83b1-a768c8b2b3d5
Verdict: Malicious activity
Analysis date: May 10, 2025, 09:11:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
susp-powershell
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

997E67980C344C260A6CF77DA90A2B39

SHA1:

5743166C9C72D6C3F9E19D066E07E54E016F2222

SHA256:

F258F660F30A7F9669B025D9C2D5663F16C576A03F48E6FC169AF692D43336C3

SSDEEP:

48:YhXSHP3bUHkkY4444444aMcmMtjK7vvqNi3OeqmfH1cRqmOegp9tx5Pjvhvrrrab:igbf1lM7qNcObaV9Ii9txoEd3ojZlrl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 2284)

    • Executing a file with an untrusted certificate

      • win32.exe (PID: 4452)

    • Adds path to the Windows Defender exclusion list

      • explorer.exe (PID: 5492)

    • Changes Windows Defender settings

      • explorer.exe (PID: 5492)

    • Application was injected by another process

      • svchost.exe (PID: 1044)
      • lsass.exe (PID: 756)
      • svchost.exe (PID: 1260)
      • svchost.exe (PID: 1232)
      • svchost.exe (PID: 468)
      • svchost.exe (PID: 1252)
      • svchost.exe (PID: 1288)
      • svchost.exe (PID: 1524)
      • svchost.exe (PID: 1784)
      • svchost.exe (PID: 1416)
      • svchost.exe (PID: 1988)
      • svchost.exe (PID: 1772)
      • svchost.exe (PID: 1980)
      • svchost.exe (PID: 1904)
      • svchost.exe (PID: 1792)
      • svchost.exe (PID: 1892)
      • svchost.exe (PID: 2292)
      • svchost.exe (PID: 2068)
      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 2544)
      • svchost.exe (PID: 2396)
      • svchost.exe (PID: 1652)
      • svchost.exe (PID: 1552)
      • svchost.exe (PID: 1352)
      • svchost.exe (PID: 1444)
      • svchost.exe (PID: 2624)
      • dasHost.exe (PID: 3012)
      • svchost.exe (PID: 2776)
      • svchost.exe (PID: 2584)
      • OfficeClickToRun.exe (PID: 3112)
      • svchost.exe (PID: 2880)
      • spoolsv.exe (PID: 2732)
      • svchost.exe (PID: 2932)
      • svchost.exe (PID: 3084)
      • svchost.exe (PID: 3216)
      • svchost.exe (PID: 3184)
      • svchost.exe (PID: 2920)
      • svchost.exe (PID: 3104)
      • svchost.exe (PID: 3196)
      • svchost.exe (PID: 4292)
      • svchost.exe (PID: 2172)
      • svchost.exe (PID: 2536)
      • svchost.exe (PID: 2448)
      • svchost.exe (PID: 4312)
      • svchost.exe (PID: 3232)
      • svchost.exe (PID: 3284)
      • svchost.exe (PID: 860)
      • svchost.exe (PID: 3860)
      • svchost.exe (PID: 2996)
      • svchost.exe (PID: 4508)
      • svchost.exe (PID: 1572)
      • dllhost.exe (PID: 5880)
      • svchost.exe (PID: 3812)
      • svchost.exe (PID: 3564)
      • MoUsoCoreWorker.exe (PID: 5496)
      • explorer.exe (PID: 5492)
      • svchost.exe (PID: 6024)
      • uhssvc.exe (PID: 648)
      • svchost.exe (PID: 2112)
      • svchost.exe (PID: 4544)
      • svchost.exe (PID: 1684)
      • winlogon.exe (PID: 6648)
      • dwm.exe (PID: 6568)
      • svchost.exe (PID: 4952)
      • sihost.exe (PID: 4984)
      • RuntimeBroker.exe (PID: 6160)
      • ctfmon.exe (PID: 956)
      • RuntimeBroker.exe (PID: 1036)
      • svchost.exe (PID: 6608)
      • dllhost.exe (PID: 6896)
      • RuntimeBroker.exe (PID: 5368)
      • svchost.exe (PID: 4684)
      • svchost.exe (PID: 6544)
      • ApplicationFrameHost.exe (PID: 6952)
      • svchost.exe (PID: 6180)
      • svchost.exe (PID: 4284)
      • dllhost.exe (PID: 6176)
      • svchost.exe (PID: 5132)
      • WmiPrvSE.exe (PID: 6268)
      • RuntimeBroker.exe (PID: 3032)
      • audiodg.exe (PID: 6168)
      • svchost.exe (PID: 3140)
      • svchost.exe (PID: 4348)
      • svchost.exe (PID: 4916)
      • UserOOBEBroker.exe (PID: 1248)
      • svchost.exe (PID: 6344)
      • WmiPrvSE.exe (PID: 4380)

    • Uses Task Scheduler to run other applications

      • explorer.exe (PID: 5492)

    • Runs injected code in another process

      • dialer.exe (PID: 5376)

  • SUSPICIOUS

    • BASE64 encoded PowerShell command has been detected

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Base64-obfuscated command line is found

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Starts POWERSHELL.EXE for commands execution

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)
      • explorer.exe (PID: 5492)

    • Adds/modifies Windows certificates

      • lsass.exe (PID: 756)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2284)
      • win32.exe (PID: 4452)

    • Manipulates environment variables

      • powershell.exe (PID: 7084)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 5492)

    • Stops a currently running service

      • sc.exe (PID: 1040)
      • sc.exe (PID: 5260)
      • sc.exe (PID: 5400)
      • sc.exe (PID: 2644)
      • sc.exe (PID: 6468)

    • Script adds exclusion path to Windows Defender

      • explorer.exe (PID: 5492)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 4000)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1116)

    • Modifies hosts file to alter network resolution

      • win32.exe (PID: 4452)

  • INFO

    • Reads the computer name

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Reads the time zone

      • MoUsoCoreWorker.exe (PID: 5496)
      • WmiPrvSE.exe (PID: 6268)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)

    • Creates files in the program directory

      • MoUsoCoreWorker.exe (PID: 5496)
      • win32.exe (PID: 4452)

    • Process checks computer location settings

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2284)
      • powershell.exe (PID: 7084)

    • Checks supported languages

      • SecuriteInfo.com.Win32.Evo-gen.20014.21640.exe (PID: 4996)
      • win32.exe (PID: 4452)
      • uhssvc.exe (PID: 648)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2284)
      • powershell.exe (PID: 7084)

    • Disables trace logs

      • powershell.exe (PID: 2284)

    • Checks proxy server information

      • powershell.exe (PID: 2284)
      • slui.exe (PID: 496)

    • Reads the software policy settings

      • lsass.exe (PID: 756)
      • slui.exe (PID: 496)
      • slui.exe (PID: 1280)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • powershell.exe (PID: 2284)

    • Manual execution by a user

      • powershell.exe (PID: 7084)
      • cmd.exe (PID: 1116)
      • dialer.exe (PID: 5376)
      • schtasks.exe (PID: 4000)
      • schtasks.exe (PID: 720)
      • cmd.exe (PID: 5136)

    • The executable file from the user directory is run by the Powershell process

      • win32.exe (PID: 4452)

    • Create files in a temporary directory

      • win32.exe (PID: 4452)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3112)

    • Creates files or folders in the user directory

      • lsass.exe (PID: 756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (61.6)
.dll | Win32 Dynamic Link Library (generic) (14.6)
.exe | Win32 Executable (generic) (10)
.exe | Win16/32 Executable Delphi generic (4.6)
.exe | Generic Win/DOS Executable (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 1024
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0x1159
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
112
Malicious processes
6
Suspicious processes
86

Behavior graph

Click at the process to see the details
start securiteinfo.com.win32.evo-gen.20014.21640.exe powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe wmiprvse.exe win32.exe wmiprvse.exe powershell.exe conhost.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs dialer.exe schtasks.exe conhost.exe no specs schtasks.exe conhost.exe no specs cmd.exe conhost.exe no specs choice.exe no specs slui.exe svchost.exe uhssvc.exe lsass.exe svchost.exe ctfmon.exe runtimebroker.exe svchost.exe svchost.exe useroobebroker.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe spoolsv.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe dashost.exe runtimebroker.exe svchost.exe svchost.exe officeclicktorun.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe sihost.exe svchost.exe runtimebroker.exe explorer.exe mousocoreworker.exe dllhost.exe securiteinfo.com.win32.evo-gen.20014.21640.exe no specs svchost.exe runtimebroker.exe audiodg.exe dllhost.exe svchost.exe svchost.exe svchost.exe dwm.exe svchost.exe winlogon.exe dllhost.exe applicationframehost.exe

Process information

PID
CMD
Path
Indicators
Parent process
468C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSMC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\lsm.dll
c:\windows\system32\msvcrt.dll
496C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
648"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Update Health Service
Version:
10.0.19041.3626 (WinBuild.160101.0800)
Modules
Images
c:\program files\microsoft update health tools\uhssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
720C:\WINDOWS\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\admin\AppData\Local\Temp\ysffqgghpxdj.xml"C:\Windows\System32\schtasks.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
756C:\WINDOWS\system32\lsass.exeC:\Windows\System32\lsass.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Local Security Authority Process
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lsasrv.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\sechost.dll
860C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvcC:\Windows\System32\svchost.exe
services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
956"ctfmon.exe"C:\Windows\System32\ctfmon.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CTF Loader
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1036C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1040sc stop UsoSvc C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1044C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s gpsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
23 707
Read events
23 390
Write events
210
Delete events
107

Modification events

(PID) Process:(5496) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator
Operation:delete valueName:EnhancedShutdownEnabled
Value:
(PID) Process:(5496) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator
Operation:writeName:ShutdownFlyoutOptions
Value:
0
(PID) Process:(2112) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator
Operation:writeName:Preshutdown
Value:
0
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator
Operation:writeName:SD
Value:
0100049C5C000000680000000000000014000000020048000300000000001400FF011F0001010000000000051200000000001400A900120001010000000000051300000000001800A900120001020000000000052000000020020000010100000000000512000000010100000000000512000000
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Operation:writeName:Index
Value:
3
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:writeName:Hash
Value:
3B6EE4045D97AA11A9FAE50DB375B526D55466B9856CF232E0B3DDF845CC6602
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:writeName:Schema
Value:
65538
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:delete valueName:Version
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:delete valueName:Date
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ABBBFFC-6D6B-4B2E-8A8A-41ECCF29EE97}
Operation:writeName:SecurityDescriptor
Value:
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
Executable files
3
Suspicious files
36
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Workxml
MD5:4838EE953DAB2C7A1BF57E0C6620A79D
SHA256:22C798E00C4793749EAC39CFB6EA3DD75112FD4453A3706E839038A64504D45D
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Workxml
MD5:5FADF13CCFBDCC5DD728380F7A615B28
SHA256:FF1F73395F6B5B22D5FDA367521FE0DCC31FF252849B7FA85FA346B953A40451
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Workxml
MD5:C6086D02F8CE044F5FA07A98303DC7EB
SHA256:8901D9C9AEA465DA4EA7AA874610A90B8CF0A71EBA0E321CF9675FCEEE0B54A0
2284powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_itq3nnvk.siz.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2920svchost.exeC:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb —
MD5:—
SHA256:—
1772svchost.exeC:\Windows\Prefetch\HOST.EXE-F5D74C61.pfbinary
MD5:BCAD82FAD05EC33A0690829AFBA58378
SHA256:FDB0469F4ADCF206746F1F533D22D35B8E352746C68319BC4A1C9D2A15A8F50B
1772svchost.exeC:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pfbinary
MD5:2BA40EBE64A9DBC6E2BEF55A6F43B3E9
SHA256:86002D01BE623553E4C11CBF362E9F5958DCBF65CC2A74C2B461768FF55195D0
2284powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3lp15hh5.kul.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2284powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lmghulvi.hxk.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1772svchost.exeC:\Windows\Prefetch\UPFC.EXE-BDDF79D6.pfbinary
MD5:468FA1AEA1FE317355EB25F8B6915C3A
SHA256:EC976AF82F3628B3ECC08693D73F0ABA284A9D23F9193CF0DE4507155DDCBA74
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2284
powershell.exe
140.82.121.3:443
github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.14
  • 20.190.160.131
  • 20.190.160.4
  • 20.190.160.67
  • 20.190.160.22
  • 40.126.32.134
  • 40.126.31.128
  • 20.190.159.131
  • 40.126.31.73
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.73
  • 20.190.159.71
  • 20.190.159.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
github.com
  • 140.82.121.3
whitelisted
objects.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Win32.Evo-gen.20014.21640